Analysis
-
max time kernel
135s -
max time network
147s -
platform
debian-9_armhf -
resource
debian9-armhf-20240729-en -
resource tags
arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
09-11-2024 03:29
Behavioral task
behavioral1
Sample
b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf
Resource
debian9-armhf-20240729-en
General
-
Target
b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf
-
Size
35KB
-
MD5
c3983be3cbc123cac5b6c45195578de7
-
SHA1
1ab14fe1df1aca80908a67c955cc7e86783059dd
-
SHA256
b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b
-
SHA512
491ea904ed5ddf37febd76b0dfde15bd5e56f79f22e752988e20ccfd052dae312946543a27545429f582125a55d0df680e953c97c8c3dde0ed46517c9145e57a
-
SSDEEP
768:prFs5me135wp1C+s9vbM5YNMygu+OR1juP3ACqtqNLIzLtZ6GNipmWs3Uoz7:p/eRSnQjMgVuP7qtqxgtASipm7z7
Malware Config
Extracted
mirai
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elfdescription ioc process File opened for modification /dev/watchdog b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for modification /dev/misc/watchdog b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
Processes:
b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elfdescription ioc process File opened for modification /bin/watchdog b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for modification /sbin/watchdog b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf -
Processes:
b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elfdescription ioc process File opened for reading /proc/168/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/645/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/7/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/15/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/16/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/151/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/214/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/330/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/581/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/10/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/18/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/43/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/98/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/648/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/5/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/8/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/266/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/279/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/107/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/637/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/27/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/297/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/311/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/22/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/105/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/631/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/642/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/12/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/21/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/300/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/4/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/14/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/25/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/598/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/640/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/self/exe b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/41/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/76/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/264/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/588/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/6/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/139/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/262/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/587/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/638/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/644/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/11/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/17/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/19/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/584/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/23/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/108/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/140/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/3/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/137/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/298/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/643/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/2/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/29/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/1/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/13/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/20/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/42/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf File opened for reading /proc/280/status b6e0e56d091ac5bfff698216e96523627eefb1a16850455593b9f23002c11d2b.elf