Analysis
-
max time kernel
152s -
max time network
11s -
platform
debian-9_armhf -
resource
debian9-armhf-20231026-en -
resource tags
arch:armhfimage:debian9-armhf-20231026-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
23/11/2023, 18:51
General
-
Target
boatnet.arm7.elf
-
Size
45KB
-
MD5
dc77e67843b5888482ef09df0ee11f11
-
SHA1
d2c3d467b94cce382daaa1bc625b9f871c77eba9
-
SHA256
3cda4f664e68392fed077781143242268842a8a13e998508ce4128d84257004a
-
SHA512
2150c49dc33e4c9ef5113efbe2f860f7fbeed2467d82a9791e2e9be01a7ebd1c4c48a0f163f32be41d915aaf2ac8e17388d84e779a31a93d9c41b227adeb9318
-
SSDEEP
768:g/TYCoIxdEk+AxoTZAZHFeq8b3c19q3UELbUXfi6nVMQHI4vcGpv4:gECFd+A6YHAx3LRQZ4
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc File opened for modification /dev/watchdog File opened for modification /dev/misc/watchdog -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 1 TTPs 2 IoCs
description ioc File opened for modification /sbin/watchdog File opened for modification /bin/watchdog -
Reads runtime system information 39 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/481/cmdline Process not Found File opened for reading /proc/659/cmdline Process not Found File opened for reading /proc/665/cmdline Process not Found File opened for reading /proc/679/cmdline Process not Found File opened for reading /proc/782/cmdline Process not Found File opened for reading /proc/617/cmdline Process not Found File opened for reading /proc/657/cmdline Process not Found File opened for reading /proc/726/cmdline Process not Found File opened for reading /proc/738/cmdline Process not Found File opened for reading /proc/786/cmdline Process not Found File opened for reading /proc/780/cmdline Process not Found File opened for reading /proc/self/exe boatnet.arm7.elf File opened for reading /proc/430/cmdline Process not Found File opened for reading /proc/442/cmdline Process not Found File opened for reading /proc/478/cmdline Process not Found File opened for reading /proc/687/cmdline Process not Found File opened for reading /proc/709/cmdline Process not Found File opened for reading /proc/730/cmdline Process not Found File opened for reading /proc/788/cmdline Process not Found File opened for reading /proc/656/cmdline Process not Found File opened for reading /proc/716/cmdline Process not Found File opened for reading /proc/792/cmdline Process not Found File opened for reading /proc/800/cmdline Process not Found File opened for reading /proc/715/cmdline Process not Found File opened for reading /proc/750/cmdline Process not Found File opened for reading /proc/768/cmdline Process not Found File opened for reading /proc/798/cmdline Process not Found File opened for reading /proc/772/cmdline Process not Found File opened for reading /proc/774/cmdline Process not Found File opened for reading /proc/779/cmdline Process not Found File opened for reading /proc/784/cmdline Process not Found File opened for reading /proc/790/cmdline Process not Found File opened for reading /proc/794/cmdline Process not Found File opened for reading /proc/796/cmdline Process not Found File opened for reading /proc/662/cmdline Process not Found File opened for reading /proc/685/cmdline Process not Found File opened for reading /proc/733/cmdline Process not Found File opened for reading /proc/742/cmdline Process not Found File opened for reading /proc/660/cmdline Process not Found