Analysis
-
max time kernel
148s -
max time network
13s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
02/12/2024, 03:04
Behavioral task
behavioral1
Sample
db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
6 signatures
150 seconds
General
-
Target
db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf
-
Size
45KB
-
MD5
5ef10adf3247d448cc0a664abefb50ea
-
SHA1
34e1428b630e5a9e5f3e0fb682a47d213674851c
-
SHA256
db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d
-
SHA512
d058dec8c037e7f0946acecf752aae4768292f3d49a1f3741cab8ce4c776ccdda32334c71e019335168cccd351a9d85a0f197e3e0efcb9bf01cd69a124773e25
-
SSDEEP
768:D/TYCoIxdEk+AxoTZAZHFeq8b3or9q3UELbUXfi6nVMQHI4vcGpv1:DECFd+A6YHAxoKLRQZ1
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for modification /dev/misc/watchdog db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for modification /bin/watchdog db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf -
description ioc Process File opened for reading /proc/813/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/self/exe db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/441/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/681/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/708/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/751/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/787/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/808/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/629/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/710/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/779/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/795/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/798/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/807/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/801/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/489/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/746/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/753/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/770/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/786/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/792/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/799/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/488/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/811/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/429/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/686/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/711/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/747/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/803/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/669/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/673/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/724/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/731/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/739/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/769/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/793/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/805/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/730/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/791/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/809/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/797/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/668/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/674/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/675/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/679/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/718/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/743/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf File opened for reading /proc/784/cmdline db41931c7733f5086f807f4e01ab87fb1d4dbb60c0f81dfd3ce564b444cdf14d.elf