Analysis
-
max time kernel
149s -
max time network
129s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240729-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240729-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
15-12-2024 20:27
Behavioral task
behavioral1
Sample
boatnet.x86.elf
Resource
ubuntu1804-amd64-20240729-en
ubuntu-18.04-amd64
6 signatures
150 seconds
General
-
Target
boatnet.x86.elf
-
Size
20KB
-
MD5
ca95eab493cfc9b9bed940c9a28a1b26
-
SHA1
54ac919ada2b946bf6d8e4766cdadfb5206b518e
-
SHA256
0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923
-
SHA512
56261bb12c76257c1b2162de8b8ffdf4e2a8efefccde8703ab1ac2ebb1a0363e120d2ead06c83b6c8faff011fdde7a06b2cdb95297f02f2f8e68a17163209ea7
-
SSDEEP
384:MgWLpj8s/qPui8uZxoIA57RWQjJiEVi+Zkqafc1oj5CWRfINhCjTn6Epl9zpdI83:O98o08kxofBE+ZkqNxWRogTn6Ep3lTz
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog boatnet.x86.elf File opened for modification /dev/misc/watchdog boatnet.x86.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog boatnet.x86.elf File opened for modification /bin/watchdog boatnet.x86.elf -
description ioc Process File opened for reading /proc/689/cmdline boatnet.x86.elf File opened for reading /proc/1134/cmdline boatnet.x86.elf File opened for reading /proc/1066/cmdline boatnet.x86.elf File opened for reading /proc/1090/cmdline boatnet.x86.elf File opened for reading /proc/1126/cmdline boatnet.x86.elf File opened for reading /proc/1147/cmdline boatnet.x86.elf File opened for reading /proc/1152/cmdline boatnet.x86.elf File opened for reading /proc/1275/cmdline boatnet.x86.elf File opened for reading /proc/1587/cmdline boatnet.x86.elf File opened for reading /proc/1171/cmdline boatnet.x86.elf File opened for reading /proc/496/cmdline boatnet.x86.elf File opened for reading /proc/523/cmdline boatnet.x86.elf File opened for reading /proc/705/cmdline boatnet.x86.elf File opened for reading /proc/969/cmdline boatnet.x86.elf File opened for reading /proc/1331/cmdline boatnet.x86.elf File opened for reading /proc/1337/cmdline boatnet.x86.elf File opened for reading /proc/461/cmdline boatnet.x86.elf File opened for reading /proc/1076/cmdline boatnet.x86.elf File opened for reading /proc/965/cmdline boatnet.x86.elf File opened for reading /proc/1314/cmdline boatnet.x86.elf File opened for reading /proc/685/cmdline boatnet.x86.elf File opened for reading /proc/955/cmdline boatnet.x86.elf File opened for reading /proc/1170/cmdline boatnet.x86.elf File opened for reading /proc/1581/cmdline boatnet.x86.elf File opened for reading /proc/953/cmdline boatnet.x86.elf File opened for reading /proc/1143/cmdline boatnet.x86.elf File opened for reading /proc/1350/cmdline boatnet.x86.elf File opened for reading /proc/415/cmdline boatnet.x86.elf File opened for reading /proc/552/cmdline boatnet.x86.elf File opened for reading /proc/1176/cmdline boatnet.x86.elf File opened for reading /proc/647/cmdline boatnet.x86.elf File opened for reading /proc/1156/cmdline boatnet.x86.elf File opened for reading /proc/460/cmdline boatnet.x86.elf File opened for reading /proc/522/cmdline boatnet.x86.elf File opened for reading /proc/1114/cmdline boatnet.x86.elf File opened for reading /proc/1187/cmdline boatnet.x86.elf File opened for reading /proc/1316/cmdline boatnet.x86.elf File opened for reading /proc/1617/cmdline boatnet.x86.elf File opened for reading /proc/576/cmdline boatnet.x86.elf File opened for reading /proc/1593/cmdline boatnet.x86.elf File opened for reading /proc/1623/cmdline boatnet.x86.elf File opened for reading /proc/1130/cmdline boatnet.x86.elf File opened for reading /proc/1190/cmdline boatnet.x86.elf File opened for reading /proc/462/cmdline boatnet.x86.elf File opened for reading /proc/486/cmdline boatnet.x86.elf File opened for reading /proc/1014/cmdline boatnet.x86.elf File opened for reading /proc/1122/cmdline boatnet.x86.elf File opened for reading /proc/1185/cmdline boatnet.x86.elf File opened for reading /proc/1555/cmdline boatnet.x86.elf File opened for reading /proc/1561/cmdline boatnet.x86.elf File opened for reading /proc/650/cmdline boatnet.x86.elf File opened for reading /proc/1188/cmdline boatnet.x86.elf File opened for reading /proc/1193/cmdline boatnet.x86.elf File opened for reading /proc/1197/cmdline boatnet.x86.elf File opened for reading /proc/1605/cmdline boatnet.x86.elf File opened for reading /proc/1019/cmdline boatnet.x86.elf File opened for reading /proc/1547/cmdline boatnet.x86.elf File opened for reading /proc/1567/cmdline boatnet.x86.elf File opened for reading /proc/1641/cmdline boatnet.x86.elf File opened for reading /proc/1299/cmdline boatnet.x86.elf File opened for reading /proc/1043/cmdline boatnet.x86.elf File opened for reading /proc/428/cmdline boatnet.x86.elf File opened for reading /proc/437/cmdline boatnet.x86.elf File opened for reading /proc/1069/cmdline boatnet.x86.elf