Analysis
-
max time kernel
149s -
max time network
149s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240508-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
21-07-2024 18:26
General
-
Target
f90653583ae7efbf695d8ee63045b743.elf
-
Size
43KB
-
MD5
f90653583ae7efbf695d8ee63045b743
-
SHA1
35b4b7bb3ebe4f4160b87dfe8e1ab4b164dcbf3e
-
SHA256
682effde9a843d148b41ee802f86683c7b2c4310d6d2003b0dee381050e44633
-
SHA512
aa0e86f53507201b4b44d0f5b753389cc5625a3858469c66a6dfcd1ec0a1f697ea4ac339753d743a9242379fda2f3fcf91513e533970d11cc339582660b1a9fb
-
SSDEEP
768:piwfWG3NTE6BIQjt9wOEfrttCrzIDZwJn55kla4tIkjLUXFtWe1uocSQ:piC53tB7cByrzNjuaQIkjADc3
Malware Config
Extracted
Family
mirai
Botnet
MIRAI
Signatures
-
Deletes itself 1 IoCs
Processes:
f90653583ae7efbf695d8ee63045b743.elfpid process 1504 f90653583ae7efbf695d8ee63045b743.elf -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
f90653583ae7efbf695d8ee63045b743.elfdescription ioc process File opened for modification /dev/watchdog f90653583ae7efbf695d8ee63045b743.elf File opened for modification /dev/misc/watchdog f90653583ae7efbf695d8ee63045b743.elf -
Changes its process name 1 IoCs
Processes:
f90653583ae7efbf695d8ee63045b743.elfdescription pid process Changes the process name, possibly in an attempt to hide itself 1504 f90653583ae7efbf695d8ee63045b743.elf -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
f90653583ae7efbf695d8ee63045b743.elfdescription ioc process File opened for reading /proc/7cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/15cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/28cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/465cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/542cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/557cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/1082cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/1164cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/1499cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/1501cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/452cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/955cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/1150cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/173cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/439cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/464cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/632cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/665cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/25cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/169cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/1122cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/1222cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/1509cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/82cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/429cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/944cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/1290cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/1299cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/467cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/598cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/689cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/965cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/1270cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/697cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/1148cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/1326cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/442cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/1232cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/89cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/98cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/518cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/661cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/1256cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/1257cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/4cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/6cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/17cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/29cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/31cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/115cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/1126cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/646cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/1025cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/18cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/84cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/160cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/164cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/171cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/449cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/463cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/1178cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/3cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/163cmdline f90653583ae7efbf695d8ee63045b743.elf File opened for reading /proc/170cmdline f90653583ae7efbf695d8ee63045b743.elf
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1504-1-0x0000000008048000-0x000000000805b988-memory.dmp