Analysis
-
max time kernel
149s -
max time network
6s -
platform
debian-9_armhf -
resource
debian9-armhf-20240226-en -
resource tags
arch:armhfimage:debian9-armhf-20240226-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
11-04-2024 01:12
General
-
Target
3de9a6c4ec9731408c65bcae040263fc955928a7b542c7f4515f4aa37530829d.elf
-
Size
45KB
-
MD5
c2405d5b7e609c9cfbca86434e308ed6
-
SHA1
8f89ca073e422d4a66a0269607458695f7067b52
-
SHA256
3de9a6c4ec9731408c65bcae040263fc955928a7b542c7f4515f4aa37530829d
-
SHA512
356327cfffb476be32f679228f220b16135bd2c069ef3b9d1259471275742a87adb0ec2fd6c06d623378d7c7693850027fa0101c221cb8caff1e6be5d972be58
-
SSDEEP
768:D/TYCoIxdEk+AxoTZAZHFeq8b3K9q3UELbUXfi6nVMQHI4vcGpvN:DECFd+A6YHAx/LRQZN
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
description ioc File opened for modification /dev/watchdog File opened for modification /dev/misc/watchdog -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 1 TTPs 2 IoCs
Processes:
description ioc File opened for modification /sbin/watchdog File opened for modification /bin/watchdog -
Reads runtime system information 32 IoCs
Reads data from /proc virtual filesystem.
Processes:
3de9a6c4ec9731408c65bcae040263fc955928a7b542c7f4515f4aa37530829d.elfdescription ioc process File opened for reading /proc/self/exe 3de9a6c4ec9731408c65bcae040263fc955928a7b542c7f4515f4aa37530829d.elf File opened for reading /proc/705/cmdline File opened for reading /proc/763/cmdline File opened for reading /proc/588/cmdline File opened for reading /proc/593/cmdline File opened for reading /proc/634/cmdline File opened for reading /proc/573/cmdline File opened for reading /proc/631/cmdline File opened for reading /proc/637/cmdline File opened for reading /proc/669/cmdline File opened for reading /proc/765/cmdline File opened for reading /proc/759/cmdline File opened for reading /proc/768/cmdline File opened for reading /proc/769/cmdline File opened for reading /proc/591/cmdline File opened for reading /proc/594/cmdline File opened for reading /proc/717/cmdline File opened for reading /proc/757/cmdline File opened for reading /proc/767/cmdline File opened for reading /proc/775/cmdline File opened for reading /proc/642/cmdline File opened for reading /proc/746/cmdline File opened for reading /proc/748/cmdline File opened for reading /proc/755/cmdline File opened for reading /proc/773/cmdline File opened for reading /proc/771/cmdline File opened for reading /proc/638/cmdline File opened for reading /proc/648/cmdline File opened for reading /proc/701/cmdline File opened for reading /proc/735/cmdline File opened for reading /proc/750/cmdline File opened for reading /proc/761/cmdline
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/639-1-0x00008000-0x00026464-memory.dmp