Analysis
-
max time kernel
151s -
max time network
11s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20231215-en -
resource tags
arch:mipselimage:debian9-mipsel-20231215-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
16-02-2024 06:26
General
-
Target
e154e3122438a7f4f9d5e6cc7f3c511219862164e472b1e25f25d1aad4323ace.elf
-
Size
24KB
-
MD5
07281957e1b2acc3a3ea14c513981573
-
SHA1
c676131df0547577abb17477456fd9fe702d70f5
-
SHA256
e154e3122438a7f4f9d5e6cc7f3c511219862164e472b1e25f25d1aad4323ace
-
SHA512
b40385bc44520bbc9ae12cc021e39be519cf8bb7a55eb01f3ee523b6fefce71637b6f6a8796ef46e36360be24ed8066f340ab08c5f4736259785a6892a542dcb
-
SSDEEP
768:c4rQlS07dEv0UXqUhvQE+CXQKMQKCXBpSZq8Wv9:BQlS07FUXqIYSXQKqu2qn
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
description ioc File opened for modification /dev/watchdog File opened for modification /dev/misc/watchdog -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 1 TTPs 2 IoCs
Processes:
description ioc File opened for modification /sbin/watchdog File opened for modification /bin/watchdog -
Reads runtime system information 28 IoCs
Reads data from /proc virtual filesystem.
Processes:
description ioc File opened for reading /proc/651/cmdline File opened for reading /proc/655/cmdline File opened for reading /proc/688/cmdline File opened for reading /proc/734/cmdline File opened for reading /proc/735/cmdline File opened for reading /proc/773/cmdline File opened for reading /proc/682/cmdline File opened for reading /proc/706/cmdline File opened for reading /proc/779/cmdline File opened for reading /proc/799/cmdline File opened for reading /proc/718/cmdline File opened for reading /proc/751/cmdline File opened for reading /proc/654/cmdline File opened for reading /proc/722/cmdline File opened for reading /proc/741/cmdline File opened for reading /proc/763/cmdline File opened for reading /proc/668/cmdline File opened for reading /proc/689/cmdline File opened for reading /proc/754/cmdline File opened for reading /proc/785/cmdline File opened for reading /proc/686/cmdline File opened for reading /proc/692/cmdline File opened for reading /proc/647/cmdline File opened for reading /proc/683/cmdline File opened for reading /proc/703/cmdline File opened for reading /proc/740/cmdline File opened for reading /proc/755/cmdline File opened for reading /proc/767/cmdline
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/699-1-0x00400000-0x00452a58-memory.dmp