Analysis
- max time kernel
53s - max time network
150s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20261019-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
13/11/2026, 12:11
Static task
static1
Behavioral task
behavioral1
Sample
x86
Resource
ubuntu1804-amd64-20261019-en
6 signatures
150 seconds
General
- Target x86
- Size 40KB
- Sample261113-pc26eaad69
- SHA256 61e3d5824f6774751409577b1952efec8b8f658de291dd28b3b86b6a8169007d
- MD5 4d3d6b5e102533395bd214635a351064
- SHA1 63901fb89acee49543167fc8275b4650d93da01a
- SHA512 d71e59d306ab64d7dcba219220bd45546b201a5801d0db80693b95d38a056a836c584cbb9592c17a226988d404bab6e521533eee64366f37300a708ff326c2a4
- SSDEEP 768:QQaiSup66OkEgy5oD5YQuj4JAUTeU4wQOn8spVI/4bOGd7nX:QQaiSuptOkEX6D5YQ/JAUeUDt8spDbOY
- TLSH T1D2133AC1A643D1F2EC5212F5147B67628F76E4364A7DFA92EBA92531FC03B10960B39C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Contacts a large (112377) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog x86 File opened for modification /dev/misc/watchdog x86 - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /var/Sofia 1544 x86 -
description ioc Process File opened for reading /proc/478/cmdline x86 File opened for reading /proc/632/cmdline x86 File opened for reading /proc/561/cmdline x86 File opened for reading /proc/708/cmdline x86 File opened for reading /proc/909/cmdline x86 File opened for reading /proc/968/cmdline x86 File opened for reading /proc/1/cmdline x86 File opened for reading /proc/20/cmdline x86 File opened for reading /proc/901/cmdline x86 File opened for reading /proc/1089/cmdline x86 File opened for reading /proc/1286/cmdline x86 File opened for reading /proc/1320/cmdline x86 File opened for reading /proc/11/cmdline x86 File opened for reading /proc/28/cmdline x86 File opened for reading /proc/1033/cmdline x86 File opened for reading /proc/1052/cmdline x86 File opened for reading /proc/1301/cmdline x86 File opened for reading /proc/3/cmdline x86 File opened for reading /proc/161/cmdline x86 File opened for reading /proc/171/cmdline x86 File opened for reading /proc/928/cmdline x86 File opened for reading /proc/977/cmdline x86 File opened for reading /proc/1134/cmdline x86 File opened for reading /proc/163/cmdline x86 File opened for reading /proc/8/cmdline x86 File opened for reading /proc/15/cmdline x86 File opened for reading /proc/78/cmdline x86 File opened for reading /proc/432/cmdline x86 File opened for reading /proc/467/cmdline x86 File opened for reading /proc/856/cmdline x86 File opened for reading /proc/1541/cmdline x86 File opened for reading /proc/948/cmdline x86 File opened for reading /proc/1159/cmdline x86 File opened for reading /proc/1542/cmdline x86 File opened for reading /proc/26/cmdline x86 File opened for reading /proc/115/cmdline x86 File opened for reading /proc/463/cmdline x86 File opened for reading /proc/653/cmdline x86 File opened for reading /proc/1047/cmdline x86 File opened for reading /proc/1214/cmdline x86 File opened for reading /proc/27/cmdline x86 File opened for reading /proc/268/cmdline x86 File opened for reading /proc/647/cmdline x86 File opened for reading /proc/651/cmdline x86 File opened for reading /proc/971/cmdline x86 File opened for reading /proc/1054/cmdline x86 File opened for reading /proc/16/cmdline x86 File opened for reading /proc/24/cmdline x86 File opened for reading /proc/1017/cmdline x86 File opened for reading /proc/1093/cmdline x86 File opened for reading /proc/170/cmdline x86 File opened for reading /proc/430/cmdline x86 File opened for reading /proc/1037/cmdline x86 File opened for reading /proc/4/cmdline x86 File opened for reading /proc/98/cmdline x86 File opened for reading /proc/965/cmdline x86 File opened for reading /proc/1050/cmdline x86 File opened for reading /proc/21/cmdline x86 File opened for reading /proc/157/cmdline x86 File opened for reading /proc/172/cmdline x86 File opened for reading /proc/458/cmdline x86 File opened for reading /proc/649/cmdline x86 File opened for reading /proc/1074/cmdline x86 File opened for reading /proc/6/cmdline x86