Analysis
-
max time kernel
150s -
max time network
153s -
platform
debian-12_armhf -
resource
debian12-armhf-20240221-en -
resource tags
arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
21-07-2024 18:26
General
-
Target
91449c2830e32f60d5b4a1c4aaece84d.elf
-
Size
57KB
-
MD5
91449c2830e32f60d5b4a1c4aaece84d
-
SHA1
3b6c75c183ce8c369b6a578b3ab60c1474dce6cc
-
SHA256
82cac44937ab2d7c20d46e53b87a73594824457443a1946083df6cca33e324cf
-
SHA512
c63403eb6e2b9973fd28bc0773f72c110eb733e13ae64985e609c142c73bbc1b0f5155707688de1ecf1dfa602f829b78bfd819b53cc6af859f478c5e78445c94
-
SSDEEP
1536:jccRgToILobaTyTYH0gg67EevuG9o5Pn7SfLXfFt+E:jLRgT6bqyT767EeWGGhn7SfLXV
Malware Config
Extracted
Family
mirai
Botnet
MIRAI
Signatures
-
Deletes itself 1 IoCs
Processes:
91449c2830e32f60d5b4a1c4aaece84d.elfpid process 709 91449c2830e32f60d5b4a1c4aaece84d.elf -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
91449c2830e32f60d5b4a1c4aaece84d.elfdescription ioc process File opened for modification /dev/watchdog 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for modification /dev/misc/watchdog 91449c2830e32f60d5b4a1c4aaece84d.elf -
Changes its process name 1 IoCs
Processes:
91449c2830e32f60d5b4a1c4aaece84d.elfdescription ioc pid process Changes the process name, possibly in an attempt to hide itself sb4bdmq0rsbdo68mq8vw 709 91449c2830e32f60d5b4a1c4aaece84d.elf -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
91449c2830e32f60d5b4a1c4aaece84d.elfdescription ioc process File opened for reading /proc/222c�/cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/33/stat 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/7777�;cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/7777�;cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/55cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/222cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/6666v7cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/7777�;cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/99ssd/cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/111/stat 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/7777�;cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/111p/cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/222�/cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/333�/cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/6666�:cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/7777v;cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/6666/stat 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/7777�;cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/7777�;cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/333�/cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/1111�/cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/1111;cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/77/stat 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/7777�;cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/7777�;cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/7777�;cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/7777�;cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/7777cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/7777�;cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/3333u4cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/7777�;cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/7777�;cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/7777�;cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/3333�4cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/7777�;cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/3333/stat 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/7777�;cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/444cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/7777�;cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/444d�/cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/222m�/cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/7777<cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/333s�/cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/11/stat 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/2222�2cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/2222�3cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/6666�7cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/7777�;cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/88/stat 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/7777�;cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/7777�;cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/self/exe 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/333s�/cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/6666'8cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/2222/stat 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/44cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/66cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/6666�;cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/7777�;cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/7777�;cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/111cv/cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/777k�/cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/666688cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf File opened for reading /proc/7777�;cmdline 91449c2830e32f60d5b4a1c4aaece84d.elf
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/709-1-0x00008000-0x000297a4-memory.dmp