Analysis
-
max time kernel
152s -
max time network
134s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20221111-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20221111-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
12-05-2023 11:41
General
-
Target
a90e415ff17734be20f1c6dc66964db8.elf
-
Size
21KB
-
MD5
a90e415ff17734be20f1c6dc66964db8
-
SHA1
e4c6c2598161672c12d931588aaba534233d4426
-
SHA256
475f28781e8d14d52788ef589bbb4f41049aa90c6dd1359927915431b2410f40
-
SHA512
ab079e48c40b6a87c64a3a0097794c36dc1056b15fc43057da41339cf5c25b2089d7ae6cdbb1710dfc206454adc2ad44ef43f10a320c06666dcd1dadb3f13afc
-
SSDEEP
384:MOcDqRfKUWFH39z+/49ETVQrGLruI8qB+eANnlBQpMr//Ayk+v1RpA:zMkKJFH39CBVQey7qsZoMT4ypA
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
-
Writes file to system bin folder 1 TTPs 2 IoCs
Processes:
description ioc File opened for modification /sbin/watchdog File opened for modification /bin/watchdog -
Reads runtime system information 14 IoCs
Reads data from /proc virtual filesystem.
Processes:
description ioc File opened for reading /proc/412/cmdline File opened for reading /proc/413/cmdline File opened for reading /proc/429/cmdline File opened for reading /proc/585/cmdline File opened for reading /proc/608/cmdline File opened for reading /proc/612/cmdline File opened for reading /proc/566/cmdline File opened for reading /proc/583/cmdline File opened for reading /proc/586/cmdline File opened for reading /proc/406/cmdline File opened for reading /proc/430/cmdline File opened for reading /proc/584/cmdline File opened for reading /proc/591/cmdline File opened for reading /proc/592/cmdline
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/588-1-0x0000000008048000-0x0000000008056c40-memory.dmp