Malware Analysis Report

2024-11-13 18:02

Sample ID 241109-drj3lawerc
Target 98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf
SHA256 98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4
Tags
upx mirai lzrd botnet defense_evasion discovery
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4

Threat Level: Known bad

The file 98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf was found to be: Known bad.

Malicious Activity Summary

upx mirai lzrd botnet defense_evasion discovery

Mirai

Mirai family

Modifies Watchdog functionality

Enumerates running processes

Writes file to system bin folder

UPX packed file

Reads runtime system information

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-09 03:14

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-09 03:14

Reported

2024-11-09 03:17

Platform

ubuntu2404-amd64-20240729-en

Max time kernel

135s

Max time network

146s

Command Line

[/tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf]

Signatures

Mirai

botnet mirai

Mirai family

mirai

Modifies Watchdog functionality

defense_evasion
Description Indicator Process Target
File opened for modification /dev/watchdog /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for modification /dev/misc/watchdog /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A

Enumerates running processes

Writes file to system bin folder

Description Indicator Process Target
File opened for modification /sbin/watchdog /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for modification /bin/watchdog /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A

Reads runtime system information

discovery
Description Indicator Process Target
File opened for reading /proc/777/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/2289/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/2393/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/32/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/65/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/773/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/2004/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/2025/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/2263/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/2351/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/5/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/34/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/47/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/1865/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/2147/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/2340/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/15/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/1350/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/1751/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/1990/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/2059/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/275/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/1050/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/2176/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/4/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/1748/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/597/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/30/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/55/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/24/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/11/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/21/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/124/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/1124/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/1408/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/2544/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/3/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/591/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/817/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/1976/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/2319/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/194/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/42/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/50/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/200/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/201/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/791/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/1999/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/33/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/53/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/193/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/788/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/2298/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/2546/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/14/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/19/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/54/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/80/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/197/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/2204/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/2484/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/2543/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/1/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A
File opened for reading /proc/514/status /tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf N/A

Processes

/tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf

[/tmp/98bbe9f9955cd1a311a032cabb0bf99f6b9a17968f6b02fdc667caca28998dc4.elf]

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
DE 157.173.118.27:3778 tcp
DE 157.173.118.27:3778 tcp

Files

memory/2547-1-0x0000000000400000-0x0000000000614b00-memory.dmp