Analysis
-
max time kernel
150s -
max time network
11s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240611-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
09-11-2024 04:10
Behavioral task
behavioral1
Sample
boatnet.mips.elf
Resource
debian9-mipsbe-20240611-en
General
-
Target
boatnet.mips.elf
-
Size
23KB
-
MD5
e3206d28c93769f5acb5e1e1d5b5f219
-
SHA1
198b56e1df06819e1141c1d6e8f7ad7d1646194c
-
SHA256
cdf3f41e3ad38f3081c882ac25d15d03b9e85b7b7021cbd32a6c504acd353aab
-
SHA512
dad4a759472131bed86139904962c9ce218dbba129e866fabfb524392e2ef8e77f30087d80305eef0452b5f5e685a5d5103e2ee6518b6b9c103fb55b8cfd3503
-
SSDEEP
384:neD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtuiOQmdzJgGlzDpH7uNj1JA+:neD8ZSWvZHZbs1row697qohQvg9OQizK
Malware Config
Extracted
mirai
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
boatnet.mips.elfdescription ioc process File opened for modification /dev/watchdog boatnet.mips.elf File opened for modification /dev/misc/watchdog boatnet.mips.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
Processes:
boatnet.mips.elfdescription ioc process File opened for modification /sbin/watchdog boatnet.mips.elf File opened for modification /bin/watchdog boatnet.mips.elf -
Processes:
boatnet.mips.elfdescription ioc process File opened for reading /proc/774/cmdline boatnet.mips.elf File opened for reading /proc/463/cmdline boatnet.mips.elf File opened for reading /proc/691/cmdline boatnet.mips.elf File opened for reading /proc/769/cmdline boatnet.mips.elf File opened for reading /proc/771/cmdline boatnet.mips.elf File opened for reading /proc/790/cmdline boatnet.mips.elf File opened for reading /proc/493/cmdline boatnet.mips.elf File opened for reading /proc/748/cmdline boatnet.mips.elf File opened for reading /proc/701/cmdline boatnet.mips.elf File opened for reading /proc/703/cmdline boatnet.mips.elf File opened for reading /proc/708/cmdline boatnet.mips.elf File opened for reading /proc/456/cmdline boatnet.mips.elf File opened for reading /proc/690/cmdline boatnet.mips.elf File opened for reading /proc/763/cmdline boatnet.mips.elf File opened for reading /proc/778/cmdline boatnet.mips.elf File opened for reading /proc/804/cmdline boatnet.mips.elf File opened for reading /proc/494/cmdline boatnet.mips.elf File opened for reading /proc/736/cmdline boatnet.mips.elf File opened for reading /proc/759/cmdline boatnet.mips.elf File opened for reading /proc/768/cmdline boatnet.mips.elf File opened for reading /proc/807/cmdline boatnet.mips.elf File opened for reading /proc/696/cmdline boatnet.mips.elf File opened for reading /proc/726/cmdline boatnet.mips.elf File opened for reading /proc/784/cmdline boatnet.mips.elf File opened for reading /proc/697/cmdline boatnet.mips.elf File opened for reading /proc/760/cmdline boatnet.mips.elf File opened for reading /proc/742/cmdline boatnet.mips.elf File opened for reading /proc/676/cmdline boatnet.mips.elf File opened for reading /proc/695/cmdline boatnet.mips.elf -
System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
Processes:
boatnet.mips.elfpid process 698 boatnet.mips.elf