Analysis
-
max time kernel
149s -
max time network
4s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
17-12-2024 01:26
Behavioral task
behavioral1
Sample
09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
6 signatures
150 seconds
General
-
Target
09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf
-
Size
45KB
-
MD5
7e09c5fd1a2407b1af66d5b00b12d87f
-
SHA1
10f034c43ccb844574aeb5bcd1dfcfe70050a2e5
-
SHA256
09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f
-
SHA512
c966ae3f60ed07b150b2f1f9f964a186bd2c811dcc0cb386290e60188c9104fc49e6f515448347d4908891f3d5ceeff8b068ead4750230ec29f3053f7a77b95d
-
SSDEEP
768:g/TYCoIxYc7rI0QBsRvNlJxiWO6i9q3UELbUXfi6nVMQHI4vcGpvY:gECFScnmBsRvNlJxiW9XLRQZY
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf File opened for modification /dev/misc/watchdog 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf File opened for modification /bin/watchdog 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf -
description ioc Process File opened for reading /proc/419/cmdline 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf File opened for reading /proc/646/cmdline 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf File opened for reading /proc/708/cmdline 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf File opened for reading /proc/759/cmdline 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf File opened for reading /proc/781/cmdline 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf File opened for reading /proc/709/cmdline 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf File opened for reading /proc/727/cmdline 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf File opened for reading /proc/771/cmdline 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf File opened for reading /proc/785/cmdline 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf File opened for reading /proc/463/cmdline 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf File opened for reading /proc/652/cmdline 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf File opened for reading /proc/657/cmdline 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf File opened for reading /proc/753/cmdline 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf File opened for reading /proc/777/cmdline 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf File opened for reading /proc/760/cmdline 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf File opened for reading /proc/773/cmdline 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf File opened for reading /proc/783/cmdline 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf File opened for reading /proc/406/cmdline 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf File opened for reading /proc/608/cmdline 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf File opened for reading /proc/721/cmdline 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf File opened for reading /proc/743/cmdline 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf File opened for reading /proc/757/cmdline 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf File opened for reading /proc/790/cmdline 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf File opened for reading /proc/791/cmdline 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf File opened for reading /proc/789/cmdline 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf File opened for reading /proc/647/cmdline 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf File opened for reading /proc/651/cmdline 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf File opened for reading /proc/729/cmdline 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf File opened for reading /proc/775/cmdline 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf File opened for reading /proc/787/cmdline 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf File opened for reading /proc/744/cmdline 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf File opened for reading /proc/666/cmdline 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf File opened for reading /proc/688/cmdline 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf File opened for reading /proc/694/cmdline 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf File opened for reading /proc/717/cmdline 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf File opened for reading /proc/726/cmdline 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf File opened for reading /proc/765/cmdline 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf File opened for reading /proc/716/cmdline 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf File opened for reading /proc/769/cmdline 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf File opened for reading /proc/779/cmdline 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf File opened for reading /proc/self/exe 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf File opened for reading /proc/464/cmdline 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf File opened for reading /proc/653/cmdline 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf File opened for reading /proc/659/cmdline 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf File opened for reading /proc/665/cmdline 09249f0de05e521c3eda4d43d09343f6108d3f59cd5d3056e5dbfcfb4cca342f.elf