4b49891a0209264ea901a5b024f30a21af5f0a6a65d2355d8df7de81bda9abd6

Analysis

max time kernel
5s
max time network
128s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20261019-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
23/10/2026, 03:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4b49891a0209264ea901a5b024f30a21af5f0a6a65d2355d8df7de81bda9abd6.elf
Size 810KB
Sample261023-ds76tabx5l
SHA256 4b49891a0209264ea901a5b024f30a21af5f0a6a65d2355d8df7de81bda9abd6
MD5 18f3b7b87f5d1244c2beeef69e9b48c8
SHA1 c9c62449005740177125cc82c56e7d1705b650a8
SHA512 f30f3a8500841774c7359b97af34ab28c391b28b0bd1d7f76319290e44ab1cc19a2b18157aa6ae4823ed5933dcf550b305280122de7468ae8e8ac906b03e2196
SSDEEP 24576:8tSohwOgrhubhB3UCZyDV9Wx6uD5YPbzMp:ahwvrhubhBj8zD
TLSH
T183058D9DE783D6F2F25341B1124ECBF20534A11AF463F6F2EB442A5678B27522E1632D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1508	4b49891a0209264ea901a5b024f30a21af5f0a6a65d2355d8df7de81bda9abd6.elf

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/misc/watchdog	4b49891a0209264ea901a5b024f30a21af5f0a6a65d2355d8df7de81bda9abd6.elf
File opened for modification	/dev/watchdog	4b49891a0209264ea901a5b024f30a21af5f0a6a65d2355d8df7de81bda9abd6.elf

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	4b49891a0209264ea901a5b024f30a21af5f0a6a65d2355d8df7de81bda9abd6.elf

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	4b49891a0209264ea901a5b024f30a21af5f0a6a65d2355d8df7de81bda9abd6.elf

/tmp/4b49891a0209264ea901a5b024f30a21af5f0a6a65d2355d8df7de81bda9abd6.elf
/tmp/4b49891a0209264ea901a5b024f30a21af5f0a6a65d2355d8df7de81bda9abd6.elf
1⤵
- Deletes itself
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Reads system network configuration
PID:1508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads