Analysis
-
max time kernel
152s -
max time network
9s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20221111-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20221111-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
14-05-2023 01:41
General
-
Target
a2efaabd3d465feca2094fae9b60eb72a07cec8e386990069c9829ed21077bdf.elf
-
Size
20KB
-
MD5
96efa2d38b90b40eff74b4b4f96c8012
-
SHA1
a5501909a848ac1d72bf4b1e9696734380cecb14
-
SHA256
a2efaabd3d465feca2094fae9b60eb72a07cec8e386990069c9829ed21077bdf
-
SHA512
c2e649f40bf3a73dbf0c722b4a5a7fa8f261d0188fa10a2ae92fb35fec2c5ee5b56c2522e72a1bff5e145c97edeb90f409b63fb6022251779fc72172824aa457
-
SSDEEP
384:MgWLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTJ:O98o08kxofBE+ZkXaITbp2F2TWul0c5F
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
-
Writes file to system bin folder 1 TTPs 2 IoCs
Processes:
description ioc File opened for modification /sbin/watchdog File opened for modification /bin/watchdog -
Reads runtime system information 12 IoCs
Reads data from /proc virtual filesystem.
Processes:
description ioc File opened for reading /proc/447/cmdline File opened for reading /proc/594/cmdline File opened for reading /proc/595/cmdline File opened for reading /proc/602/cmdline File opened for reading /proc/576/cmdline File opened for reading /proc/596/cmdline File opened for reading /proc/597/cmdline File opened for reading /proc/603/cmdline File opened for reading /proc/412/cmdline File opened for reading /proc/424/cmdline File opened for reading /proc/427/cmdline File opened for reading /proc/450/cmdline
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/599-1-0x0000000008048000-0x00000000080547a0-memory.dmp