Analysis
-
max time kernel
20954s -
max time network
134s -
platform
linux_amd64 -
resource
ubuntu1804-amd64-en-20211208 -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
08-08-2022 05:30
Static task
static1
Behavioral task
behavioral1
Sample
boatnet.x86_64
Resource
ubuntu1804-amd64-en-20211208
ubuntu-18.04-amd64
3 signatures
150 seconds
General
-
Target
boatnet.x86_64
-
Size
22KB
-
MD5
5df24a13b6fc7fa85827ed880db04c12
-
SHA1
be40a63622485ec72e4c9badc6b2e6700c843f55
-
SHA256
c6348240a5102a7b8a00ea12ca30bd4db6a4776434bac64e5774535e3df356ee
-
SHA512
6c0aa876a6f4cce7425e7f0abb3a85f7ed026c6dcfcb15745068d169df351997e605fed1e39c70c0e9df442959c1c97d4b8ec10d267608b9f6c1a1dd0a316884
Score
9/10
Malware Config
Signatures
-
Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
-
Writes file to system bin folder 1 TTPs 2 IoCs
Processes:
description ioc /sbin/watchdog /sbin/watchdog /bin/watchdog /bin/watchdog -
Reads runtime system information 16 IoCs
Reads data from /proc virtual filesystem.
Processes:
description ioc /proc/611/cmdline /proc/611/cmdline /proc/673/cmdline /proc/673/cmdline /proc/677/cmdline /proc/677/cmdline /proc/460/cmdline /proc/460/cmdline /proc/565/cmdline /proc/565/cmdline /proc/596/cmdline /proc/596/cmdline /proc/634/cmdline /proc/634/cmdline /proc/685/cmdline /proc/685/cmdline /proc/424/cmdline /proc/424/cmdline /proc/591/cmdline /proc/591/cmdline /proc/597/cmdline /proc/597/cmdline /proc/ /proc/ /proc/422/cmdline /proc/422/cmdline /proc/602/cmdline /proc/602/cmdline /proc/615/cmdline /proc/615/cmdline /proc/409/cmdline /proc/409/cmdline