Analysis
- max time kernel
135s - max time network
148s - platform
debian-9_armhf - resource
debian9-armhf-20240418-en - resource tags
arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem - submitted
09/11/2024, 02:28
Behavioral task
behavioral1
Sample
3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf
Resource
debian9-armhf-20240418-en
debian-9-armhf
6 signatures
150 seconds
General
- Target 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf
- Size 60KB
- Sample241109-cybjcsvhlg
- SHA256 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed
- MD5 668676d72aaee4a743d15f5f89e9fece
- SHA1 a7c77204609022fa6d2b3c14be7a56254377e27a
- SHA512 7391e5dfb303b9d7ba29f8714846cc725b5e3e06451b69b737ef4902ee4e5e544c0c875dc57a460426d7af3687565eb5ea3a7b7d7a5507e208fc8bf773d68362
- SSDEEP 1536:Y7XduYshWhq/HIEy6Og3Nwz9hAy+ud1pnLSM5Tfv83KJGTb6R4Q:qdpssMPR9w4y7RnLXTX83K0Tb6Rf
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
mirai
Botnet
-
LZRD
Signatures
- Mirai family
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for modification /dev/misc/watchdog 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for modification /bin/watchdog 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf -
description ioc Process File opened for reading /proc/629/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/630/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/634/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/5/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/165/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/218/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/314/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/16/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/139/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/23/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/28/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/9/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/11/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/149/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/592/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/22/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/41/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/107/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/266/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/19/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/75/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/26/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/43/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/3/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/18/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/637/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/278/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/635/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/7/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/108/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/143/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/275/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/571/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/589/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/self/exe 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/4/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/21/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/24/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/29/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/623/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/1/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/14/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/105/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/15/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/20/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/280/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/640/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/13/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/25/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/17/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/300/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/8/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/10/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/136/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/588/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/636/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/6/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/42/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/312/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/27/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/304/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/591/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/12/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf File opened for reading /proc/276/status 3a01ac886c3f3dffed582fa36723aebfb209c1780cd98077b4e5bfff547542ed.elf