Analysis
-
max time kernel
148s -
max time network
15s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
02/12/2024, 02:57
Behavioral task
behavioral1
Sample
c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
6 signatures
150 seconds
General
-
Target
c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf
-
Size
45KB
-
MD5
7b81230032eda0c976209e08e0f36f8d
-
SHA1
a932a7360a93384e2205f552321ecc87f011c5b0
-
SHA256
c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe
-
SHA512
1a5de3ab1be314123c6439de0c5568c5192b23abaa9c6ef118f06506cf20b2c66d1486e3f64f74659cc8f0761233fc1c4f90ed64e8f7db227f8f93e2935241b5
-
SSDEEP
768:D/TYCoIxdEk+AxoTZAZHFeq8b3I99q3UELbUXfi6nVMQHI4vcGpvP:DECFd+A6YHAxIQLRQZP
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf File opened for modification /dev/misc/watchdog c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf File opened for modification /bin/watchdog c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf -
description ioc Process File opened for reading /proc/770/cmdline c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf File opened for reading /proc/777/cmdline c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf File opened for reading /proc/783/cmdline c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf File opened for reading /proc/650/cmdline c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf File opened for reading /proc/769/cmdline c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf File opened for reading /proc/726/cmdline c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf File opened for reading /proc/787/cmdline c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf File opened for reading /proc/788/cmdline c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf File opened for reading /proc/649/cmdline c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf File opened for reading /proc/691/cmdline c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf File opened for reading /proc/683/cmdline c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf File opened for reading /proc/718/cmdline c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf File opened for reading /proc/711/cmdline c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf File opened for reading /proc/729/cmdline c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf File opened for reading /proc/760/cmdline c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf File opened for reading /proc/767/cmdline c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf File opened for reading /proc/771/cmdline c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf File opened for reading /proc/781/cmdline c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf File opened for reading /proc/643/cmdline c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf File opened for reading /proc/644/cmdline c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf File opened for reading /proc/785/cmdline c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf File opened for reading /proc/780/cmdline c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf File opened for reading /proc/648/cmdline c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf File opened for reading /proc/705/cmdline c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf File opened for reading /proc/765/cmdline c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf File opened for reading /proc/773/cmdline c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf File opened for reading /proc/self/exe c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf File opened for reading /proc/714/cmdline c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf File opened for reading /proc/441/cmdline c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf File opened for reading /proc/604/cmdline c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf File opened for reading /proc/654/cmdline c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf File opened for reading /proc/656/cmdline c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf File opened for reading /proc/661/cmdline c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf File opened for reading /proc/685/cmdline c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf File opened for reading /proc/403/cmdline c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf File opened for reading /proc/439/cmdline c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf File opened for reading /proc/775/cmdline c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf File opened for reading /proc/779/cmdline c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf File opened for reading /proc/748/cmdline c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf File opened for reading /proc/756/cmdline c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf File opened for reading /proc/736/cmdline c2729a12005e0185fafbd2c71873cf60c6c472a2949faffb6a2f422c7dd2fdbe.elf