Analysis
-
max time kernel
149s -
max time network
152s -
platform
debian-12_armhf -
resource
debian12-armhf-20240729-en -
resource tags
arch:armhfimage:debian12-armhf-20240729-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
11-11-2024 10:08
Behavioral task
behavioral1
Sample
1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf
Resource
debian12-armhf-20240729-en
debian-12-armhf
6 signatures
150 seconds
General
-
Target
1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf
-
Size
60KB
-
MD5
2623e9f7b300d7ad9454f990e433d1ac
-
SHA1
591c728a74a602994be882d92abbee70f7f690d7
-
SHA256
1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5
-
SHA512
e9714610229b485ec36c52f447530e2640b998c126bec7eade3058d40e532f52b21e7f2feafe7dcdb85f9784282cbb30b64f332a5985c67be6afd766e5df2c00
-
SSDEEP
1536:17XduYshWhq/HIEy6Og3Nwz9hAyb6LSM5Tfv83KJGTb6R4G:xdpssMPR9w4ymLXTX83K0Tb6Rh
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for modification /dev/watchdog 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for modification /bin/watchdog 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf -
description ioc Process File opened for reading /proc/36/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/3/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/4/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/14/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/32/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/34/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/42/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/46/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/372/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/11/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/13/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/25/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/31/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/658/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/695/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/356/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/639/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/694/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/697/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/1/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/6/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/51/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/344/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/7/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/8/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/30/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/195/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/15/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/655/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/671/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/699/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/57/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/142/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/188/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/672/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/29/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/44/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/73/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/292/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/26/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/337/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/640/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/689/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/696/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/self/exe 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/33/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/56/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/326/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/35/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/9/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/348/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/624/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/277/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/352/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/675/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/702/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/17/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/21/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/22/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/24/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/698/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/5/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/12/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf File opened for reading /proc/18/status 1680a290d0867bf4981f5e8e12dd4124a420e5c518a321ddbdb88e1870a459f5.elf