Analysis
-
max time kernel
135s -
max time network
150s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
09-11-2024 04:02
Behavioral task
behavioral1
Sample
f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf
Resource
debian9-armhf-20240611-en
General
-
Target
f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf
-
Size
60KB
-
MD5
bc240f3d7ce7eb0db9af1cf9e5520203
-
SHA1
0ca1b1926293412e9c637760670d2a61d7d53143
-
SHA256
f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a
-
SHA512
dca89d8d6a6b700194926d211f01f194404209bfe69b90f733b83c2958b35a37ec15e84500878467a525042d26a3a00784956d7f7b191217e5e42ff0efc92758
-
SSDEEP
1536:F7XduYshWhq/HIEy6Og3Nwz9hAyYLSM5Tfv83KJGTb6R4h:BdpssMPR9w4yYLXTX83K0Tb6RC
Malware Config
Extracted
mirai
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elfdescription ioc process File opened for modification /dev/misc/watchdog f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for modification /dev/watchdog f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
Processes:
f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elfdescription ioc process File opened for modification /sbin/watchdog f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for modification /bin/watchdog f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf -
Processes:
f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elfdescription ioc process File opened for reading /proc/6/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/8/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/14/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/106/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/17/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/166/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/642/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/649/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/27/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/29/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/107/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/305/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/266/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/308/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/401/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/636/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/12/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/22/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/25/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/104/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/202/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/18/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/137/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/139/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/149/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/7/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/647/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/20/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/267/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/286/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/414/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/645/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/650/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/2/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/23/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/24/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/28/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/4/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/284/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/302/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/653/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/643/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/1/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/10/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/21/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/43/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/265/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/648/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/19/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/74/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/318/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/605/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/self/exe f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/9/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/11/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/16/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/147/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/461/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/462/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/13/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/15/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/26/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/42/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf File opened for reading /proc/3/status f1aa8dc8f3985ea6bc7535424addcd5c004f6d64949a2b92a229ae785a88587a.elf