Analysis
-
max time kernel
135s -
max time network
149s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240522.1-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240522.1-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
20-11-2024 22:52
Behavioral task
behavioral1
Sample
Satan.x86_64.elf
Resource
ubuntu2204-amd64-20240522.1-en
ubuntu-22.04-amd64
6 signatures
150 seconds
General
-
Target
Satan.x86_64.elf
-
Size
36KB
-
MD5
e4df8be7344cd39e0a8e908adbe23cd4
-
SHA1
0a3fa93b2ef3b28f3bdbd9b5b7774d85205d6d86
-
SHA256
c765671d83adf38b777ecf372154f3b6cb163a429ab97256b91bb17f7600fcc8
-
SHA512
c76d538d2a6a5ffbde826f2f6265bbd2580d3843bc72c7064b106ddb5e181e3cb57b60578bf0ec9b24c45aee42d94dbd9ed3145d5035439090c743ec0388691d
-
SSDEEP
768:G+4qtvWUAASjjLMGz7/tjBQd4Mt8nEPH3GgurUEUe5Wx0T:19tvWrASjjL17/9BODtoPgurlU9S
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog Satan.x86_64.elf File opened for modification /dev/misc/watchdog Satan.x86_64.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog Satan.x86_64.elf File opened for modification /bin/watchdog Satan.x86_64.elf -
description ioc Process File opened for reading /proc/769/status Satan.x86_64.elf File opened for reading /proc/832/status Satan.x86_64.elf File opened for reading /proc/1037/status Satan.x86_64.elf File opened for reading /proc/1272/status Satan.x86_64.elf File opened for reading /proc/75/status Satan.x86_64.elf File opened for reading /proc/95/status Satan.x86_64.elf File opened for reading /proc/200/status Satan.x86_64.elf File opened for reading /proc/210/status Satan.x86_64.elf File opened for reading /proc/1159/status Satan.x86_64.elf File opened for reading /proc/23/status Satan.x86_64.elf File opened for reading /proc/25/status Satan.x86_64.elf File opened for reading /proc/409/status Satan.x86_64.elf File opened for reading /proc/827/status Satan.x86_64.elf File opened for reading /proc/1158/status Satan.x86_64.elf File opened for reading /proc/1161/status Satan.x86_64.elf File opened for reading /proc/12/status Satan.x86_64.elf File opened for reading /proc/85/status Satan.x86_64.elf File opened for reading /proc/977/status Satan.x86_64.elf File opened for reading /proc/1073/status Satan.x86_64.elf File opened for reading /proc/1259/status Satan.x86_64.elf File opened for reading /proc/1566/status Satan.x86_64.elf File opened for reading /proc/74/status Satan.x86_64.elf File opened for reading /proc/588/status Satan.x86_64.elf File opened for reading /proc/159/status Satan.x86_64.elf File opened for reading /proc/586/status Satan.x86_64.elf File opened for reading /proc/1168/status Satan.x86_64.elf File opened for reading /proc/22/status Satan.x86_64.elf File opened for reading /proc/82/status Satan.x86_64.elf File opened for reading /proc/160/status Satan.x86_64.elf File opened for reading /proc/206/status Satan.x86_64.elf File opened for reading /proc/609/status Satan.x86_64.elf File opened for reading /proc/691/status Satan.x86_64.elf File opened for reading /proc/931/status Satan.x86_64.elf File opened for reading /proc/1053/status Satan.x86_64.elf File opened for reading /proc/11/status Satan.x86_64.elf File opened for reading /proc/77/status Satan.x86_64.elf File opened for reading /proc/1560/status Satan.x86_64.elf File opened for reading /proc/110/status Satan.x86_64.elf File opened for reading /proc/1176/status Satan.x86_64.elf File opened for reading /proc/199/status Satan.x86_64.elf File opened for reading /proc/202/status Satan.x86_64.elf File opened for reading /proc/1052/status Satan.x86_64.elf File opened for reading /proc/1165/status Satan.x86_64.elf File opened for reading /proc/1431/status Satan.x86_64.elf File opened for reading /proc/1484/status Satan.x86_64.elf File opened for reading /proc/93/status Satan.x86_64.elf File opened for reading /proc/101/status Satan.x86_64.elf File opened for reading /proc/639/status Satan.x86_64.elf File opened for reading /proc/764/status Satan.x86_64.elf File opened for reading /proc/774/status Satan.x86_64.elf File opened for reading /proc/1087/status Satan.x86_64.elf File opened for reading /proc/1164/status Satan.x86_64.elf File opened for reading /proc/7/status Satan.x86_64.elf File opened for reading /proc/27/status Satan.x86_64.elf File opened for reading /proc/26/status Satan.x86_64.elf File opened for reading /proc/83/status Satan.x86_64.elf File opened for reading /proc/220/status Satan.x86_64.elf File opened for reading /proc/227/status Satan.x86_64.elf File opened for reading /proc/762/status Satan.x86_64.elf File opened for reading /proc/785/status Satan.x86_64.elf File opened for reading /proc/4/status Satan.x86_64.elf File opened for reading /proc/6/status Satan.x86_64.elf File opened for reading /proc/793/status Satan.x86_64.elf File opened for reading /proc/80/status Satan.x86_64.elf