Analysis
-
max time kernel
148s -
max time network
132s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20240508-en -
resource tags
arch:amd64arch:i386image:ubuntu2004-amd64-20240508-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system -
submitted
03/12/2024, 02:09
Behavioral task
behavioral1
Sample
1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf
Resource
ubuntu2004-amd64-20240508-en
ubuntu-20.04-amd64
6 signatures
150 seconds
General
-
Target
1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf
-
Size
22KB
-
MD5
fabfa526cad5319365ea6653e6f9ced8
-
SHA1
136bc476e87c8abd1139876951b2f9d7d5987bac
-
SHA256
1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f
-
SHA512
3aaae3ebc9f2c1e28eda4a8857f051f76666657436a77bbd13e3c2cc60bf2f9f3b5ecca984c84e6f43acc5fd14a0827c16926d55c52f4ca7df764a790cc065a0
-
SSDEEP
384:BPF1Pel7ZYiR5YBuukX3R993wleTUUrbpcRChgnNMlfrpyd7lr8aBThN2lM5B7hi:B91PIZvRZZhzkiUURWChgnNwydJXB1Ng
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for modification /dev/misc/watchdog 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for modification /bin/watchdog 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf -
description ioc Process File opened for reading /proc/783/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/1004/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/1032/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/1082/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/1337/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/567/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/639/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/944/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/1053/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/1403/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/485/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/499/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/523/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/616/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/960/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/1083/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/1322/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/519/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/546/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/576/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/582/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/589/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/1075/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/1182/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/1408/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/667/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/1063/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/1078/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/1079/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/480/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/570/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/617/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/693/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/800/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/949/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/1036/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/1152/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/1165/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/453/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/483/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/537/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/638/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/808/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/1074/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/1402/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/440/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/495/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/671/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/906/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/689/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/778/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/913/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/439/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/793/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/981/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/1202/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/1044/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/1072/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/1076/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/1077/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/1081/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/1108/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/1445/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf File opened for reading /proc/442/cmdline 1d527eb33d504aa5f19fc15da542a1e6911bc07d751ab4570ba49b159569681f.elf