Analysis
-
max time kernel
148s -
max time network
152s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
14-11-2024 02:43
Static task
static1
Behavioral task
behavioral1
Sample
84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf
Resource
ubuntu2204-amd64-20240611-en
General
-
Target
84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf
-
Size
80KB
-
MD5
0c23e652086add7954804fff265703d2
-
SHA1
d673a1b0c36d67f36a426ab9fb0c7fbdb4eda735
-
SHA256
84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823
-
SHA512
90d2a5959089a799f866e585a1f7cc36201d8da1315a3c728b5f43600dc4b5e76923ce62dadf83a09cd4f506d0611e10f51fd3ffd9e9ac6af650fea96c7cc52e
-
SSDEEP
1536:lps8VcvdWqEFgaT0Go7tgHuUA31gYr3pV1DeBwvkr:lp/caW2oK+RqaM
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elfdescription ioc Process File opened for modification /dev/watchdog 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for modification /dev/misc/watchdog 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
Processes:
84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elfdescription ioc Process File opened for modification /sbin/watchdog 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for modification /bin/watchdog 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf -
Processes:
84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elfdescription ioc Process File opened for reading /proc/1560/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/83/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/86/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/1404/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/1477/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/373/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/499/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/673/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/1396/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/78/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/745/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/1114/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/1122/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/2/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/3/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/7/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/25/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/1534/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/1301/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/217/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/644/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/693/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/1050/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/1425/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/11/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/18/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/23/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/590/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/98/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/109/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/210/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/307/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/9/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/13/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/22/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/26/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/1208/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/1267/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/308/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/411/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/425/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/1153/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/1289/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/21/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/213/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/1129/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/1138/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/1/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/95/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/584/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/1041/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/446/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/778/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/1167/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/1315/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/1180/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/1596/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/8/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/80/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/113/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/1102/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/212/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/980/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf File opened for reading /proc/1158/status 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf