Analysis
- max time kernel
135s - max time network
147s - platform
debian-9_armhf - resource
debian9-armhf-20240729-en - resource tags
arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem - submitted
09/11/2024, 03:29
Behavioral task
behavioral1
Sample
b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf
Resource
debian9-armhf-20240729-en
debian-9-armhf
6 signatures
150 seconds
General
- Target b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf
- Size 35KB
- Sample241109-d12c8syrdk
- SHA256 b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b
- MD5 c3983be3cbc123cac5b6c45195578de7
- SHA1 1ab14fe1df1aca80908a67c955cc7e86783059dd
- SHA512 491ea904ed5ddf37febd76b0dfde15bd5e56f79f22e752988e20ccfd052dae312946543a27545429f582125a55d0df680e953c97c8c3dde0ed46517c9145e57a
- SSDEEP 768:prFs5me135wp1C+s9vbM5YNMygu+OR1juP3ACqtqNLIzLtZ6GNipmWs3Uoz7:p/eRSnQjMgVuP7qtqxgtASipm7z7
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
mirai
Botnet
-
LZRD
Signatures
- Mirai family
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for modification /dev/misc/watchdog b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /bin/watchdog b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for modification /sbin/watchdog b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf -
description ioc Process File opened for reading /proc/168/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/645/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/7/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/15/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/16/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/151/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/214/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/330/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/581/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/10/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/18/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/43/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/98/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/648/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/5/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/8/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/266/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/279/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/107/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/637/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/27/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/297/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/311/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/22/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/105/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/631/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/642/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/12/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/21/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/300/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/4/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/14/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/25/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/598/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/640/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/self/exe b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/41/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/76/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/264/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/588/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/6/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/139/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/262/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/587/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/638/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/644/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/11/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/17/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/19/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/584/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/23/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/108/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/140/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/3/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/137/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/298/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/643/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/2/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/29/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/1/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/13/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/20/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/42/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/280/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf