Analysis
-
max time kernel
135s -
max time network
147s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240729-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
09-11-2024 03:18
Behavioral task
behavioral1
Sample
a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf
Resource
debian9-mipsbe-20240729-en
General
-
Target
a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf
-
Size
43KB
-
MD5
85cab25fb6f5479776f5cfce63bd6c18
-
SHA1
945b36a23744bb2ebb2f6200e8c4e09bdf8d03d1
-
SHA256
a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47
-
SHA512
184851cdf1c6ba5edcb728a0c8c22c3f19b391457a1f7f48c76fd68b9214fe17a92f50da8481c43202ec00d5ce07362a7177e9191f08333a47f44349d4db6cd4
-
SSDEEP
768:57ph1LjFGpx652lJXasyEk6JGbr6MWiNIx8FkIH5JgGlzDpbuR1JXJ:5zA65yk6JGbrbNwQJHrVJu7
Malware Config
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elfdescription ioc process File opened for modification /dev/watchdog a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for modification /dev/misc/watchdog a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
Processes:
a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elfdescription ioc process File opened for modification /bin/watchdog a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for modification /sbin/watchdog a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf -
Processes:
a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elfdescription ioc process File opened for reading /proc/71/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/717/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/9/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/16/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/22/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/7/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/76/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/161/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/722/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/6/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/13/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/73/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/121/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/382/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/4/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/5/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/332/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/672/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/678/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/1/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/20/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/81/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/109/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/329/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/719/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/11/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/69/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/77/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/713/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/21/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/74/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/75/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/679/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/696/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/2/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/3/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/72/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/676/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/711/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/716/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/12/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/15/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/37/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/179/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/211/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/10/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/17/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/36/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/360/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/710/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/718/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/18/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/23/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/82/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/241/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/388/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/14/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/19/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/120/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/435/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/715/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/331/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/383/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf File opened for reading /proc/8/status a1304e2ecf4d039fc2a225c9b45d904621f447008c9c49bcb8ca1e56b285bb47.elf