Analysis
-
max time kernel
149s -
max time network
129s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240522.1-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240522.1-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
02/12/2024, 02:06
Behavioral task
behavioral1
Sample
2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf
Resource
ubuntu2204-amd64-20240522.1-en
ubuntu-22.04-amd64
6 signatures
150 seconds
General
-
Target
2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf
-
Size
20KB
-
MD5
e496f61986a63fbc38f42754b4877a16
-
SHA1
0950cc4d4c0583040210177db98411e5b06f5004
-
SHA256
2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf
-
SHA512
a6b28e1b323242d5b17c48639a8fa8642f43892c3a292d3fff89bf02b46b8ca0d4e756074d8b9a238a1caea7adba467d26cc0a0bd184f20321dbe54114dd3a5a
-
SSDEEP
384:M0DLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTA:x98o08kxofBE+ZkXaITbp2F2TWul0c5E
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for modification /dev/misc/watchdog 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for modification /bin/watchdog 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf -
description ioc Process File opened for reading /proc/589/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/1114/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/1449/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/762/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/774/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/1087/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/1239/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/1389/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/832/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/1043/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/590/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/1377/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/1144/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/1089/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/1164/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/413/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/743/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/1551/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/1053/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/1374/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/1124/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/1158/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/1160/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/748/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/1032/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/977/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/1155/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/1227/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/740/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/827/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/1131/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/1162/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/1436/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/415/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/418/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/1061/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/1238/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/1281/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/1540/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/586/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/613/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/1037/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/1176/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/508/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/793/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/1168/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/978/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/1159/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/785/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/1163/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/614/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/635/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/1252/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/409/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/634/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/1106/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/691/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/764/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/1097/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/1140/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/1247/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/732/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/957/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf File opened for reading /proc/1347/cmdline 2156dc83b9b4882b3bceb4a6a37e88f2b04441795730856c00716c3c057714cf.elf