Analysis
-
max time kernel
149s -
max time network
131s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
10-12-2024 02:23
Behavioral task
behavioral1
Sample
2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
6 signatures
150 seconds
General
-
Target
2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf
-
Size
20KB
-
MD5
af64b1c4bbf91493c0e0d5395aac5ced
-
SHA1
fe1dd2c44a8ba21429cb60df36447473bcf7e90b
-
SHA256
2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77
-
SHA512
25bbcaac71a6e533eb10efcba54dedc5abeb681702af4c53ec46850e357d380fcc9804c2ee1793ba8f320243eafa8729d20cdb33ebf3261fc1b5617d75e84154
-
SSDEEP
384:M0DLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oT0:x98o08kxofBE+ZkXaITbp2F2TWul0c5o
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for modification /dev/misc/watchdog 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for modification /bin/watchdog 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf -
description ioc Process File opened for reading /proc/1268/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/1307/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/1308/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/590/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/632/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/767/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/410/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/446/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/1009/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/1050/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/1041/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/1209/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/522/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/633/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/1101/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/1121/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/1165/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/599/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/606/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/666/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/968/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/1088/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/1529/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/1591/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/409/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/503/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/692/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/1321/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/1576/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/589/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/777/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/988/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/1030/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/1564/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/779/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/980/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/1279/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/1397/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/738/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/959/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/1090/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/1166/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/1164/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/1596/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/838/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/1472/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/763/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/1156/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/1291/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/1421/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/987/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/1366/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/412/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/645/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/1077/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/425/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/582/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/1128/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/1137/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/864/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/1159/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/953/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/1035/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf File opened for reading /proc/631/cmdline 2730c95a17ca8400d4daedab03ab5e1f0fec1f8a6dd21d88d8060a1d6d613b77.elf