Analysis
-
max time kernel
152s -
max time network
102s -
platform
linux_amd64 -
resource
ubuntu1804-amd64-en-20211208 -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
25-05-2023 21:56
General
-
Target
9f320bb8dcbda1e0f6c44436704eb185.elf
-
Size
20KB
-
MD5
9f320bb8dcbda1e0f6c44436704eb185
-
SHA1
b6edfcf32608c1657c05f9979c75029ed60e7b02
-
SHA256
34e7056ef1d1cc0c6f32aac935134593c575177e3c3ccc5237b38373436c85c6
-
SHA512
ca833bb22c85645e9a6e6ac9445d50263efd559c82b7e2ad897bbd1b0ef927e790db7b67a40e05bea5930209d753e066838a09f90729f9165032ff87c1d4b51b
-
SSDEEP
384:Mg4Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTG:M98o08kxofBE+ZkXaITbp2F2TWul0c5C
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
description ioc File opened for modification /dev/watchdog File opened for modification /dev/misc/watchdog -
Writes file to system bin folder 1 TTPs 2 IoCs
Processes:
description ioc File opened for modification /sbin/watchdog File opened for modification /bin/watchdog -
Reads runtime system information 17 IoCs
Reads data from /proc virtual filesystem.
Processes:
description ioc File opened for reading /proc/600/cmdline File opened for reading /proc/616/cmdline File opened for reading /proc/715/cmdline File opened for reading /proc/716/cmdline File opened for reading /proc/460/cmdline File opened for reading /proc/565/cmdline File opened for reading /proc/592/cmdline File opened for reading /proc/593/cmdline File opened for reading /proc/409/cmdline File opened for reading /proc/422/cmdline File opened for reading /proc/424/cmdline File opened for reading /proc/607/cmdline File opened for reading /proc/594/cmdline File opened for reading /proc/595/cmdline File opened for reading /proc/679/cmdline File opened for reading /proc/683/cmdline File opened for reading /proc/601/cmdline
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/597-1-0x0000000008048000-0x00000000080547a0-memory.dmp