Analysis
-
max time kernel
147s -
max time network
149s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20240523-en -
resource tags
arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system -
submitted
15-11-2024 22:32
Behavioral task
behavioral1
Sample
Satan.x86_64.elf
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
6 signatures
150 seconds
General
-
Target
Satan.x86_64.elf
-
Size
36KB
-
MD5
61e21345f095015159d3bc3cf8e03c45
-
SHA1
10110e69d9ad7704150f454d385312c4784f6ec8
-
SHA256
fbdd988dc8735258f6fea1c65e740d2b727844ad120b065bfb8a545b7aad9dc6
-
SHA512
1aaf63f2e069fbbfb4b40e132e67befb14b0dfe421bb3eb6dee02bac2781d34ae7e8e7dba693700ae218cfcf9f687e1694a2a6f1ee04bfc6fc2233d0c9debb68
-
SSDEEP
768:c+4qtvWUAASjjLMGz7/tjBQd4Mt8nEPH3GguHNg+Wx0L:H9tvWrASjjL17/9BODtoPguHNqC
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog Satan.x86_64.elf File opened for modification /dev/misc/watchdog Satan.x86_64.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /bin/watchdog Satan.x86_64.elf File opened for modification /sbin/watchdog Satan.x86_64.elf -
description ioc Process File opened for reading /proc/21/status Satan.x86_64.elf File opened for reading /proc/41/status Satan.x86_64.elf File opened for reading /proc/63/status Satan.x86_64.elf File opened for reading /proc/789/status Satan.x86_64.elf File opened for reading /proc/1788/status Satan.x86_64.elf File opened for reading /proc/2192/status Satan.x86_64.elf File opened for reading /proc/2471/status Satan.x86_64.elf File opened for reading /proc/1831/status Satan.x86_64.elf File opened for reading /proc/2/status Satan.x86_64.elf File opened for reading /proc/13/status Satan.x86_64.elf File opened for reading /proc/22/status Satan.x86_64.elf File opened for reading /proc/357/status Satan.x86_64.elf File opened for reading /proc/1122/status Satan.x86_64.elf File opened for reading /proc/1667/status Satan.x86_64.elf File opened for reading /proc/1684/status Satan.x86_64.elf File opened for reading /proc/2129/status Satan.x86_64.elf File opened for reading /proc/2290/status Satan.x86_64.elf File opened for reading /proc/2318/status Satan.x86_64.elf File opened for reading /proc/80/status Satan.x86_64.elf File opened for reading /proc/182/status Satan.x86_64.elf File opened for reading /proc/189/status Satan.x86_64.elf File opened for reading /proc/2222/status Satan.x86_64.elf File opened for reading /proc/235/status Satan.x86_64.elf File opened for reading /proc/1068/status Satan.x86_64.elf File opened for reading /proc/1401/status Satan.x86_64.elf File opened for reading /proc/2267/status Satan.x86_64.elf File opened for reading /proc/25/status Satan.x86_64.elf File opened for reading /proc/46/status Satan.x86_64.elf File opened for reading /proc/1342/status Satan.x86_64.elf File opened for reading /proc/12/status Satan.x86_64.elf File opened for reading /proc/23/status Satan.x86_64.elf File opened for reading /proc/34/status Satan.x86_64.elf File opened for reading /proc/191/status Satan.x86_64.elf File opened for reading /proc/1126/status Satan.x86_64.elf File opened for reading /proc/1771/status Satan.x86_64.elf File opened for reading /proc/1989/status Satan.x86_64.elf File opened for reading /proc/14/status Satan.x86_64.elf File opened for reading /proc/194/status Satan.x86_64.elf File opened for reading /proc/1931/status Satan.x86_64.elf File opened for reading /proc/1996/status Satan.x86_64.elf File opened for reading /proc/2130/status Satan.x86_64.elf File opened for reading /proc/2142/status Satan.x86_64.elf File opened for reading /proc/2257/status Satan.x86_64.elf File opened for reading /proc/27/status Satan.x86_64.elf File opened for reading /proc/30/status Satan.x86_64.elf File opened for reading /proc/44/status Satan.x86_64.elf File opened for reading /proc/575/status Satan.x86_64.elf File opened for reading /proc/2199/status Satan.x86_64.elf File opened for reading /proc/2469/status Satan.x86_64.elf File opened for reading /proc/69/status Satan.x86_64.elf File opened for reading /proc/124/status Satan.x86_64.elf File opened for reading /proc/441/status Satan.x86_64.elf File opened for reading /proc/2076/status Satan.x86_64.elf File opened for reading /proc/2270/status Satan.x86_64.elf File opened for reading /proc/2468/status Satan.x86_64.elf File opened for reading /proc/2475/status Satan.x86_64.elf File opened for reading /proc/10/status Satan.x86_64.elf File opened for reading /proc/51/status Satan.x86_64.elf File opened for reading /proc/585/status Satan.x86_64.elf File opened for reading /proc/1091/status Satan.x86_64.elf File opened for reading /proc/1855/status Satan.x86_64.elf File opened for reading /proc/1877/status Satan.x86_64.elf File opened for reading /proc/1966/status Satan.x86_64.elf File opened for reading /proc/16/status Satan.x86_64.elf