Analysis
-
max time kernel
150s -
max time network
148s -
platform
debian-9_armhf -
resource
debian9-armhf-20221125-en -
resource tags
arch:armhfimage:debian9-armhf-20221125-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
14-05-2023 01:09
General
-
Target
fea546be8d4769a5380a464f09b8e3c98b6faacf36c8e0b1096bbee3bebd5fb0.elf
-
Size
45KB
-
MD5
2f2703da1f6cf96dcee594b5192ed591
-
SHA1
98379088ba73ec2d9780b3247e9767b0a4e3ca64
-
SHA256
fea546be8d4769a5380a464f09b8e3c98b6faacf36c8e0b1096bbee3bebd5fb0
-
SHA512
23e13de316f655104aa2d6eb138f14ae1b19fa6b5e6816105b6d22d0faf85ab4418e4b949f1fb37516c08a8be34979e6d06402e3a9f6830a72880cbef1803066
-
SSDEEP
768:D/TYCoIxdEk+AxoTZAZHFeq8b3/n9q3UELbUXfi6nVMQHI4vcGpvI:DECFd+A6YHAxuLRQZI
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
-
Writes file to system bin folder 1 TTPs 2 IoCs
Processes:
description ioc File opened for modification /sbin/watchdog File opened for modification /bin/watchdog -
Reads runtime system information 23 IoCs
Reads data from /proc virtual filesystem.
Processes:
fea546be8d4769a5380a464f09b8e3c98b6faacf36c8e0b1096bbee3bebd5fb0.elfdescription ioc File opened for reading /proc/422/cmdline File opened for reading /proc/444/cmdline File opened for reading /proc/463/cmdline File opened for reading /proc/471/cmdline File opened for reading /proc/481/cmdline File opened for reading /proc/self/exe fea546be8d4769a5380a464f09b8e3c98b6faacf36c8e0b1096bbee3bebd5fb0.elf File opened for reading /proc/421/cmdline File opened for reading /proc/485/cmdline File opened for reading /proc/497/cmdline File opened for reading /proc/458/cmdline File opened for reading /proc/459/cmdline File opened for reading /proc/401/cmdline File opened for reading /proc/402/cmdline File opened for reading /proc/420/cmdline File opened for reading /proc/434/cmdline File opened for reading /proc/451/cmdline File opened for reading /proc/455/cmdline File opened for reading /proc/403/cmdline File opened for reading /proc/404/cmdline File opened for reading /proc/418/cmdline File opened for reading /proc/445/cmdline File opened for reading /proc/498/cmdline File opened for reading /proc/499/cmdline
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/360-1-0x00008000-0x00026464-memory.dmp