Analysis
-
max time kernel
149s -
max time network
149s -
platform
debian-9_armhf -
resource
debian9-armhf-20221125-en -
resource tags
arch:armhfimage:debian9-armhf-20221125-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
12-05-2023 11:49
General
-
Target
2f2703da1f6cf96dcee594b5192ed591.elf
-
Size
45KB
-
MD5
2f2703da1f6cf96dcee594b5192ed591
-
SHA1
98379088ba73ec2d9780b3247e9767b0a4e3ca64
-
SHA256
fea546be8d4769a5380a464f09b8e3c98b6faacf36c8e0b1096bbee3bebd5fb0
-
SHA512
23e13de316f655104aa2d6eb138f14ae1b19fa6b5e6816105b6d22d0faf85ab4418e4b949f1fb37516c08a8be34979e6d06402e3a9f6830a72880cbef1803066
-
SSDEEP
768:D/TYCoIxdEk+AxoTZAZHFeq8b3/n9q3UELbUXfi6nVMQHI4vcGpvI:DECFd+A6YHAxuLRQZI
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
-
Writes file to system bin folder 1 TTPs 2 IoCs
Processes:
description ioc File opened for modification /sbin/watchdog File opened for modification /bin/watchdog -
Reads runtime system information 27 IoCs
Reads data from /proc virtual filesystem.
Processes:
2f2703da1f6cf96dcee594b5192ed591.elfdescription ioc File opened for reading /proc/491/cmdline File opened for reading /proc/500/cmdline File opened for reading /proc/401/cmdline File opened for reading /proc/453/cmdline File opened for reading /proc/495/cmdline File opened for reading /proc/501/cmdline File opened for reading /proc/430/cmdline File opened for reading /proc/431/cmdline File opened for reading /proc/461/cmdline File opened for reading /proc/471/cmdline File opened for reading /proc/493/cmdline File opened for reading /proc/418/cmdline File opened for reading /proc/428/cmdline File opened for reading /proc/419/cmdline File opened for reading /proc/481/cmdline File opened for reading /proc/489/cmdline File opened for reading /proc/self/exe 2f2703da1f6cf96dcee594b5192ed591.elf File opened for reading /proc/497/cmdline File opened for reading /proc/440/cmdline File opened for reading /proc/441/cmdline File opened for reading /proc/486/cmdline File opened for reading /proc/487/cmdline File opened for reading /proc/499/cmdline File opened for reading /proc/503/cmdline File opened for reading /proc/505/cmdline File opened for reading /proc/408/cmdline File opened for reading /proc/445/cmdline
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/368-1-0x00008000-0x00026464-memory.dmp