Analysis
-
max time kernel
135s -
max time network
174s -
platform
debian-12_armhf -
resource
debian12-armhf-20240221-en -
resource tags
arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
13-11-2024 07:32
Behavioral task
behavioral1
Sample
ub8ehJSePAfc9FYqZIT6.arm6.elf
Resource
debian12-armhf-20240221-en
debian-12-armhf
6 signatures
150 seconds
General
-
Target
ub8ehJSePAfc9FYqZIT6.arm6.elf
-
Size
43KB
-
MD5
a2704328a12405ec890423b56a54ae95
-
SHA1
fca3901ffc843c1e86af1939aee138f8e780fa6f
-
SHA256
0f1805bc2402069b538a25fa633bc680090c5dcb8ac930b55b626ee45615d562
-
SHA512
27524353afce1c8639d284f2ac83945799590401ca71502129a67c53fdf8227afc07015bc8ae3f64bbbe747a92392ddc81f8324942464c34c49a4822be8ac293
-
SSDEEP
768:EnZOKj8x/QSQ3y/4qFTOdeoJWBhdYnjWcBWDW4s5GyZDa6XXfSwmH9q3UELn:yXwQSYPqFHI8rOjBn4+9DX6wmWLn
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for modification /dev/misc/watchdog ub8ehJSePAfc9FYqZIT6.arm6.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for modification /bin/watchdog ub8ehJSePAfc9FYqZIT6.arm6.elf -
description ioc Process File opened for reading /proc/18/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/21/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/42/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/197/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/316/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/3/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/6/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/9/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/27/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/35/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/22/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/23/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/32/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/46/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/190/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/720/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/725/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/10/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/25/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/1/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/26/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/204/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/31/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/51/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/323/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/658/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/707/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/716/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/722/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/11/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/44/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/341/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/686/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/8/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/14/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/15/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/16/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/34/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/640/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/717/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/721/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/2/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/19/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/28/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/343/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/666/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/4/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/24/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/56/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/628/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/657/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/709/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/17/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/142/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/681/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/5/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/13/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/364/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/641/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/708/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/7/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/20/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/57/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/221/status ub8ehJSePAfc9FYqZIT6.arm6.elf