Analysis
-
max time kernel
136s -
max time network
155s -
platform
debian-12_armhf -
resource
debian12-armhf-20240221-en -
resource tags
arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
13/10/2024, 19:47
Behavioral task
behavioral1
Sample
3cd0d2b3c9359e95d6522fb18508ec5f.elf
Resource
debian12-armhf-20240221-en
5 signatures
150 seconds
General
-
Target
3cd0d2b3c9359e95d6522fb18508ec5f.elf
-
Size
43KB
-
MD5
3cd0d2b3c9359e95d6522fb18508ec5f
-
SHA1
f28ee5961f157611852e1f58f199256a1ac08e97
-
SHA256
e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4
-
SHA512
8f9a0edc316c8820ead01be527f8910d9b3546eb1331ca323455e49734ff05ea9994f3912effd7e2a31cb89670191624e8928bc4ffbe3bdd196cab062b493741
-
SSDEEP
768:oBZOKj8x/QSQ3y/4qFTOdeoJWBhdYnjWcBWDW4s5GyZDa6XXzeYUO9q3UELA:gXwQSYPqFHI8rOjBn4+9DXzetLA
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for modification /dev/misc/watchdog 3cd0d2b3c9359e95d6522fb18508ec5f.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for modification /bin/watchdog 3cd0d2b3c9359e95d6522fb18508ec5f.elf -
description ioc Process File opened for reading /proc/680/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/8/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/12/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/14/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/38/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/703/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/710/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/6/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/16/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/27/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/188/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/705/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/709/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/1/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/31/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/35/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/684/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/45/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/249/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/339/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/2/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/25/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/679/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/11/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/26/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/57/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/484/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/3/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/32/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/52/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/199/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/20/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/346/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/34/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/219/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/706/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/self/exe 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/19/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/43/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/316/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/24/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/74/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/309/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/342/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/5/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/9/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/13/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/21/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/488/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/701/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/29/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/47/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/58/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/308/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/4/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/46/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/143/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/638/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/353/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/665/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/692/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/695/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/7/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf File opened for reading /proc/15/status 3cd0d2b3c9359e95d6522fb18508ec5f.elf