Analysis
-
max time kernel
149s -
max time network
129s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240522.1-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240522.1-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
17-12-2024 01:45
Behavioral task
behavioral1
Sample
0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf
Resource
ubuntu2204-amd64-20240522.1-en
ubuntu-22.04-amd64
6 signatures
150 seconds
General
-
Target
0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf
-
Size
20KB
-
MD5
ca95eab493cfc9b9bed940c9a28a1b26
-
SHA1
54ac919ada2b946bf6d8e4766cdadfb5206b518e
-
SHA256
0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923
-
SHA512
56261bb12c76257c1b2162de8b8ffdf4e2a8efefccde8703ab1ac2ebb1a0363e120d2ead06c83b6c8faff011fdde7a06b2cdb95297f02f2f8e68a17163209ea7
-
SSDEEP
384:MgWLpj8s/qPui8uZxoIA57RWQjJiEVi+Zkqafc1oj5CWRfINhCjTn6Epl9zpdI83:O98o08kxofBE+ZkqNxWRogTn6Ep3lTz
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for modification /dev/misc/watchdog 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for modification /bin/watchdog 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf -
description ioc Process File opened for reading /proc/1054/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/1389/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/1426/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/1111/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/1170/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/1287/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/1352/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/956/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/1166/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/1181/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/585/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/639/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/1045/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/1057/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/1363/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/521/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/739/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/1039/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/408/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/588/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/794/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/984/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/1198/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/1284/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/993/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/1159/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/1556/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/612/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/731/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/1448/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/1493/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/415/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/589/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/518/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/740/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/1070/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/1275/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/1318/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/1157/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/992/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/1177/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/613/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/1147/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/1205/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/1253/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/759/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/1068/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/1541/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/452/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/634/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/771/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/973/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/1190/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/1279/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/638/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/735/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/766/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/1158/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/1179/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/633/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/772/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/1096/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/1117/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf File opened for reading /proc/1232/cmdline 0439117b36cccec92a1ff3ec8bb5f36f65b42a8c2a323e38fea98c4b6c572923.elf