Analysis
-
max time kernel
149s -
max time network
7s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240418-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
13/10/2024, 09:44
Behavioral task
behavioral1
Sample
a9645840ed9e516a7929525539cb3f750e2176ee5a63a6ab5edc67b9857e85cc.elf
Resource
debian9-mipsbe-20240418-en
4 signatures
150 seconds
General
-
Target
a9645840ed9e516a7929525539cb3f750e2176ee5a63a6ab5edc67b9857e85cc.elf
-
Size
23KB
-
MD5
506ddfc3e5aca187e25a5999e5a1831d
-
SHA1
b1d3848f7ba1aa7623dfbc847d8dacbca5638efd
-
SHA256
a9645840ed9e516a7929525539cb3f750e2176ee5a63a6ab5edc67b9857e85cc
-
SHA512
cace551488dfaf502f64dad0e72ce8114c89b09be173b1f8b5b25f2f707676f2b2a4563364de8a14e43c90745718faa4c56085be05b4afde2468b1b6d1bda9f8
-
SSDEEP
384:YeD8ZSH2LLZUYyGZbsOiTFdrd44YiTGeuCqlQCXHpKJjA19eoFmdtJgGlzDpH7uW:YeD8ZSWvZHZbs1Fx+1iTGeZqlQCXoJss
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog a9645840ed9e516a7929525539cb3f750e2176ee5a63a6ab5edc67b9857e85cc.elf File opened for modification /dev/misc/watchdog a9645840ed9e516a7929525539cb3f750e2176ee5a63a6ab5edc67b9857e85cc.elf -
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog a9645840ed9e516a7929525539cb3f750e2176ee5a63a6ab5edc67b9857e85cc.elf File opened for modification /bin/watchdog a9645840ed9e516a7929525539cb3f750e2176ee5a63a6ab5edc67b9857e85cc.elf -
description ioc Process File opened for reading /proc/663/cmdline a9645840ed9e516a7929525539cb3f750e2176ee5a63a6ab5edc67b9857e85cc.elf File opened for reading /proc/669/cmdline a9645840ed9e516a7929525539cb3f750e2176ee5a63a6ab5edc67b9857e85cc.elf File opened for reading /proc/719/cmdline a9645840ed9e516a7929525539cb3f750e2176ee5a63a6ab5edc67b9857e85cc.elf File opened for reading /proc/774/cmdline a9645840ed9e516a7929525539cb3f750e2176ee5a63a6ab5edc67b9857e85cc.elf File opened for reading /proc/810/cmdline a9645840ed9e516a7929525539cb3f750e2176ee5a63a6ab5edc67b9857e85cc.elf File opened for reading /proc/811/cmdline a9645840ed9e516a7929525539cb3f750e2176ee5a63a6ab5edc67b9857e85cc.elf File opened for reading /proc/422/cmdline a9645840ed9e516a7929525539cb3f750e2176ee5a63a6ab5edc67b9857e85cc.elf File opened for reading /proc/718/cmdline a9645840ed9e516a7929525539cb3f750e2176ee5a63a6ab5edc67b9857e85cc.elf File opened for reading /proc/724/cmdline a9645840ed9e516a7929525539cb3f750e2176ee5a63a6ab5edc67b9857e85cc.elf File opened for reading /proc/733/cmdline a9645840ed9e516a7929525539cb3f750e2176ee5a63a6ab5edc67b9857e85cc.elf File opened for reading /proc/798/cmdline a9645840ed9e516a7929525539cb3f750e2176ee5a63a6ab5edc67b9857e85cc.elf File opened for reading /proc/666/cmdline a9645840ed9e516a7929525539cb3f750e2176ee5a63a6ab5edc67b9857e85cc.elf File opened for reading /proc/670/cmdline a9645840ed9e516a7929525539cb3f750e2176ee5a63a6ab5edc67b9857e85cc.elf File opened for reading /proc/730/cmdline a9645840ed9e516a7929525539cb3f750e2176ee5a63a6ab5edc67b9857e85cc.elf File opened for reading /proc/732/cmdline a9645840ed9e516a7929525539cb3f750e2176ee5a63a6ab5edc67b9857e85cc.elf File opened for reading /proc/786/cmdline a9645840ed9e516a7929525539cb3f750e2176ee5a63a6ab5edc67b9857e85cc.elf File opened for reading /proc/791/cmdline a9645840ed9e516a7929525539cb3f750e2176ee5a63a6ab5edc67b9857e85cc.elf File opened for reading /proc/704/cmdline a9645840ed9e516a7929525539cb3f750e2176ee5a63a6ab5edc67b9857e85cc.elf File opened for reading /proc/723/cmdline a9645840ed9e516a7929525539cb3f750e2176ee5a63a6ab5edc67b9857e85cc.elf File opened for reading /proc/725/cmdline a9645840ed9e516a7929525539cb3f750e2176ee5a63a6ab5edc67b9857e85cc.elf File opened for reading /proc/773/cmdline a9645840ed9e516a7929525539cb3f750e2176ee5a63a6ab5edc67b9857e85cc.elf File opened for reading /proc/790/cmdline a9645840ed9e516a7929525539cb3f750e2176ee5a63a6ab5edc67b9857e85cc.elf