Analysis
- max time kernel
147s - max time network
149s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20261019-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
22/10/2026, 18:33
Behavioral task
behavioral1
Sample
x86_64
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
5 signatures
150 seconds
General
- Target x86_64
- Size 36KB
- Sample261022-w7cbssbc84
- SHA256 eeb4e7217972d1ea391859310759c9d58ae164ca0e1e68ba1e369df4c9d37a86
- MD5 5a48116ba60ffb5f7b9b69b6704a5ca0
- SHA1 a07df54bc22bf5ecbabb235679a71cf021952da3
- SHA512 34fbf351fe60e3decd588f720681e546d27e248e0c85d8f045e9c4b5f2d0d74753fb3e0362756abec57f486c85c740275c3000e5a5f32008d25b5fe403718c3f
- SSDEEP 768:kw2xI4Y3hW26uVyAHG+n+9zQmOauDNVFKg233aasx0K0:kw2xIz3hXVV679zQmPqrwg2SP0
- TLSH T1AAF2F173A37EFAE5D55DC3F10159A3CDF8B1781192232BB91CEA31B78C5A568F201A60
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
Botnet
-
LZRD
C2
-
176.65.139.35
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog x86_64 File opened for modification /dev/misc/watchdog x86_64 - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog x86_64 File opened for modification /bin/watchdog x86_64 -
description ioc Process File opened for reading /proc/653/status x86_64 File opened for reading /proc/927/status x86_64 File opened for reading /proc/1350/status x86_64 File opened for reading /proc/437/status x86_64 File opened for reading /proc/1076/status x86_64 File opened for reading /proc/1520/status x86_64 File opened for reading /proc/30/status x86_64 File opened for reading /proc/433/status x86_64 File opened for reading /proc/500/status x86_64 File opened for reading /proc/641/status x86_64 File opened for reading /proc/1047/status x86_64 File opened for reading /proc/495/status x86_64 File opened for reading /proc/1311/status x86_64 File opened for reading /proc/98/status x86_64 File opened for reading /proc/162/status x86_64 File opened for reading /proc/8/status x86_64 File opened for reading /proc/17/status x86_64 File opened for reading /proc/22/status x86_64 File opened for reading /proc/32/status x86_64 File opened for reading /proc/137/status x86_64 File opened for reading /proc/157/status x86_64 File opened for reading /proc/1012/status x86_64 File opened for reading /proc/160/status x86_64 File opened for reading /proc/86/status x86_64 File opened for reading /proc/200/status x86_64 File opened for reading /proc/488/status x86_64 File opened for reading /proc/1016/status x86_64 File opened for reading /proc/1051/status x86_64 File opened for reading /proc/1093/status x86_64 File opened for reading /proc/21/status x86_64 File opened for reading /proc/161/status x86_64 File opened for reading /proc/361/status x86_64 File opened for reading /proc/900/status x86_64 File opened for reading /proc/1067/status x86_64 File opened for reading /proc/1306/status x86_64 File opened for reading /proc/79/status x86_64 File opened for reading /proc/84/status x86_64 File opened for reading /proc/1043/status x86_64 File opened for reading /proc/1332/status x86_64 File opened for reading /proc/3/status x86_64 File opened for reading /proc/163/status x86_64 File opened for reading /proc/254/status x86_64 File opened for reading /proc/497/status x86_64 File opened for reading /proc/654/status x86_64 File opened for reading /proc/1037/status x86_64 File opened for reading /proc/1053/status x86_64 File opened for reading /proc/1064/status x86_64 File opened for reading /proc/167/status x86_64 File opened for reading /proc/967/status x86_64 File opened for reading /proc/1515/status x86_64 File opened for reading /proc/1533/status x86_64 File opened for reading /proc/164/status x86_64 File opened for reading /proc/941/status x86_64 File opened for reading /proc/1085/status x86_64 File opened for reading /proc/1304/status x86_64 File opened for reading /proc/1511/status x86_64 File opened for reading /proc/2/status x86_64 File opened for reading /proc/20/status x86_64 File opened for reading /proc/115/status x86_64 File opened for reading /proc/159/status x86_64 File opened for reading /proc/1025/status x86_64 File opened for reading /proc/14/status x86_64 File opened for reading /proc/7/status x86_64 File opened for reading /proc/9/status x86_64