Analysis
-
max time kernel
150s -
max time network
141s -
platform
debian-9_armhf -
resource
debian9-armhf-20221111-en -
resource tags
arch:armhfimage:debian9-armhf-20221111-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
01-05-2023 11:51
General
-
Target
boatnet.arm7.elf
-
Size
45KB
-
MD5
91e737517e8235971e8c985971d57d0e
-
SHA1
9d2c16ac20ea674e0d429d60551e113a7a832335
-
SHA256
0a9349ddbaab4ff17a0a20fcc82ddcca680b866706a7b4650c69f1112bde17dd
-
SHA512
291806d8549e3b7a23b26708f748089b0280ef637c3451b6cbf2380686ad3306015bd311b585343bef74f2bbaeef86017bee8a5cc7f0e1f5cd72338b56ca1e23
-
SSDEEP
768:D/TYCoIxdEk+AxoTZAZHFeq8b3Cj9q3UELbUXfi6nVMQHI4vcGpvt:DECFd+A6YHAx9LRQZt
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
-
Writes file to system bin folder 1 TTPs 2 IoCs
Processes:
description ioc File opened for modification /sbin/watchdog File opened for modification /bin/watchdog -
Reads runtime system information 15 IoCs
Reads data from /proc virtual filesystem.
Processes:
boatnet.arm7.elfdescription ioc File opened for reading /proc/458/cmdline File opened for reading /proc/473/cmdline File opened for reading /proc/484/cmdline File opened for reading /proc/401/cmdline File opened for reading /proc/446/cmdline File opened for reading /proc/447/cmdline File opened for reading /proc/494/cmdline File opened for reading /proc/self/exe boatnet.arm7.elf File opened for reading /proc/413/cmdline File opened for reading /proc/471/cmdline File opened for reading /proc/435/cmdline File opened for reading /proc/470/cmdline File opened for reading /proc/423/cmdline File opened for reading /proc/425/cmdline File opened for reading /proc/450/cmdline
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/353-1-0x00008000-0x00026464-memory.dmp