Analysis
-
max time kernel
149s -
max time network
11s -
platform
debian-9_armhf -
resource
debian9-armhf-20240226-en -
resource tags
arch:armhfimage:debian9-armhf-20240226-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
10-04-2024 09:29
General
-
Target
SecuriteInfo.com.Linux.Siggen.9999.3867.27839.elf
-
Size
45KB
-
MD5
52d32b03a064ad1484a148039b8efd6f
-
SHA1
3ba0c7fc52624f9471c0d34857ed971a80895b80
-
SHA256
6e113e31227c82766b986496191c9645ada6f2e3b91a794eb2e6f274020a4c4c
-
SHA512
b039f6d10587ddec0644cb87c90e0424dc661c6dae983e35a2ad2ba0fbd779cb83b9351b1907c52e57731bcc21409b291fdb8aa4019bf1eb6b948dc8b80b9152
-
SSDEEP
768:D/TYCoIxdEk+AxoTZAZHFeq8b3K9q3UELmjfTgdGwdh5WGES3ye:DECFd+A6YHAx/L+fMJJ5
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
description ioc File opened for modification /dev/watchdog File opened for modification /dev/misc/watchdog -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 1 TTPs 2 IoCs
Processes:
description ioc File opened for modification /sbin/watchdog File opened for modification /bin/watchdog -
Reads runtime system information 40 IoCs
Reads data from /proc virtual filesystem.
Processes:
SecuriteInfo.com.Linux.Siggen.9999.3867.27839.elfdescription ioc File opened for reading /proc/647/cmdline File opened for reading /proc/675/cmdline File opened for reading /proc/639/cmdline File opened for reading /proc/738/cmdline File opened for reading /proc/773/cmdline File opened for reading /proc/511/cmdline File opened for reading /proc/566/cmdline File opened for reading /proc/723/cmdline File opened for reading /proc/729/cmdline File opened for reading /proc/779/cmdline File opened for reading /proc/525/cmdline File opened for reading /proc/601/cmdline File opened for reading /proc/640/cmdline File opened for reading /proc/644/cmdline File opened for reading /proc/651/cmdline File opened for reading /proc/653/cmdline File opened for reading /proc/658/cmdline File opened for reading /proc/678/cmdline File opened for reading /proc/684/cmdline File opened for reading /proc/761/cmdline File opened for reading /proc/737/cmdline File opened for reading /proc/771/cmdline File opened for reading /proc/775/cmdline File opened for reading /proc/781/cmdline File opened for reading /proc/783/cmdline File opened for reading /proc/785/cmdline File opened for reading /proc/571/cmdline File opened for reading /proc/724/cmdline File opened for reading /proc/769/cmdline File opened for reading /proc/self/exe SecuriteInfo.com.Linux.Siggen.9999.3867.27839.elf File opened for reading /proc/702/cmdline File opened for reading /proc/711/cmdline File opened for reading /proc/715/cmdline File opened for reading /proc/757/cmdline File opened for reading /proc/762/cmdline File opened for reading /proc/763/cmdline File opened for reading /proc/765/cmdline File opened for reading /proc/777/cmdline File opened for reading /proc/646/cmdline File opened for reading /proc/767/cmdline
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/648-1-0x00008000-0x00026464-memory.dmp