Analysis
-
max time kernel
150s -
max time network
10s -
platform
debian-12_mipsel -
resource
debian12-mipsel-20240221-en -
resource tags
arch:mipselimage:debian12-mipsel-20240221-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem -
submitted
09-11-2024 04:09
Behavioral task
behavioral1
Sample
boatnet.mpsl.elf
Resource
debian12-mipsel-20240221-en
5 signatures
150 seconds
General
-
Target
boatnet.mpsl.elf
-
Size
24KB
-
MD5
8f40d0ebe50dc285e60148d2b37ba423
-
SHA1
04f3eb09ca26a52e29ddf092bd1f586b90275384
-
SHA256
6fcec39c841467b8ef53dab6f9acada11898ba46b5eeefde95132dcd88f23782
-
SHA512
77110f644cb264611be2c77d394b30a284f6e07eec3f6f2a01869b104e0e6efbde22d619e29cad6419cbb19d5b3e0f3b394258a586f6683811436cf75a700289
-
SSDEEP
768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpB8ZqSWvc:4QlS07FUXqIYSXQKquGqE
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
boatnet.mpsl.elfdescription ioc process File opened for modification /dev/misc/watchdog boatnet.mpsl.elf File opened for modification /dev/watchdog boatnet.mpsl.elf -
Writes file to system bin folder 2 IoCs
Processes:
boatnet.mpsl.elfdescription ioc process File opened for modification /sbin/watchdog boatnet.mpsl.elf File opened for modification /bin/watchdog boatnet.mpsl.elf -
Processes:
boatnet.mpsl.elfdescription ioc process File opened for reading /proc/716/cmdline boatnet.mpsl.elf File opened for reading /proc/717/cmdline boatnet.mpsl.elf File opened for reading /proc/720/cmdline boatnet.mpsl.elf File opened for reading /proc/732/cmdline boatnet.mpsl.elf File opened for reading /proc/745/cmdline boatnet.mpsl.elf File opened for reading /proc/414/cmdline boatnet.mpsl.elf File opened for reading /proc/710/cmdline boatnet.mpsl.elf File opened for reading /proc/666/cmdline boatnet.mpsl.elf File opened for reading /proc/697/cmdline boatnet.mpsl.elf File opened for reading /proc/750/cmdline boatnet.mpsl.elf File opened for reading /proc/679/cmdline boatnet.mpsl.elf File opened for reading /proc/680/cmdline boatnet.mpsl.elf File opened for reading /proc/733/cmdline boatnet.mpsl.elf File opened for reading /proc/668/cmdline boatnet.mpsl.elf File opened for reading /proc/695/cmdline boatnet.mpsl.elf