Analysis
-
max time kernel
135s -
max time network
172s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
13-11-2024 07:28
Behavioral task
behavioral1
Sample
ub8ehJSePAfc9FYqZIT6.arm7.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
6 signatures
150 seconds
General
-
Target
ub8ehJSePAfc9FYqZIT6.arm7.elf
-
Size
60KB
-
MD5
e094e9341984f1cc61db673bfc442569
-
SHA1
0e640634450980e357c00823820bfc39e66197c1
-
SHA256
62a0d867d512cb705692e121924e25eeba12d2a3e79ac01251b62db2217a759c
-
SHA512
9df6c463ceaafe5e86b470698d61a5ddd6dbc59b41438633d7e9b1b9d20c3da3f3cfaf3be31bb84825efacd92cf6fdb8a0da93ee3fc5185606538140c715f3e1
-
SSDEEP
1536:zVQSmwtMJXmejtQGMBLTM5Tfv83KJ2crl2EW3:zVywt8XZKGMBLgTX83KHl2EW3
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
ub8ehJSePAfc9FYqZIT6.arm7.elfdescription ioc Process File opened for modification /dev/watchdog ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for modification /dev/misc/watchdog ub8ehJSePAfc9FYqZIT6.arm7.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
Processes:
ub8ehJSePAfc9FYqZIT6.arm7.elfdescription ioc Process File opened for modification /sbin/watchdog ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for modification /bin/watchdog ub8ehJSePAfc9FYqZIT6.arm7.elf -
Processes:
ub8ehJSePAfc9FYqZIT6.arm7.elfdescription ioc Process File opened for reading /proc/43/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/654/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/596/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/16/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/27/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/28/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/29/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/267/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/661/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/7/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/9/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/15/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/20/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/333/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/self/exe ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/24/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/76/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/4/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/13/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/17/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/647/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/660/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/5/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/19/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/42/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/142/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/149/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/3/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/8/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/23/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/26/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/286/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/653/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/656/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/10/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/12/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/41/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/318/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/599/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/11/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/600/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/658/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/21/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/110/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/269/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/283/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/1/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/6/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/14/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/139/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/305/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/597/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/664/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/98/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/107/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/306/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/606/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/2/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/109/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/166/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/284/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/607/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/261/status ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/659/status ub8ehJSePAfc9FYqZIT6.arm7.elf