Analysis
-
max time kernel
149s -
max time network
150s -
platform
debian-9_armhf -
resource
debian9-armhf-20221111-en -
resource tags
arch:armhfimage:debian9-armhf-20221111-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
09-05-2023 01:37
General
-
Target
e0893425a4aeec7e6baba8a20c5aae56f748ebf8eac4384f91d40a931a5eeea3.elf
-
Size
45KB
-
MD5
a749f42a19b967f2ba7ccfe5e8d6c6cb
-
SHA1
68ca9c88855df3efc1bbe70530bc6b6d2c0137ec
-
SHA256
e0893425a4aeec7e6baba8a20c5aae56f748ebf8eac4384f91d40a931a5eeea3
-
SHA512
0aa08c1425f809dc3598a7f301964d721cf97443928a9d1f04a907fb2c31efb57e92c7cb50e0a8e7e4b1970f127990ac824f03459510e6c0fc96943f245a75f8
-
SSDEEP
768:D/TYCoIxdEk+AxoTZAZHFeq8b3DW9q3UELbUXfi6nVMQHI4vcGpv2:DECFd+A6YHAxHLRQZ2
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
-
Writes file to system bin folder 1 TTPs 2 IoCs
Processes:
description ioc File opened for modification /sbin/watchdog File opened for modification /bin/watchdog -
Reads runtime system information 22 IoCs
Reads data from /proc virtual filesystem.
Processes:
e0893425a4aeec7e6baba8a20c5aae56f748ebf8eac4384f91d40a931a5eeea3.elfdescription ioc File opened for reading /proc/411/cmdline File opened for reading /proc/451/cmdline File opened for reading /proc/510/cmdline File opened for reading /proc/476/cmdline File opened for reading /proc/401/cmdline File opened for reading /proc/403/cmdline File opened for reading /proc/405/cmdline File opened for reading /proc/407/cmdline File opened for reading /proc/414/cmdline File opened for reading /proc/439/cmdline File opened for reading /proc/466/cmdline File opened for reading /proc/488/cmdline File opened for reading /proc/489/cmdline File opened for reading /proc/500/cmdline File opened for reading /proc/501/cmdline File opened for reading /proc/self/exe e0893425a4aeec7e6baba8a20c5aae56f748ebf8eac4384f91d40a931a5eeea3.elf File opened for reading /proc/416/cmdline File opened for reading /proc/462/cmdline File opened for reading /proc/429/cmdline File opened for reading /proc/463/cmdline File opened for reading /proc/474/cmdline File opened for reading /proc/499/cmdline
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/371-1-0x00008000-0x00026464-memory.dmp