Analysis
-
max time kernel
149s -
max time network
132s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
23-07-2024 02:06
General
-
Target
52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf
-
Size
20KB
-
MD5
da43477c443f642ccf9c57720a6c5c75
-
SHA1
8eada786384fc5875890a7212fa4f0cf926e17cb
-
SHA256
52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09
-
SHA512
5869708cce0c31148513ba86bde8ec182e0e92a78a7ecd45998d80829cb67a74c93979af380e80a7a047351a2b700aa0bd9d28dacbd2b4b295d138827f8f35a7
-
SSDEEP
384:Mg4Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkZadmNUCfSWVU7D/TN4zbF0ApssyjSO:M98o08kxofBE+ZkZaINKYwB4HWoyZx
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for modification /dev/misc/watchdog 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 1 TTPs 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for modification /bin/watchdog 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/766/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/1176/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/1408/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/983/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/669/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/1014/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/1409/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/1419/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/1479/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/836/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/871/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/1182/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/1052/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/1089/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/1184/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/500/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/1046/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/1145/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/1469/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/409/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/645/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/1063/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/1537/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/1600/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/406/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/589/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/603/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/1105/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/1160/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/1185/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/446/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/770/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/1075/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/1164/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/1181/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/1035/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/1158/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/1320/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/1323/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/1431/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/1302/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/410/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/425/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/583/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/1119/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/1286/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/600/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/1177/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/971/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/1114/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/1345/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/1553/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/781/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/1192/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/1197/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/1546/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/499/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/741/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/1398/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/412/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/1165/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/1169/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/585/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf File opened for reading /proc/756/cmdline 52d7452ee7396c5b9db31a7ac0bce15958a550ce6a0fb5291da3c9222c737e09.elf