Analysis
-
max time kernel
149s -
max time network
9s -
platform
debian-9_armhf -
resource
debian9-armhf-20240226-en -
resource tags
arch:armhfimage:debian9-armhf-20240226-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
11-04-2024 01:23
General
-
Target
6e113e31227c82766b986496191c9645ada6f2e3b91a794eb2e6f274020a4c4c.elf
-
Size
45KB
-
MD5
52d32b03a064ad1484a148039b8efd6f
-
SHA1
3ba0c7fc52624f9471c0d34857ed971a80895b80
-
SHA256
6e113e31227c82766b986496191c9645ada6f2e3b91a794eb2e6f274020a4c4c
-
SHA512
b039f6d10587ddec0644cb87c90e0424dc661c6dae983e35a2ad2ba0fbd779cb83b9351b1907c52e57731bcc21409b291fdb8aa4019bf1eb6b948dc8b80b9152
-
SSDEEP
768:D/TYCoIxdEk+AxoTZAZHFeq8b3K9q3UELmjfTgdGwdh5WGES3ye:DECFd+A6YHAx/L+fMJJ5
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
description ioc File opened for modification /dev/watchdog File opened for modification /dev/misc/watchdog -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 1 TTPs 2 IoCs
Processes:
description ioc File opened for modification /sbin/watchdog File opened for modification /bin/watchdog -
Reads runtime system information 42 IoCs
Reads data from /proc virtual filesystem.
Processes:
6e113e31227c82766b986496191c9645ada6f2e3b91a794eb2e6f274020a4c4c.elfdescription ioc File opened for reading /proc/498/cmdline File opened for reading /proc/700/cmdline File opened for reading /proc/742/cmdline File opened for reading /proc/743/cmdline File opened for reading /proc/763/cmdline File opened for reading /proc/782/cmdline File opened for reading /proc/self/exe 6e113e31227c82766b986496191c9645ada6f2e3b91a794eb2e6f274020a4c4c.elf File opened for reading /proc/764/cmdline File opened for reading /proc/693/cmdline File opened for reading /proc/647/cmdline File opened for reading /proc/656/cmdline File opened for reading /proc/761/cmdline File opened for reading /proc/770/cmdline File opened for reading /proc/772/cmdline File opened for reading /proc/776/cmdline File opened for reading /proc/779/cmdline File opened for reading /proc/643/cmdline File opened for reading /proc/714/cmdline File opened for reading /proc/718/cmdline File opened for reading /proc/774/cmdline File opened for reading /proc/788/cmdline File opened for reading /proc/644/cmdline File opened for reading /proc/673/cmdline File opened for reading /proc/757/cmdline File opened for reading /proc/780/cmdline File opened for reading /proc/450/cmdline File opened for reading /proc/661/cmdline File opened for reading /proc/726/cmdline File opened for reading /proc/762/cmdline File opened for reading /proc/778/cmdline File opened for reading /proc/650/cmdline File opened for reading /proc/685/cmdline File opened for reading /proc/699/cmdline File opened for reading /proc/768/cmdline File opened for reading /proc/784/cmdline File opened for reading /proc/786/cmdline File opened for reading /proc/654/cmdline File opened for reading /proc/497/cmdline File opened for reading /proc/604/cmdline File opened for reading /proc/649/cmdline File opened for reading /proc/747/cmdline File opened for reading /proc/436/cmdline
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/651-1-0x00008000-0x00026464-memory.dmp