Analysis
- max time kernel
149s - max time network
151s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20261019-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
02/11/2026, 12:47
Behavioral task
behavioral1
Sample
x86_64.elf
Resource
ubuntu1804-amd64-20261019-en
4 signatures
150 seconds
General
- Target x86_64.elf
- Size 165KB
- Sample261102-p1afastwex
- SHA256 5eb1b69d5dc001b2cb9560290ece4f3fec68f19f7beeda5874c36a85ac1ab6d5
- MD5 c4eef3f688165510381a395af87bcf4e
- SHA1 aa4d41072c0556ddcf5026730ac87ef52477928a
- SHA512 674a9fc9066fd92b2a629858b37c982dd3389f360a5ca050645072c9b3eeb7233b7342949cf6fa8865ca0f538c6929e00c661d932b5b84e6149e5f0ca82d1e23
- SSDEEP 3072:oRdcw8AQs+pFKfI0jG9gGybZGOLcyB4u73+fLtxwVvMnshQgFZRGQ4:Wdcw8lL6yLyBH7ujtSVksagdc
- TLSH T183F322A595B2A6FEE65E2ABB739CD4D07FF17E821E12B64FB01E63791C1C6050AC0740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog x86_64.elf File opened for modification /dev/watchdog x86_64.elf - Unexpected DNS network traffic destination 16 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 1.0.0.1 Destination IP 64.6.64.6 Destination IP 64.6.64.6 Destination IP 64.6.65.6 Destination IP 64.6.65.6 Destination IP 64.6.64.6 Destination IP 64.6.65.6 Destination IP 223.5.5.5 Destination IP 223.5.5.5 Destination IP 1.0.0.1 Destination IP 223.5.5.5 Destination IP 1.0.0.1 Destination IP 64.6.64.6 Destination IP 64.6.65.6 Destination IP 1.0.0.1 Destination IP 223.5.5.5 - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself p7phtcfvgv4p1of 1515 x86_64.elf -
description ioc Process File opened for reading /proc/self/exe x86_64.elf File opened for reading /proc/self/fd x86_64.elf