Analysis
-
max time kernel
152s -
max time network
134s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20221111-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20221111-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
12-05-2023 08:55
General
-
Target
boatnet.x86.elf
-
Size
20KB
-
MD5
0fa4614d26fc768a2f3a05dd323c8a6e
-
SHA1
7bb6743b2fa2ae01d7782e0c4751cfc392138f82
-
SHA256
e8ccd48224848b6645c700c9fdb139b4990f0f4748e8dd51911bd1c26b22d06d
-
SHA512
931e8db3219d81f20698c66d73ef91ed3abe58d78251d2c68c203ff53858b091fbff3f111e9e028d90fc51952ae941424316f97109c7409d3665c71237f0b297
-
SSDEEP
384:M0DLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaQNAr8vcoBAvP+qNV+KLebRt8NSyi:x98o08kxofBE+ZkXaT47C2Epitqi
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
-
Writes file to system bin folder 1 TTPs 2 IoCs
Processes:
description ioc File opened for modification /sbin/watchdog File opened for modification /bin/watchdog -
Reads runtime system information 14 IoCs
Reads data from /proc virtual filesystem.
Processes:
description ioc File opened for reading /proc/587/cmdline File opened for reading /proc/429/cmdline File opened for reading /proc/585/cmdline File opened for reading /proc/592/cmdline File opened for reading /proc/612/cmdline File opened for reading /proc/406/cmdline File opened for reading /proc/586/cmdline File opened for reading /proc/584/cmdline File opened for reading /proc/593/cmdline File opened for reading /proc/608/cmdline File opened for reading /proc/412/cmdline File opened for reading /proc/430/cmdline File opened for reading /proc/413/cmdline File opened for reading /proc/566/cmdline
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/589-1-0x0000000008048000-0x00000000080547a0-memory.dmp