Analysis
-
max time kernel
149s -
max time network
149s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240508-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
11/06/2024, 18:55
Behavioral task
behavioral1
Sample
45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf
Resource
ubuntu1804-amd64-20240508-en
ubuntu-18.04-amd64
5 signatures
150 seconds
General
-
Target
45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf
-
Size
58KB
-
MD5
42fb5fb4683ecdebbe2c3989c4b8157c
-
SHA1
cf34621d00571f8ebd155c3e1ef7544530dbeb77
-
SHA256
45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61
-
SHA512
cdf6a8dcc2324f8790880a298ffbbb598363a97f8be62f071f18620da2907e43d8eb29b151acb7e953d958dc896146d1a3d5ee2408d106e283428d11b98ac2d9
-
SSDEEP
1536:sjmmrVD/JIuBb8gu5/itJvvW3aHMlEDWqXjYEOy:simd2uBNu5KvWqHMlEDVjROy
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for modification /dev/misc/watchdog 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 1 TTPs 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for modification /bin/watchdog 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /bin/bash 1507 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/1146/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/1200/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/30/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/79/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/182/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/596/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/960/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/1309/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/1323/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/2/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/130/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/1120/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/1196/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/1299/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/98/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/198/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/201/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/457/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/1076/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/1150/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/1503/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/26/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/81/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/183/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/195/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/328/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/1505/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/27/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/184/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/296/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/1110/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/1263/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/6/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/14/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/574/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/628/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/9/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/16/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/84/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/192/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/1204/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/973/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/1023/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/1191/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/1356/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/1226/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/1252/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/1/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/187/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/464/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/696/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/1134/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/1138/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/188/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/226/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/439/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/451/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/498/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/1279/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/1484/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/441/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/537/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/672/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf File opened for reading /proc/979/cmdline 45e120e56ede7195d5ad2b36e081569a7ea8ce43f8ad67d6ba862dea6bed2d61.elf