Analysis
-
max time kernel
149s -
max time network
11s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
22-07-2024 22:13
General
-
Target
9b2356d6fa60307dc6776f25473592ea.elf
-
Size
21KB
-
MD5
9b2356d6fa60307dc6776f25473592ea
-
SHA1
0911006d17603d412465dba7cc5435a313ac6b7e
-
SHA256
301e421f6c17c8c99e52032c06adf88ea70861a52f1dd46a5889f885d8079a5d
-
SHA512
c1f3826a4cd77085d47c48eea3127df18af9b31a92031f7587e4e73b834e7ca04d04ec5d3e13b69bb6950ae5300ebe97ac2714d2955590696e16b0a5cb953553
-
SSDEEP
384:FB/HF1/1eZ9/6o10ILPljIgf76KRJ34QTECcbrv+0BYVUyeEDf0bTh2EPWVv4qhQ:FJHvcZ56qt9feK734QTEpbq0B4VQThyC
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 9b2356d6fa60307dc6776f25473592ea.elf File opened for modification /dev/misc/watchdog 9b2356d6fa60307dc6776f25473592ea.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 1 TTPs 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 9b2356d6fa60307dc6776f25473592ea.elf File opened for modification /bin/watchdog 9b2356d6fa60307dc6776f25473592ea.elf -
Reads runtime system information 46 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/754/cmdline 9b2356d6fa60307dc6776f25473592ea.elf File opened for reading /proc/766/cmdline 9b2356d6fa60307dc6776f25473592ea.elf File opened for reading /proc/771/cmdline 9b2356d6fa60307dc6776f25473592ea.elf File opened for reading /proc/787/cmdline 9b2356d6fa60307dc6776f25473592ea.elf File opened for reading /proc/657/cmdline 9b2356d6fa60307dc6776f25473592ea.elf File opened for reading /proc/662/cmdline 9b2356d6fa60307dc6776f25473592ea.elf File opened for reading /proc/690/cmdline 9b2356d6fa60307dc6776f25473592ea.elf File opened for reading /proc/712/cmdline 9b2356d6fa60307dc6776f25473592ea.elf File opened for reading /proc/414/cmdline 9b2356d6fa60307dc6776f25473592ea.elf File opened for reading /proc/725/cmdline 9b2356d6fa60307dc6776f25473592ea.elf File opened for reading /proc/773/cmdline 9b2356d6fa60307dc6776f25473592ea.elf File opened for reading /proc/779/cmdline 9b2356d6fa60307dc6776f25473592ea.elf File opened for reading /proc/650/cmdline 9b2356d6fa60307dc6776f25473592ea.elf File opened for reading /proc/717/cmdline 9b2356d6fa60307dc6776f25473592ea.elf File opened for reading /proc/728/cmdline 9b2356d6fa60307dc6776f25473592ea.elf File opened for reading /proc/743/cmdline 9b2356d6fa60307dc6776f25473592ea.elf File opened for reading /proc/self/exe 9b2356d6fa60307dc6776f25473592ea.elf File opened for reading /proc/401/cmdline 9b2356d6fa60307dc6776f25473592ea.elf File opened for reading /proc/605/cmdline 9b2356d6fa60307dc6776f25473592ea.elf File opened for reading /proc/642/cmdline 9b2356d6fa60307dc6776f25473592ea.elf File opened for reading /proc/775/cmdline 9b2356d6fa60307dc6776f25473592ea.elf File opened for reading /proc/781/cmdline 9b2356d6fa60307dc6776f25473592ea.elf File opened for reading /proc/783/cmdline 9b2356d6fa60307dc6776f25473592ea.elf File opened for reading /proc/785/cmdline 9b2356d6fa60307dc6776f25473592ea.elf File opened for reading /proc/647/cmdline 9b2356d6fa60307dc6776f25473592ea.elf File opened for reading /proc/729/cmdline 9b2356d6fa60307dc6776f25473592ea.elf File opened for reading /proc/769/cmdline 9b2356d6fa60307dc6776f25473592ea.elf File opened for reading /proc/649/cmdline 9b2356d6fa60307dc6776f25473592ea.elf File opened for reading /proc/651/cmdline 9b2356d6fa60307dc6776f25473592ea.elf File opened for reading /proc/720/cmdline 9b2356d6fa60307dc6776f25473592ea.elf File opened for reading /proc/643/cmdline 9b2356d6fa60307dc6776f25473592ea.elf File opened for reading /proc/706/cmdline 9b2356d6fa60307dc6776f25473592ea.elf File opened for reading /proc/713/cmdline 9b2356d6fa60307dc6776f25473592ea.elf File opened for reading /proc/691/cmdline 9b2356d6fa60307dc6776f25473592ea.elf File opened for reading /proc/696/cmdline 9b2356d6fa60307dc6776f25473592ea.elf File opened for reading /proc/753/cmdline 9b2356d6fa60307dc6776f25473592ea.elf File opened for reading /proc/764/cmdline 9b2356d6fa60307dc6776f25473592ea.elf File opened for reading /proc/461/cmdline 9b2356d6fa60307dc6776f25473592ea.elf File opened for reading /proc/462/cmdline 9b2356d6fa60307dc6776f25473592ea.elf File opened for reading /proc/655/cmdline 9b2356d6fa60307dc6776f25473592ea.elf File opened for reading /proc/680/cmdline 9b2356d6fa60307dc6776f25473592ea.elf File opened for reading /proc/767/cmdline 9b2356d6fa60307dc6776f25473592ea.elf File opened for reading /proc/777/cmdline 9b2356d6fa60307dc6776f25473592ea.elf File opened for reading /proc/788/cmdline 9b2356d6fa60307dc6776f25473592ea.elf File opened for reading /proc/686/cmdline 9b2356d6fa60307dc6776f25473592ea.elf File opened for reading /proc/737/cmdline 9b2356d6fa60307dc6776f25473592ea.elf