Analysis
-
max time kernel
149s -
max time network
129s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240221-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240221-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
24-02-2024 13:57
General
-
Target
c9e5528e20ea145f226f0b8e144994bc.elf
-
Size
20KB
-
MD5
c9e5528e20ea145f226f0b8e144994bc
-
SHA1
e0b37a76f542b172e782f4fce815f734e7c02070
-
SHA256
3e52af9db19a2219d051de8e7a579b533974ad23cc8b07c1abf2d05a3870d99b
-
SHA512
e5d0f9dfb637f2338524245d086a314c74867fbd3b7e3158a5dcf6253056b3f0daf0d95ef3a71b178d886b030ed1d0d5f49c38a8183cc57d1f428b6863b707e7
-
SSDEEP
384:MgWLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAKU:O98o08kxofBE+ZkXaqGbp2F2TWul0c5h
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
description ioc File opened for modification /dev/watchdog File opened for modification /dev/misc/watchdog -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 1 TTPs 2 IoCs
Processes:
description ioc File opened for modification /sbin/watchdog File opened for modification /bin/watchdog -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
description ioc File opened for reading /proc/1054/cmdline File opened for reading /proc/1132/cmdline File opened for reading /proc/1601/cmdline File opened for reading /proc/414/cmdline File opened for reading /proc/1121/cmdline File opened for reading /proc/1158/cmdline File opened for reading /proc/655/cmdline File opened for reading /proc/1153/cmdline File opened for reading /proc/1595/cmdline File opened for reading /proc/1191/cmdline File opened for reading /proc/1269/cmdline File opened for reading /proc/1454/cmdline File opened for reading /proc/484/cmdline File opened for reading /proc/1172/cmdline File opened for reading /proc/1184/cmdline File opened for reading /proc/1073/cmdline File opened for reading /proc/1128/cmdline File opened for reading /proc/1300/cmdline File opened for reading /proc/1198/cmdline File opened for reading /proc/427/cmdline File opened for reading /proc/1197/cmdline File opened for reading /proc/1283/cmdline File opened for reading /proc/1360/cmdline File opened for reading /proc/1520/cmdline File opened for reading /proc/1625/cmdline File opened for reading /proc/459/cmdline File opened for reading /proc/907/cmdline File opened for reading /proc/1144/cmdline File opened for reading /proc/1163/cmdline File opened for reading /proc/1619/cmdline File opened for reading /proc/1179/cmdline File opened for reading /proc/462/cmdline File opened for reading /proc/494/cmdline File opened for reading /proc/656/cmdline File opened for reading /proc/1019/cmdline File opened for reading /proc/1024/cmdline File opened for reading /proc/1067/cmdline File opened for reading /proc/1161/cmdline File opened for reading /proc/1262/cmdline File opened for reading /proc/1335/cmdline File opened for reading /proc/1364/cmdline File opened for reading /proc/439/cmdline File opened for reading /proc/609/cmdline File opened for reading /proc/681/cmdline File opened for reading /proc/968/cmdline File opened for reading /proc/1203/cmdline File opened for reading /proc/446/cmdline File opened for reading /proc/450/cmdline File opened for reading /proc/1177/cmdline File opened for reading /proc/1545/cmdline File opened for reading /proc/581/cmdline File opened for reading /proc/1554/cmdline File opened for reading /proc/1581/cmdline File opened for reading /proc/562/cmdline File opened for reading /proc/1607/cmdline File opened for reading /proc/688/cmdline File opened for reading /proc/1477/cmdline File opened for reading /proc/1589/cmdline File opened for reading /proc/1613/cmdline File opened for reading /proc/1038/cmdline File opened for reading /proc/1155/cmdline File opened for reading /proc/1302/cmdline File opened for reading /proc/1243/cmdline File opened for reading /proc/454/cmdline
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1550-1-0x0000000008048000-0x00000000080547a0-memory.dmp