Analysis
-
max time kernel
149s -
max time network
4s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
09-11-2024 04:07
Behavioral task
behavioral1
Sample
fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf
Resource
debian9-armhf-20240611-en
General
-
Target
fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf
-
Size
21KB
-
MD5
ac9ed1f09a0dd9f2c77b863ab4e1a936
-
SHA1
6c1c832f9516d7c09ffaca8fead42d3342e11a19
-
SHA256
fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668
-
SHA512
4e1370f62d596d790dbd1ef5c1ed01c91da0e1f89da868828bb1f58a72b8e442343f58ee719eba8a5c26058ca3c6e9ad76f26bf991f51a154af0ee1d38d9f4d1
-
SSDEEP
384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjXhymdGUop5hR:vvQn4j+ZO5fKAlxTs3Uozj
Malware Config
Extracted
mirai
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elfdescription ioc process File opened for modification /dev/watchdog fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf File opened for modification /dev/misc/watchdog fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
Processes:
fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elfdescription ioc process File opened for modification /bin/watchdog fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf File opened for modification /sbin/watchdog fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf -
Processes:
fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elfdescription ioc process File opened for reading /proc/773/cmdline fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf File opened for reading /proc/777/cmdline fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf File opened for reading /proc/653/cmdline fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf File opened for reading /proc/654/cmdline fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf File opened for reading /proc/719/cmdline fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf File opened for reading /proc/748/cmdline fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf File opened for reading /proc/604/cmdline fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf File opened for reading /proc/787/cmdline fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf File opened for reading /proc/791/cmdline fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf File opened for reading /proc/590/cmdline fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf File opened for reading /proc/781/cmdline fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf File opened for reading /proc/655/cmdline fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf File opened for reading /proc/687/cmdline fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf File opened for reading /proc/723/cmdline fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf File opened for reading /proc/783/cmdline fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf File opened for reading /proc/self/exe fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf File opened for reading /proc/670/cmdline fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf File opened for reading /proc/789/cmdline fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf File opened for reading /proc/610/cmdline fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf File opened for reading /proc/659/cmdline fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf File opened for reading /proc/775/cmdline fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf File opened for reading /proc/779/cmdline fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf File opened for reading /proc/766/cmdline fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf File opened for reading /proc/768/cmdline fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf File opened for reading /proc/785/cmdline fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf File opened for reading /proc/608/cmdline fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf File opened for reading /proc/611/cmdline fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf File opened for reading /proc/648/cmdline fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf File opened for reading /proc/731/cmdline fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf File opened for reading /proc/747/cmdline fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf File opened for reading /proc/765/cmdline fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf File opened for reading /proc/793/cmdline fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf