Analysis
-
max time kernel
150s -
max time network
150s -
platform
debian-9_armhf -
resource
debian9-armhf-20221125-en -
resource tags
arch:armhfimage:debian9-armhf-20221125-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
07-05-2023 13:29
General
-
Target
a749f42a19b967f2ba7ccfe5e8d6c6cb.elf
-
Size
45KB
-
MD5
a749f42a19b967f2ba7ccfe5e8d6c6cb
-
SHA1
68ca9c88855df3efc1bbe70530bc6b6d2c0137ec
-
SHA256
e0893425a4aeec7e6baba8a20c5aae56f748ebf8eac4384f91d40a931a5eeea3
-
SHA512
0aa08c1425f809dc3598a7f301964d721cf97443928a9d1f04a907fb2c31efb57e92c7cb50e0a8e7e4b1970f127990ac824f03459510e6c0fc96943f245a75f8
-
SSDEEP
768:D/TYCoIxdEk+AxoTZAZHFeq8b3DW9q3UELbUXfi6nVMQHI4vcGpv2:DECFd+A6YHAxHLRQZ2
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
-
Writes file to system bin folder 1 TTPs 2 IoCs
Processes:
description ioc File opened for modification /sbin/watchdog File opened for modification /bin/watchdog -
Reads runtime system information 27 IoCs
Reads data from /proc virtual filesystem.
Processes:
a749f42a19b967f2ba7ccfe5e8d6c6cb.elfdescription ioc File opened for reading /proc/493/cmdline File opened for reading /proc/429/cmdline File opened for reading /proc/443/cmdline File opened for reading /proc/447/cmdline File opened for reading /proc/449/cmdline File opened for reading /proc/436/cmdline File opened for reading /proc/471/cmdline File opened for reading /proc/499/cmdline File opened for reading /proc/428/cmdline File opened for reading /proc/455/cmdline File opened for reading /proc/463/cmdline File opened for reading /proc/497/cmdline File opened for reading /proc/489/cmdline File opened for reading /proc/495/cmdline File opened for reading /proc/503/cmdline File opened for reading /proc/505/cmdline File opened for reading /proc/438/cmdline File opened for reading /proc/420/cmdline File opened for reading /proc/491/cmdline File opened for reading /proc/401/cmdline File opened for reading /proc/421/cmdline File opened for reading /proc/501/cmdline File opened for reading /proc/self/exe a749f42a19b967f2ba7ccfe5e8d6c6cb.elf File opened for reading /proc/439/cmdline File opened for reading /proc/481/cmdline File opened for reading /proc/488/cmdline File opened for reading /proc/410/cmdline
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/368-1-0x00008000-0x00026464-memory.dmp