Analysis
- max time kernel
5s - max time network
128s - platform
ubuntu-22.04_amd64 - resource
ubuntu2204-amd64-20261019-en - resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20261019-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system - submitted
26/10/2026, 16:19
Static task
static1
Behavioral task
behavioral1
Sample
px86
Resource
ubuntu2204-amd64-20261019-en
ubuntu-22.04-amd64
6 signatures
150 seconds
General
- Target px86
- Size 135KB
- Sample261026-tsglvsbd97
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 1608 px86 - Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog px86 File opened for modification /dev/watchdog px86 - Enumerates running processes
Discovers information about currently running processes on the system
- Reads process memory 1 TTPs 64 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/74/maps px86 File opened for reading /proc/101/maps px86 File opened for reading /proc/110/maps px86 File opened for reading /proc/409/maps px86 File opened for reading /proc/506/maps px86 File opened for reading /proc/737/maps px86 File opened for reading /proc/813/maps px86 File opened for reading /proc/25/maps px86 File opened for reading /proc/81/maps px86 File opened for reading /proc/114/maps px86 File opened for reading /proc/212/maps px86 File opened for reading /proc/766/maps px86 File opened for reading /proc/982/maps px86 File opened for reading /proc/8/maps px86 File opened for reading /proc/98/maps px86 File opened for reading /proc/798/maps px86 File opened for reading /proc/588/maps px86 File opened for reading /proc/10/maps px86 File opened for reading /proc/17/maps px86 File opened for reading /proc/83/maps px86 File opened for reading /proc/587/maps px86 File opened for reading /proc/818/maps px86 File opened for reading /proc/16/maps px86 File opened for reading /proc/22/maps px86 File opened for reading /proc/313/maps px86 File opened for reading /proc/413/maps px86 File opened for reading /proc/3/maps px86 File opened for reading /proc/21/maps px86 File opened for reading /proc/680/maps px86 File opened for reading /proc/12/maps px86 File opened for reading /proc/376/maps px86 File opened for reading /proc/407/maps px86 File opened for reading /proc/592/maps px86 File opened for reading /proc/13/maps px86 File opened for reading /proc/99/maps px86 File opened for reading /proc/549/maps px86 File opened for reading /proc/829/maps px86 File opened for reading /proc/833/maps px86 File opened for reading /proc/450/maps px86 File opened for reading /proc/93/maps px86 File opened for reading /proc/94/maps px86 File opened for reading /proc/427/maps px86 File opened for reading /proc/1/maps px86 File opened for reading /proc/5/maps px86 File opened for reading /proc/18/maps px86 File opened for reading /proc/88/maps px86 File opened for reading /proc/611/maps px86 File opened for reading /proc/956/maps px86 File opened for reading /proc/11/maps px86 File opened for reading /proc/14/maps px86 File opened for reading /proc/102/maps px86 File opened for reading /proc/2/maps px86 File opened for reading /proc/732/maps px86 File opened for reading /proc/921/maps px86 File opened for reading /proc/76/maps px86 File opened for reading /proc/82/maps px86 File opened for reading /proc/194/maps px86 File opened for reading /proc/646/maps px86 File opened for reading /proc/85/maps px86 File opened for reading /proc/95/maps px86 File opened for reading /proc/171/maps px86 File opened for reading /proc/416/maps px86 File opened for reading /proc/741/maps px86 File opened for reading /proc/928/maps px86 - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself scanbot 1608 px86 -
description ioc Process File opened for reading /proc/1101/maps px86 File opened for reading /proc/1139/maps px86 File opened for reading /proc/1159/maps px86 File opened for reading /proc/1049/maps px86 File opened for reading /proc/1082/maps px86 File opened for reading /proc/1136/maps px86 File opened for reading /proc/1223/maps px86 File opened for reading /proc/1075/maps px86 File opened for reading /proc/1135/maps px86 File opened for reading /proc/1169/maps px86 File opened for reading /proc/1217/maps px86 File opened for reading /proc/1274/maps px86 File opened for reading /proc/1114/maps px86 File opened for reading /proc/1422/maps px86 File opened for reading /proc/1606/maps px86 File opened for reading /proc/1013/maps px86 File opened for reading /proc/1151/maps px86 File opened for reading /proc/1194/maps px86 File opened for reading /proc/1209/maps px86 File opened for reading /proc/1250/maps px86 File opened for reading /proc/1605/maps px86 File opened for reading /proc/1047/maps px86 File opened for reading /proc/1061/maps px86 File opened for reading /proc/1134/maps px86 File opened for reading /proc/1375/maps px86 File opened for reading /proc/1487/maps px86 File opened for reading /proc/1208/maps px86 File opened for reading /proc/1276/maps px86 File opened for reading /proc/1425/maps px86 File opened for reading /proc/1612/maps px86 File opened for reading /proc/1031/maps px86 File opened for reading /proc/1068/maps px86 File opened for reading /proc/1376/maps px86 File opened for reading /proc/1022/maps px86 File opened for reading /proc/1086/maps px86 File opened for reading /proc/1168/maps px86 File opened for reading /proc/1474/maps px86 File opened for reading /proc/1462/maps px86 File opened for reading /proc/1002/maps px86 File opened for reading /proc/1023/maps px86 File opened for reading /proc/1133/maps px86 File opened for reading /proc/1173/maps px86 File opened for reading /proc/1236/maps px86 File opened for reading /proc/1007/maps px86 File opened for reading /proc/1156/maps px86 File opened for reading /proc/1523/maps px86 File opened for reading /proc/1112/maps px86 File opened for reading /proc/1508/maps px86 File opened for reading /proc/1053/maps px86 File opened for reading /proc/1160/maps px86 File opened for reading /proc/1141/maps px86 File opened for reading /proc/1142/maps px86 File opened for reading /proc/1348/maps px86 File opened for reading /proc/1154/maps px86 File opened for reading /proc/1172/maps px86 File opened for reading /proc/1242/maps px86 File opened for reading /proc/1544/maps px86 File opened for reading /proc/1132/maps px86 File opened for reading /proc/1153/maps px86 File opened for reading /proc/1247/maps px86 File opened for reading /proc/1567/maps px86 File opened for reading /proc/mounts px86 File opened for reading /proc/1094/maps px86