Analysis
-
max time kernel
130s -
max time network
34s -
platform
debian-12_mipsel -
resource
debian12-mipsel-20240221-en -
resource tags
arch:mipselimage:debian12-mipsel-20240221-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem -
submitted
10-12-2024 01:07
Behavioral task
behavioral1
Sample
2cdb081c1828de59669f777c0f6a867acde762d2201f169887e33b133a91b568.elf
Resource
debian12-mipsel-20240221-en
6 signatures
150 seconds
General
-
Target
2cdb081c1828de59669f777c0f6a867acde762d2201f169887e33b133a91b568.elf
-
Size
24KB
-
MD5
302bc8811041c2f816f8bf82fed28473
-
SHA1
ebb9ebd1df93353b9d928b609848a775bdeb3071
-
SHA256
2cdb081c1828de59669f777c0f6a867acde762d2201f169887e33b133a91b568
-
SHA512
f2c94ef641ef7e42913baef3a4c299f450652b6e22849f0818f6738a7d933dce2002f6b0b3fe8a2553d6ef4658e9cdfb15207289b5e104cdc34479be70df699d
-
SSDEEP
768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpZZqSWvd:4QlS07FUXqIYSXQKquPqF
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 2cdb081c1828de59669f777c0f6a867acde762d2201f169887e33b133a91b568.elf File opened for modification /dev/misc/watchdog 2cdb081c1828de59669f777c0f6a867acde762d2201f169887e33b133a91b568.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 2cdb081c1828de59669f777c0f6a867acde762d2201f169887e33b133a91b568.elf File opened for modification /bin/watchdog 2cdb081c1828de59669f777c0f6a867acde762d2201f169887e33b133a91b568.elf -
description ioc Process File opened for reading /proc/713/cmdline 2cdb081c1828de59669f777c0f6a867acde762d2201f169887e33b133a91b568.elf File opened for reading /proc/749/cmdline 2cdb081c1828de59669f777c0f6a867acde762d2201f169887e33b133a91b568.elf File opened for reading /proc/795/cmdline 2cdb081c1828de59669f777c0f6a867acde762d2201f169887e33b133a91b568.elf File opened for reading /proc/690/cmdline 2cdb081c1828de59669f777c0f6a867acde762d2201f169887e33b133a91b568.elf File opened for reading /proc/745/cmdline 2cdb081c1828de59669f777c0f6a867acde762d2201f169887e33b133a91b568.elf File opened for reading /proc/799/cmdline 2cdb081c1828de59669f777c0f6a867acde762d2201f169887e33b133a91b568.elf File opened for reading /proc/710/cmdline 2cdb081c1828de59669f777c0f6a867acde762d2201f169887e33b133a91b568.elf File opened for reading /proc/717/cmdline 2cdb081c1828de59669f777c0f6a867acde762d2201f169887e33b133a91b568.elf File opened for reading /proc/721/cmdline 2cdb081c1828de59669f777c0f6a867acde762d2201f169887e33b133a91b568.elf File opened for reading /proc/731/cmdline 2cdb081c1828de59669f777c0f6a867acde762d2201f169887e33b133a91b568.elf File opened for reading /proc/771/cmdline 2cdb081c1828de59669f777c0f6a867acde762d2201f169887e33b133a91b568.elf File opened for reading /proc/796/cmdline 2cdb081c1828de59669f777c0f6a867acde762d2201f169887e33b133a91b568.elf File opened for reading /proc/409/cmdline 2cdb081c1828de59669f777c0f6a867acde762d2201f169887e33b133a91b568.elf File opened for reading /proc/431/cmdline 2cdb081c1828de59669f777c0f6a867acde762d2201f169887e33b133a91b568.elf File opened for reading /proc/786/cmdline 2cdb081c1828de59669f777c0f6a867acde762d2201f169887e33b133a91b568.elf File opened for reading /proc/622/cmdline 2cdb081c1828de59669f777c0f6a867acde762d2201f169887e33b133a91b568.elf File opened for reading /proc/693/cmdline 2cdb081c1828de59669f777c0f6a867acde762d2201f169887e33b133a91b568.elf File opened for reading /proc/691/cmdline 2cdb081c1828de59669f777c0f6a867acde762d2201f169887e33b133a91b568.elf File opened for reading /proc/732/cmdline 2cdb081c1828de59669f777c0f6a867acde762d2201f169887e33b133a91b568.elf File opened for reading /proc/793/cmdline 2cdb081c1828de59669f777c0f6a867acde762d2201f169887e33b133a91b568.elf File opened for reading /proc/410/cmdline 2cdb081c1828de59669f777c0f6a867acde762d2201f169887e33b133a91b568.elf File opened for reading /proc/773/cmdline 2cdb081c1828de59669f777c0f6a867acde762d2201f169887e33b133a91b568.elf File opened for reading /proc/791/cmdline 2cdb081c1828de59669f777c0f6a867acde762d2201f169887e33b133a91b568.elf File opened for reading /proc/815/cmdline 2cdb081c1828de59669f777c0f6a867acde762d2201f169887e33b133a91b568.elf File opened for reading /proc/618/cmdline 2cdb081c1828de59669f777c0f6a867acde762d2201f169887e33b133a91b568.elf File opened for reading /proc/718/cmdline 2cdb081c1828de59669f777c0f6a867acde762d2201f169887e33b133a91b568.elf File opened for reading /proc/772/cmdline 2cdb081c1828de59669f777c0f6a867acde762d2201f169887e33b133a91b568.elf