Analysis
-
max time kernel
149s -
max time network
18s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
09/12/2024, 02:41
Behavioral task
behavioral1
Sample
a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
6 signatures
150 seconds
General
-
Target
a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf
-
Size
45KB
-
MD5
b587f4a1e1f6d355db37ef3cbc9d8813
-
SHA1
5a5e525c829f7df295d125a4044bab3ea4ce2711
-
SHA256
a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95
-
SHA512
35b8ee6155070025145d3ad760fb1a2a9c39354cf5d44d63eae7424defac4a402b470dfa496502b92623b970a19baffcaa7a095ff3e509e10cf3bd3a3bae7696
-
SSDEEP
768:JW2myW5zrY3m+KDOtELVpuyUEQNIM4ZktwkVlXFbkdzxe9q3UELMIk9r/e/lQMqU:A7d5zrY3mVqtSEyUE0IM4Fk7FbkdzpLv
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf File opened for modification /dev/misc/watchdog a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf File opened for modification /bin/watchdog a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf -
description ioc Process File opened for reading /proc/410/cmdline a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf File opened for reading /proc/702/cmdline a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf File opened for reading /proc/722/cmdline a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf File opened for reading /proc/745/cmdline a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf File opened for reading /proc/794/cmdline a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf File opened for reading /proc/704/cmdline a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf File opened for reading /proc/798/cmdline a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf File opened for reading /proc/804/cmdline a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf File opened for reading /proc/808/cmdline a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf File opened for reading /proc/673/cmdline a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf File opened for reading /proc/676/cmdline a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf File opened for reading /proc/677/cmdline a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf File opened for reading /proc/733/cmdline a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf File opened for reading /proc/807/cmdline a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf File opened for reading /proc/self/exe a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf File opened for reading /proc/447/cmdline a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf File opened for reading /proc/622/cmdline a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf File opened for reading /proc/662/cmdline a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf File opened for reading /proc/788/cmdline a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf File opened for reading /proc/404/cmdline a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf File opened for reading /proc/666/cmdline a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf File opened for reading /proc/796/cmdline a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf File opened for reading /proc/786/cmdline a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf File opened for reading /proc/790/cmdline a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf File opened for reading /proc/448/cmdline a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf File opened for reading /proc/661/cmdline a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf File opened for reading /proc/737/cmdline a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf File opened for reading /proc/749/cmdline a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf File opened for reading /proc/783/cmdline a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf File opened for reading /proc/750/cmdline a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf File opened for reading /proc/779/cmdline a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf File opened for reading /proc/806/cmdline a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf File opened for reading /proc/763/cmdline a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf File opened for reading /proc/784/cmdline a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf File opened for reading /proc/792/cmdline a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf File opened for reading /proc/667/cmdline a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf File opened for reading /proc/668/cmdline a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf File opened for reading /proc/710/cmdline a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf File opened for reading /proc/726/cmdline a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf File opened for reading /proc/734/cmdline a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf File opened for reading /proc/800/cmdline a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf File opened for reading /proc/802/cmdline a69d840b7f32694d0cb26524ca117b6a645359901411ecc5c1d5467b3ba8de95.elf