Analysis
-
max time kernel
149s -
max time network
187s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
15-11-2024 02:07
Behavioral task
behavioral1
Sample
xd.arm.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
8 signatures
150 seconds
General
-
Target
xd.arm.elf
-
Size
35KB
-
MD5
6856a7a8feb0592ba82aafdf6d5fcc8c
-
SHA1
bfdc3ca6a60a546b72a1bfecc036c0459eca3c69
-
SHA256
ab07aa532d5e8bc8f6c811cc04f884bd8d991390a8db34b32ef8a6a5733a0e02
-
SHA512
981f623bde726388de0d592a7afd92c34b99c99d121459240ac0743ad33747f7980a3203c9bf4228adb8a59725414424b150bd6e1d7421d933df9d38d34ecfb2
-
SSDEEP
768:0bAbsP5R35GrEBb3PuwNch7r6rJp2nhSimK/VI8Os3UozB:0bksXpDBb3PDNgr6rJchSimeVISzB
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Contacts a large (20645) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog xd.arm.elf File opened for modification /dev/misc/watchdog xd.arm.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads process memory 1 TTPs 64 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/10/maps xd.arm.elf File opened for reading /proc/278/maps xd.arm.elf File opened for reading /proc/682/maps xd.arm.elf File opened for reading /proc/43/maps xd.arm.elf File opened for reading /proc/309/maps xd.arm.elf File opened for reading /proc/647/maps xd.arm.elf File opened for reading /proc/648/maps xd.arm.elf File opened for reading /proc/652/maps xd.arm.elf File opened for reading /proc/28/maps xd.arm.elf File opened for reading /proc/20/maps xd.arm.elf File opened for reading /proc/26/maps xd.arm.elf File opened for reading /proc/701/maps xd.arm.elf File opened for reading /proc/791/maps xd.arm.elf File opened for reading /proc/12/maps xd.arm.elf File opened for reading /proc/724/maps xd.arm.elf File opened for reading /proc/751/maps xd.arm.elf File opened for reading /proc/787/maps xd.arm.elf File opened for reading /proc/2/maps xd.arm.elf File opened for reading /proc/18/maps xd.arm.elf File opened for reading /proc/23/maps xd.arm.elf File opened for reading /proc/653/maps xd.arm.elf File opened for reading /proc/773/maps xd.arm.elf File opened for reading /proc/24/maps xd.arm.elf File opened for reading /proc/42/maps xd.arm.elf File opened for reading /proc/263/maps xd.arm.elf File opened for reading /proc/14/maps xd.arm.elf File opened for reading /proc/27/maps xd.arm.elf File opened for reading /proc/267/maps xd.arm.elf File opened for reading /proc/660/maps xd.arm.elf File opened for reading /proc/781/maps xd.arm.elf File opened for reading /proc/15/maps xd.arm.elf File opened for reading /proc/672/maps xd.arm.elf File opened for reading /proc/795/maps xd.arm.elf File opened for reading /proc/21/maps xd.arm.elf File opened for reading /proc/317/maps xd.arm.elf File opened for reading /proc/768/maps xd.arm.elf File opened for reading /proc/776/maps xd.arm.elf File opened for reading /proc/9/maps xd.arm.elf File opened for reading /proc/25/maps xd.arm.elf File opened for reading /proc/73/maps xd.arm.elf File opened for reading /proc/41/maps xd.arm.elf File opened for reading /proc/95/maps xd.arm.elf File opened for reading /proc/329/maps xd.arm.elf File opened for reading /proc/107/maps xd.arm.elf File opened for reading /proc/746/maps xd.arm.elf File opened for reading /proc/792/maps xd.arm.elf File opened for reading /proc/8/maps xd.arm.elf File opened for reading /proc/19/maps xd.arm.elf File opened for reading /proc/141/maps xd.arm.elf File opened for reading /proc/265/maps xd.arm.elf File opened for reading /proc/696/maps xd.arm.elf File opened for reading /proc/165/maps xd.arm.elf File opened for reading /proc/692/maps xd.arm.elf File opened for reading /proc/714/maps xd.arm.elf File opened for reading /proc/750/maps xd.arm.elf File opened for reading /proc/674/maps xd.arm.elf File opened for reading /proc/709/maps xd.arm.elf File opened for reading /proc/720/maps xd.arm.elf File opened for reading /proc/3/maps xd.arm.elf File opened for reading /proc/11/maps xd.arm.elf File opened for reading /proc/148/maps xd.arm.elf File opened for reading /proc/602/maps xd.arm.elf File opened for reading /proc/662/maps xd.arm.elf File opened for reading /proc/766/maps xd.arm.elf -
description ioc Process File opened for reading /proc/self/exe xd.arm.elf