Analysis
- max time kernel
149s - max time network
150s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20261019-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
11/11/2026, 10:46
Behavioral task
behavioral1
Sample
2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
7 signatures
150 seconds
General
- Target 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf
- Size 61KB
- Sample261111-mt2j4afs2m
- SHA256 268224c90f691f970206a73410aa7c40259aa9a998e01faf983afb5c7efb7c65
- MD5 13e3072f82f231693e0f859e5b8ae2e6
- SHA1 9074c03d5276ebd3f2e5528570a9bc7bb016a4a4
- SHA512 6eb30dda2fe2dfae20a0bffb690cc4d4455ec51715cadf95dc83af9b5fb2593e7a6b167f358446e26961e48fe4489997c95d1833a940d5ce2df7309086d1c916
- SSDEEP 1536:3A9qgufLYl4g0ePQY+SWs/9aVHf3kd/Qgo/W:CqjfLYlgIQY+SWs/UVHfs47O
- TLSH T1D0532AC5B193E8F5EC10097D307AAF62AEB3F13B7036DE8BD7D954739942602910629D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Contacts a large (20489) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for modification /dev/watchdog 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf - Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf -
description ioc Process File opened for reading /proc/1/fd 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/359/fd 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/457/fd 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/433/exe 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/530/exe 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/1957/exe 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/2026/exe 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/1206/fd 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/1596/exe 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/2161/exe 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/256/fd 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/1747/exe 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/1814/exe 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/484/fd 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/945/fd 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/1106/fd 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/1529/exe 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/1923/exe 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/1993/exe 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/2048/exe 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/1265/fd 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/1586/exe 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/1844/exe 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/2144/exe 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/485/fd 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/661/exe 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/1543/exe 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/2180/exe 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/1065/fd 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/1087/fd 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/1116/fd 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/1555/exe 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/1775/exe 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/1778/exe 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/959/fd 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/1071/fd 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/2029/exe 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/681/fd 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/1604/exe 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/1614/exe 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/1761/exe 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/1960/exe 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/2034/exe 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/2050/exe 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/486/fd 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/1339/fd 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/1344/fd 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/581/exe 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/620/exe 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/1260/exe 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/1795/exe 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/1820/exe 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/985/fd 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/1260/fd 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/1364/fd 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/1807/exe 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/444/exe 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/480/fd 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/596/fd 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/683/fd 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/730/fd 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/1109/fd 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/1157/fd 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf File opened for reading /proc/1175/fd 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf