Analysis
-
max time kernel
152s -
max time network
102s -
platform
linux_amd64 -
resource
ubuntu1804-amd64-en-20211208 -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
04-05-2023 07:24
General
-
Target
boatnet.x86.elf
-
Size
20KB
-
MD5
eeef4829a7ee2d9e3a14e14b1df870a7
-
SHA1
89bc0b2548ed093f92e72c45a96c0a3c9d990f01
-
SHA256
9cc78e45692ac0abb22bb438f7915e5fd4f78ec078aa52ceb2b704787fd63f4f
-
SHA512
3075eefc866c3ef2444f89b18bc8904960f94912819fb02be7bdfa62ba7c13855494e131361d06de70675ccc18cc08f1ed3952fda059fad578ea43fabb053f19
-
SSDEEP
384:Mg9Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTx:798o08kxofBE+ZkXaITbp2F2TWul0c51
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
-
Writes file to system bin folder 1 TTPs 2 IoCs
Processes:
description ioc File opened for modification /sbin/watchdog File opened for modification /bin/watchdog -
Reads runtime system information 13 IoCs
Reads data from /proc virtual filesystem.
Processes:
description ioc File opened for reading /proc/460/cmdline File opened for reading /proc/593/cmdline File opened for reading /proc/595/cmdline File opened for reading /proc/600/cmdline File opened for reading /proc/601/cmdline File opened for reading /proc/409/cmdline File opened for reading /proc/424/cmdline File opened for reading /proc/565/cmdline File opened for reading /proc/592/cmdline File opened for reading /proc/594/cmdline File opened for reading /proc/616/cmdline File opened for reading /proc/620/cmdline File opened for reading /proc/422/cmdline
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/597-1-0x0000000008048000-0x00000000080547a0-memory.dmp