Analysis
-
max time kernel
154s -
max time network
130s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20231215-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20231215-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
16-02-2024 06:27
General
-
Target
e24ba8d78c3b37db40b7e77018e501de3b4fa1c1a9d26d260987a6f8bb823cfe.elf
-
Size
20KB
-
MD5
0f5d3275316cf58b05781dc5c523e312
-
SHA1
d1a9f2b3396940a9e3533c8412e7e71baef2eed0
-
SHA256
e24ba8d78c3b37db40b7e77018e501de3b4fa1c1a9d26d260987a6f8bb823cfe
-
SHA512
e4f8907966602740c4b169a9abb6ad7f3785db49dbe03c3d3405b8cdd2b4d8b2d19ee25b0cbdd5154034e310ebaaee1a34bd751075765e87511336eb6e058aec
-
SSDEEP
384:Mg4Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAKE:M98o08kxofBE+ZkXaqGbp2F2TWul0c5p
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
description ioc File opened for modification /dev/watchdog File opened for modification /dev/misc/watchdog -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 1 TTPs 2 IoCs
Processes:
description ioc File opened for modification /sbin/watchdog File opened for modification /bin/watchdog -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
description ioc File opened for reading /proc/466/cmdline File opened for reading /proc/481/cmdline File opened for reading /proc/1330/cmdline File opened for reading /proc/654/cmdline File opened for reading /proc/951/cmdline File opened for reading /proc/1132/cmdline File opened for reading /proc/1169/cmdline File opened for reading /proc/1185/cmdline File opened for reading /proc/1523/cmdline File opened for reading /proc/417/cmdline File opened for reading /proc/963/cmdline File opened for reading /proc/1507/cmdline File opened for reading /proc/960/cmdline File opened for reading /proc/967/cmdline File opened for reading /proc/1128/cmdline File opened for reading /proc/1239/cmdline File opened for reading /proc/1571/cmdline File opened for reading /proc/1601/cmdline File opened for reading /proc/522/cmdline File opened for reading /proc/576/cmdline File opened for reading /proc/1154/cmdline File opened for reading /proc/1563/cmdline File opened for reading /proc/1595/cmdline File opened for reading /proc/1631/cmdline File opened for reading /proc/1625/cmdline File opened for reading /proc/649/cmdline File opened for reading /proc/952/cmdline File opened for reading /proc/1305/cmdline File opened for reading /proc/1310/cmdline File opened for reading /proc/460/cmdline File opened for reading /proc/595/cmdline File opened for reading /proc/1115/cmdline File opened for reading /proc/1356/cmdline File opened for reading /proc/674/cmdline File opened for reading /proc/1022/cmdline File opened for reading /proc/1140/cmdline File opened for reading /proc/1589/cmdline File opened for reading /proc/1168/cmdline File opened for reading /proc/1550/cmdline File opened for reading /proc/1150/cmdline File opened for reading /proc/906/cmdline File opened for reading /proc/1577/cmdline File opened for reading /proc/597/cmdline File opened for reading /proc/1136/cmdline File opened for reading /proc/1607/cmdline File opened for reading /proc/470/cmdline File opened for reading /proc/1145/cmdline File opened for reading /proc/1182/cmdline File opened for reading /proc/1194/cmdline File opened for reading /proc/713/cmdline File opened for reading /proc/717/cmdline File opened for reading /proc/1167/cmdline File opened for reading /proc/1583/cmdline File opened for reading /proc/427/cmdline File opened for reading /proc/1087/cmdline File opened for reading /proc/1153/cmdline File opened for reading /proc/1256/cmdline File opened for reading /proc/1353/cmdline File opened for reading /proc/1462/cmdline File opened for reading /proc/1551/cmdline File opened for reading /proc/464/cmdline File opened for reading /proc/1124/cmdline File opened for reading /proc/1164/cmdline File opened for reading /proc/1619/cmdline
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1547-1-0x0000000008048000-0x00000000080547a0-memory.dmp