Analysis
- max time kernel
131s - max time network
151s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20261019-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
25/10/2026, 11:08
Behavioral task
behavioral1
Sample
Fantazy.i686.elf
Resource
ubuntu1804-amd64-20261019-en
8 signatures
150 seconds
General
- Target Fantazy.i686.elf
- Size 60KB
- Sample261025-m8rnfaft3t
- SHA256 dc8626842cd1c53c2e02eae80e4e635bda5d9921a3553236e090e50a41313db0
- MD5 b5cf0ad64138fb5a699bad5de4f74d08
- SHA1 ee797892676e24b506e8120feed1d5ae50d2c255
- SHA512 8e17cfbc68c153318b9af6e1b3b191f0f5d624fa523eecc5dd3b7d447a72a9b2b95a943752b911d297c668da5baf0babb0631723170109a9009e21c79dc14d4c
- SSDEEP 1536:+8tlDaAbLfE/YkNlvFU329Txh3zIh22b8:+8tleH/Yn329TP3zIhfb8
- TLSH T1D4533C85F5C385F6C81B4938A0DBB37FC631D9A94031599EEF8BAE36D63BA41011239D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Contacts a large (23687) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog Fantazy.i686.elf File opened for modification /dev/misc/watchdog Fantazy.i686.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog Fantazy.i686.elf File opened for modification /bin/watchdog Fantazy.i686.elf - Reads process memory 1 TTPs 39 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/526/maps Fantazy.i686.elf File opened for reading /proc/433/maps Fantazy.i686.elf File opened for reading /proc/437/maps Fantazy.i686.elf File opened for reading /proc/454/maps Fantazy.i686.elf File opened for reading /proc/471/maps Fantazy.i686.elf File opened for reading /proc/905/maps Fantazy.i686.elf File opened for reading /proc/967/maps Fantazy.i686.elf File opened for reading /proc/446/maps Fantazy.i686.elf File opened for reading /proc/447/maps Fantazy.i686.elf File opened for reading /proc/453/maps Fantazy.i686.elf File opened for reading /proc/557/maps Fantazy.i686.elf File opened for reading /proc/927/maps Fantazy.i686.elf File opened for reading /proc/988/maps Fantazy.i686.elf File opened for reading /proc/597/maps Fantazy.i686.elf File opened for reading /proc/856/maps Fantazy.i686.elf File opened for reading /proc/639/maps Fantazy.i686.elf File opened for reading /proc/711/maps Fantazy.i686.elf File opened for reading /proc/598/maps Fantazy.i686.elf File opened for reading /proc/683/maps Fantazy.i686.elf File opened for reading /proc/458/maps Fantazy.i686.elf File opened for reading /proc/482/maps Fantazy.i686.elf File opened for reading /proc/500/maps Fantazy.i686.elf File opened for reading /proc/520/maps Fantazy.i686.elf File opened for reading /proc/970/maps Fantazy.i686.elf File opened for reading /proc/497/maps Fantazy.i686.elf File opened for reading /proc/641/maps Fantazy.i686.elf File opened for reading /proc/960/maps Fantazy.i686.elf File opened for reading /proc/973/maps Fantazy.i686.elf File opened for reading /proc/495/maps Fantazy.i686.elf File opened for reading /proc/445/maps Fantazy.i686.elf File opened for reading /proc/451/maps Fantazy.i686.elf File opened for reading /proc/541/maps Fantazy.i686.elf File opened for reading /proc/572/maps Fantazy.i686.elf File opened for reading /proc/719/maps Fantazy.i686.elf File opened for reading /proc/900/maps Fantazy.i686.elf File opened for reading /proc/496/maps Fantazy.i686.elf File opened for reading /proc/519/maps Fantazy.i686.elf File opened for reading /proc/922/maps Fantazy.i686.elf File opened for reading /proc/984/maps Fantazy.i686.elf - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a 1520 Fantazy.i686.elf -
description ioc Process File opened for reading /proc/1987/maps Fantazy.i686.elf File opened for reading /proc/2090/maps Fantazy.i686.elf File opened for reading /proc/1025/maps Fantazy.i686.elf File opened for reading /proc/1033/maps Fantazy.i686.elf File opened for reading /proc/1076/maps Fantazy.i686.elf File opened for reading /proc/1631/maps Fantazy.i686.elf File opened for reading /proc/2085/maps Fantazy.i686.elf File opened for reading /proc/1095/maps Fantazy.i686.elf File opened for reading /proc/1251/maps Fantazy.i686.elf File opened for reading /proc/1306/maps Fantazy.i686.elf File opened for reading /proc/1579/maps Fantazy.i686.elf File opened for reading /proc/1645/maps Fantazy.i686.elf File opened for reading /proc/1747/maps Fantazy.i686.elf File opened for reading /proc/1875/maps Fantazy.i686.elf File opened for reading /proc/1897/maps Fantazy.i686.elf File opened for reading /proc/1716/maps Fantazy.i686.elf File opened for reading /proc/1175/maps Fantazy.i686.elf File opened for reading /proc/1575/maps Fantazy.i686.elf File opened for reading /proc/1618/maps Fantazy.i686.elf File opened for reading /proc/1702/maps Fantazy.i686.elf File opened for reading /proc/1744/maps Fantazy.i686.elf File opened for reading /proc/1750/maps Fantazy.i686.elf File opened for reading /proc/1960/maps Fantazy.i686.elf File opened for reading /proc/1064/maps Fantazy.i686.elf File opened for reading /proc/1089/maps Fantazy.i686.elf File opened for reading /proc/1522/maps Fantazy.i686.elf File opened for reading /proc/1525/maps Fantazy.i686.elf File opened for reading /proc/1544/maps Fantazy.i686.elf File opened for reading /proc/1749/maps Fantazy.i686.elf File opened for reading /proc/1202/maps Fantazy.i686.elf File opened for reading /proc/1571/maps Fantazy.i686.elf File opened for reading /proc/1943/maps Fantazy.i686.elf File opened for reading /proc/1961/maps Fantazy.i686.elf File opened for reading /proc/1980/maps Fantazy.i686.elf File opened for reading /proc/1326/maps Fantazy.i686.elf File opened for reading /proc/1548/maps Fantazy.i686.elf File opened for reading /proc/1617/maps Fantazy.i686.elf File opened for reading /proc/1900/maps Fantazy.i686.elf File opened for reading /proc/1516/maps Fantazy.i686.elf File opened for reading /proc/1720/maps Fantazy.i686.elf File opened for reading /proc/1859/maps Fantazy.i686.elf File opened for reading /proc/1978/maps Fantazy.i686.elf File opened for reading /proc/1068/maps Fantazy.i686.elf File opened for reading /proc/1542/maps Fantazy.i686.elf File opened for reading /proc/1648/maps Fantazy.i686.elf File opened for reading /proc/1713/maps Fantazy.i686.elf File opened for reading /proc/1723/maps Fantazy.i686.elf File opened for reading /proc/1311/maps Fantazy.i686.elf File opened for reading /proc/1609/maps Fantazy.i686.elf File opened for reading /proc/1724/maps Fantazy.i686.elf File opened for reading /proc/1939/maps Fantazy.i686.elf File opened for reading /proc/1974/maps Fantazy.i686.elf File opened for reading /proc/1053/maps Fantazy.i686.elf File opened for reading /proc/1191/maps Fantazy.i686.elf File opened for reading /proc/1638/maps Fantazy.i686.elf File opened for reading /proc/1673/maps Fantazy.i686.elf File opened for reading /proc/1687/maps Fantazy.i686.elf File opened for reading /proc/1745/maps Fantazy.i686.elf File opened for reading /proc/1947/maps Fantazy.i686.elf File opened for reading /proc/2093/maps Fantazy.i686.elf File opened for reading /proc/1029/maps Fantazy.i686.elf File opened for reading /proc/1524/maps Fantazy.i686.elf File opened for reading /proc/1759/maps Fantazy.i686.elf File opened for reading /proc/1067/maps Fantazy.i686.elf