Analysis
-
max time kernel
135s -
max time network
147s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
14/10/2024, 02:04
Behavioral task
behavioral1
Sample
e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf
Resource
debian9-armhf-20240611-en
General
-
Target
e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf
-
Size
43KB
-
MD5
3cd0d2b3c9359e95d6522fb18508ec5f
-
SHA1
f28ee5961f157611852e1f58f199256a1ac08e97
-
SHA256
e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4
-
SHA512
8f9a0edc316c8820ead01be527f8910d9b3546eb1331ca323455e49734ff05ea9994f3912effd7e2a31cb89670191624e8928bc4ffbe3bdd196cab062b493741
-
SSDEEP
768:oBZOKj8x/QSQ3y/4qFTOdeoJWBhdYnjWcBWDW4s5GyZDa6XXzeYUO9q3UELA:gXwQSYPqFHI8rOjBn4+9DXzetLA
Malware Config
Extracted
mirai
LZRD
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for modification /dev/watchdog e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for modification /bin/watchdog e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf -
description ioc Process File opened for reading /proc/107/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/278/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/596/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/647/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/2/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/4/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/17/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/6/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/25/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/642/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/22/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/106/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/145/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/599/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/10/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/15/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/19/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/42/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/104/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/320/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/self/exe e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/11/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/28/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/277/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/308/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/581/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/24/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/139/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/140/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/74/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/1/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/14/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/26/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/5/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/95/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/147/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/633/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/639/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/310/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/3/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/20/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/21/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/16/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/27/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/41/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/165/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/324/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/7/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/8/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/13/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/601/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/646/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/43/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/224/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/640/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/602/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/644/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/645/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/650/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/12/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/23/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/292/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/137/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf File opened for reading /proc/279/status e094fa55e07372a8937b51387f98b3a995980d4727a78480203ed31f783d1cf4.elf