Analysis
-
max time kernel
148s -
max time network
154s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240729-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240729-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
14-11-2024 03:10
Behavioral task
behavioral1
Sample
d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf
Resource
ubuntu2204-amd64-20240729-en
ubuntu-22.04-amd64
4 signatures
150 seconds
General
-
Target
d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf
-
Size
78KB
-
MD5
ad7cf51c3a7814b58d8eb586f23bf0cc
-
SHA1
2b92c49d7db83feb5f0acc5684b1fcc3aa3d0624
-
SHA256
d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1
-
SHA512
b3e9ad817554cea0732d41819ba7eaaf6abf532464eabe874318f105e2691517d3814a719cad703e05b7bb1702310aee6a3fc18b1b661cbf34fed6d8e9b400e8
-
SSDEEP
1536:gtQ59MwY2MhldlO+ttM98cKJdxZZxJ+BAQoEQ1It3R+yd5bUWarW8j0tZxH1c2Ym:gfwfsdlX/3AnmM
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for modification /dev/misc/watchdog d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for modification /bin/watchdog d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf -
description ioc Process File opened for reading /proc/593/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/726/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/740/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/997/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/1315/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/89/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/216/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/377/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/759/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/1515/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/26/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/76/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/93/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/314/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/410/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/778/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/1139/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/20/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/21/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/25/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/91/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/959/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/1060/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/1164/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/1201/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/1375/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/74/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/453/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/586/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/974/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/1241/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/13/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/17/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/98/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/159/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/203/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/209/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/587/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/1320/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/588/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/855/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/982/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/7/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/193/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/771/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/1243/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/213/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/619/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/1195/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/1571/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/9/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/81/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/504/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/1059/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/1103/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/1191/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/222/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/528/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/642/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/749/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/1044/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/1148/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/1216/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf File opened for reading /proc/16/status d1b8fe918f0baa5caa3261e64f22a5c680eab278c57fbedd3b990a27cf677bc1.elf