Analysis
-
max time kernel
137s -
max time network
138s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
09-11-2024 09:13
Behavioral task
behavioral1
Sample
62e0ec59f989335be5fbf630a49da4ea.elf
Resource
ubuntu2204-amd64-20240611-en
6 signatures
150 seconds
General
-
Target
62e0ec59f989335be5fbf630a49da4ea.elf
-
Size
36KB
-
MD5
62e0ec59f989335be5fbf630a49da4ea
-
SHA1
43bdde1afd1089008539973b08e35dd66fb7451a
-
SHA256
c3ae1058890bf151d5d464a608b68e2c377d4d31043e3883efb0d8a20685ab15
-
SHA512
ee8c5e36a0abc86c042630fcbd03f96459fe77cd8683498b77121c1a11befe59f72e3363989265317109f77df2d3c8633ccabc7e91581e3bdc363f29b8173b95
-
SSDEEP
768:WwS0nQr9tpJEu0annIBqVqVHmwIHWUFtGtzXKTr+PUx0nZV:JOX80VqVi2otGtzXpcMZV
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
62e0ec59f989335be5fbf630a49da4ea.elfdescription ioc process File opened for modification /dev/watchdog 62e0ec59f989335be5fbf630a49da4ea.elf File opened for modification /dev/misc/watchdog 62e0ec59f989335be5fbf630a49da4ea.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
Processes:
62e0ec59f989335be5fbf630a49da4ea.elfdescription ioc process File opened for modification /sbin/watchdog 62e0ec59f989335be5fbf630a49da4ea.elf File opened for modification /bin/watchdog 62e0ec59f989335be5fbf630a49da4ea.elf -
Processes:
62e0ec59f989335be5fbf630a49da4ea.elfdescription ioc process File opened for reading /proc/636/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/1162/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/1166/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/414/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/613/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/1/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/4/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/20/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/23/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/76/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/203/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/837/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/1075/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/1155/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/1221/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/1183/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/1373/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/3/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/110/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/586/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/590/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/1084/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/1563/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/197/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/1482/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/228/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/676/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/991/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/1053/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/1176/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/17/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/776/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/782/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/1062/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/1224/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/1245/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/16/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/213/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/217/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/714/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/747/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/1082/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/1251/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/1533/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/93/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/98/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/415/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/635/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/1140/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/1359/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/7/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/19/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/209/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/315/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/763/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/972/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/79/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/771/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/992/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/1157/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/1303/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/80/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/86/status 62e0ec59f989335be5fbf630a49da4ea.elf File opened for reading /proc/207/status 62e0ec59f989335be5fbf630a49da4ea.elf