Analysis
-
max time kernel
149s -
max time network
133s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240226-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
26-03-2024 02:08
General
-
Target
37abd9ae1ce97738f9e0b116d887603f5533863cac6b881dd048445b1f96d1d1.elf
-
Size
20KB
-
MD5
00940a6466ffdd660a5cfceec98a74d8
-
SHA1
9673c3ab07684916584fdbce3b5dc4e1e5645533
-
SHA256
37abd9ae1ce97738f9e0b116d887603f5533863cac6b881dd048445b1f96d1d1
-
SHA512
aedff14a60291146b8e3c18751459c501f3851e42728eccb5cd48a775b6e8c769100bb5798c4c739ce6b9027c18078cb9edc335cb948ee2493599d6e25b3422e
-
SSDEEP
384:M0DLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAK5:x98o08kxofBE+ZkXaqGbp2F2TWul0c5M
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
description ioc File opened for modification /dev/watchdog File opened for modification /dev/misc/watchdog -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 1 TTPs 2 IoCs
Processes:
description ioc File opened for modification /sbin/watchdog File opened for modification /bin/watchdog -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
description ioc File opened for reading /proc/1176/cmdline File opened for reading /proc/1656/cmdline File opened for reading /proc/1051/cmdline File opened for reading /proc/1064/cmdline File opened for reading /proc/1587/cmdline File opened for reading /proc/1668/cmdline File opened for reading /proc/489/cmdline File opened for reading /proc/964/cmdline File opened for reading /proc/1199/cmdline File opened for reading /proc/1585/cmdline File opened for reading /proc/1644/cmdline File opened for reading /proc/1091/cmdline File opened for reading /proc/1160/cmdline File opened for reading /proc/1662/cmdline File opened for reading /proc/1080/cmdline File opened for reading /proc/1110/cmdline File opened for reading /proc/1206/cmdline File opened for reading /proc/1268/cmdline File opened for reading /proc/1269/cmdline File opened for reading /proc/1620/cmdline File opened for reading /proc/525/cmdline File opened for reading /proc/1045/cmdline File opened for reading /proc/1586/cmdline File opened for reading /proc/1593/cmdline File opened for reading /proc/1674/cmdline File opened for reading /proc/1328/cmdline File opened for reading /proc/1129/cmdline File opened for reading /proc/1146/cmdline File opened for reading /proc/1307/cmdline File opened for reading /proc/1166/cmdline File opened for reading /proc/1198/cmdline File opened for reading /proc/722/cmdline File opened for reading /proc/1196/cmdline File opened for reading /proc/1626/cmdline File opened for reading /proc/434/cmdline File opened for reading /proc/647/cmdline File opened for reading /proc/1348/cmdline File opened for reading /proc/437/cmdline File opened for reading /proc/472/cmdline File opened for reading /proc/589/cmdline File opened for reading /proc/683/cmdline File opened for reading /proc/1134/cmdline File opened for reading /proc/1374/cmdline File opened for reading /proc/1397/cmdline File opened for reading /proc/456/cmdline File opened for reading /proc/463/cmdline File opened for reading /proc/742/cmdline File opened for reading /proc/1177/cmdline File opened for reading /proc/1357/cmdline File opened for reading /proc/714/cmdline File opened for reading /proc/921/cmdline File opened for reading /proc/1680/cmdline File opened for reading /proc/461/cmdline File opened for reading /proc/1073/cmdline File opened for reading /proc/1638/cmdline File opened for reading /proc/1650/cmdline File opened for reading /proc/1185/cmdline File opened for reading /proc/1323/cmdline File opened for reading /proc/974/cmdline File opened for reading /proc/1026/cmdline File opened for reading /proc/1159/cmdline File opened for reading /proc/1257/cmdline File opened for reading /proc/527/cmdline File opened for reading /proc/650/cmdline
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1590-1-0x0000000008048000-0x00000000080547a0-memory.dmp