Analysis
-
max time kernel
149s -
max time network
4s -
platform
debian-9_armhf -
resource
debian9-armhf-20240729-en -
resource tags
arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
19-11-2024 02:05
Behavioral task
behavioral1
Sample
0529d0ee6e10606cc2e74cd34245c35b1db7df1c31ea034e7086a28dc9450c0d.elf
Resource
debian9-armhf-20240729-en
General
-
Target
0529d0ee6e10606cc2e74cd34245c35b1db7df1c31ea034e7086a28dc9450c0d.elf
-
Size
45KB
-
MD5
db67c952830b8b1f6ae914a1ff879a25
-
SHA1
9273ff3fff169e1a33b6e5c97565ddacc27cb0f0
-
SHA256
0529d0ee6e10606cc2e74cd34245c35b1db7df1c31ea034e7086a28dc9450c0d
-
SHA512
03a217e0a84fa4e5d2a274bdf66bf555280c91a27c1ef5722ff6a8e9ba31bac26043cc08c2ac2350c9c7ee0767ca66dcfd589e2bedba8475394ad72a755e13d2
-
SSDEEP
768:D/TYCoIxdEk+AxoTZAZHFeq8b3B9q3UELbUXfi6nVMQHI4vcGpvA:DECFd+A6YHAx0LRQZA
Malware Config
Extracted
mirai
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 0529d0ee6e10606cc2e74cd34245c35b1db7df1c31ea034e7086a28dc9450c0d.elf File opened for modification /dev/misc/watchdog 0529d0ee6e10606cc2e74cd34245c35b1db7df1c31ea034e7086a28dc9450c0d.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 0529d0ee6e10606cc2e74cd34245c35b1db7df1c31ea034e7086a28dc9450c0d.elf File opened for modification /bin/watchdog 0529d0ee6e10606cc2e74cd34245c35b1db7df1c31ea034e7086a28dc9450c0d.elf -
description ioc Process File opened for reading /proc/757/cmdline 0529d0ee6e10606cc2e74cd34245c35b1db7df1c31ea034e7086a28dc9450c0d.elf File opened for reading /proc/775/cmdline 0529d0ee6e10606cc2e74cd34245c35b1db7df1c31ea034e7086a28dc9450c0d.elf File opened for reading /proc/573/cmdline 0529d0ee6e10606cc2e74cd34245c35b1db7df1c31ea034e7086a28dc9450c0d.elf File opened for reading /proc/586/cmdline 0529d0ee6e10606cc2e74cd34245c35b1db7df1c31ea034e7086a28dc9450c0d.elf File opened for reading /proc/594/cmdline 0529d0ee6e10606cc2e74cd34245c35b1db7df1c31ea034e7086a28dc9450c0d.elf File opened for reading /proc/705/cmdline 0529d0ee6e10606cc2e74cd34245c35b1db7df1c31ea034e7086a28dc9450c0d.elf File opened for reading /proc/593/cmdline 0529d0ee6e10606cc2e74cd34245c35b1db7df1c31ea034e7086a28dc9450c0d.elf File opened for reading /proc/638/cmdline 0529d0ee6e10606cc2e74cd34245c35b1db7df1c31ea034e7086a28dc9450c0d.elf File opened for reading /proc/701/cmdline 0529d0ee6e10606cc2e74cd34245c35b1db7df1c31ea034e7086a28dc9450c0d.elf File opened for reading /proc/754/cmdline 0529d0ee6e10606cc2e74cd34245c35b1db7df1c31ea034e7086a28dc9450c0d.elf File opened for reading /proc/765/cmdline 0529d0ee6e10606cc2e74cd34245c35b1db7df1c31ea034e7086a28dc9450c0d.elf File opened for reading /proc/self/exe 0529d0ee6e10606cc2e74cd34245c35b1db7df1c31ea034e7086a28dc9450c0d.elf File opened for reading /proc/642/cmdline 0529d0ee6e10606cc2e74cd34245c35b1db7df1c31ea034e7086a28dc9450c0d.elf File opened for reading /proc/669/cmdline 0529d0ee6e10606cc2e74cd34245c35b1db7df1c31ea034e7086a28dc9450c0d.elf File opened for reading /proc/737/cmdline 0529d0ee6e10606cc2e74cd34245c35b1db7df1c31ea034e7086a28dc9450c0d.elf File opened for reading /proc/773/cmdline 0529d0ee6e10606cc2e74cd34245c35b1db7df1c31ea034e7086a28dc9450c0d.elf File opened for reading /proc/636/cmdline 0529d0ee6e10606cc2e74cd34245c35b1db7df1c31ea034e7086a28dc9450c0d.elf File opened for reading /proc/637/cmdline 0529d0ee6e10606cc2e74cd34245c35b1db7df1c31ea034e7086a28dc9450c0d.elf File opened for reading /proc/759/cmdline 0529d0ee6e10606cc2e74cd34245c35b1db7df1c31ea034e7086a28dc9450c0d.elf File opened for reading /proc/761/cmdline 0529d0ee6e10606cc2e74cd34245c35b1db7df1c31ea034e7086a28dc9450c0d.elf File opened for reading /proc/589/cmdline 0529d0ee6e10606cc2e74cd34245c35b1db7df1c31ea034e7086a28dc9450c0d.elf File opened for reading /proc/631/cmdline 0529d0ee6e10606cc2e74cd34245c35b1db7df1c31ea034e7086a28dc9450c0d.elf File opened for reading /proc/747/cmdline 0529d0ee6e10606cc2e74cd34245c35b1db7df1c31ea034e7086a28dc9450c0d.elf File opened for reading /proc/771/cmdline 0529d0ee6e10606cc2e74cd34245c35b1db7df1c31ea034e7086a28dc9450c0d.elf File opened for reading /proc/769/cmdline 0529d0ee6e10606cc2e74cd34245c35b1db7df1c31ea034e7086a28dc9450c0d.elf File opened for reading /proc/651/cmdline 0529d0ee6e10606cc2e74cd34245c35b1db7df1c31ea034e7086a28dc9450c0d.elf File opened for reading /proc/713/cmdline 0529d0ee6e10606cc2e74cd34245c35b1db7df1c31ea034e7086a28dc9450c0d.elf File opened for reading /proc/749/cmdline 0529d0ee6e10606cc2e74cd34245c35b1db7df1c31ea034e7086a28dc9450c0d.elf File opened for reading /proc/774/cmdline 0529d0ee6e10606cc2e74cd34245c35b1db7df1c31ea034e7086a28dc9450c0d.elf File opened for reading /proc/721/cmdline 0529d0ee6e10606cc2e74cd34245c35b1db7df1c31ea034e7086a28dc9450c0d.elf File opened for reading /proc/756/cmdline 0529d0ee6e10606cc2e74cd34245c35b1db7df1c31ea034e7086a28dc9450c0d.elf File opened for reading /proc/763/cmdline 0529d0ee6e10606cc2e74cd34245c35b1db7df1c31ea034e7086a28dc9450c0d.elf File opened for reading /proc/767/cmdline 0529d0ee6e10606cc2e74cd34245c35b1db7df1c31ea034e7086a28dc9450c0d.elf