Analysis
-
max time kernel
135s -
max time network
147s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
17-12-2024 03:23
Behavioral task
behavioral1
Sample
78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
6 signatures
150 seconds
General
-
Target
78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf
-
Size
35KB
-
MD5
a56e91b6fcccccac6af83d4b96c2d3ed
-
SHA1
60b057a4285c39228b11e854362fd312fac1b94c
-
SHA256
78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d
-
SHA512
357a37eab75a1936bb0642094babc9b6a3a98bf85832b853c23117a3203984dbfdde853b68e4174c76cce34b0a5ffeffb6bcc64e944dda608d7cbc5fd3539edf
-
SSDEEP
768:Y9JFwkShNFPpaMg3zjC/dSmvlG8jbnohnbcuyD7UHQRjp:cwkQmzWVdvY8j7ohnouy8Hyd
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for modification /dev/misc/watchdog 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for modification /bin/watchdog 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf -
description ioc Process File opened for reading /proc/7/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/32/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/82/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/85/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/672/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/1515/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/11/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/1043/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/1176/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/1182/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/1282/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/1326/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/21/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/181/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/461/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/24/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/495/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/12/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/182/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/462/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/9/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/561/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/1119/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/1190/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/79/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/1521/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/1104/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/1199/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/78/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/176/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/177/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/214/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/540/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/1095/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/89/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/174/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/1074/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/1171/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/1524/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/1392/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/1018/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/13/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/178/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/185/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/213/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/429/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/450/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/3/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/84/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/184/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/613/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/1136/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/1196/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/1124/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/1132/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/31/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/80/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/169/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/946/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/970/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/971/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/1170/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/1203/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf File opened for reading /proc/18/status 78118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d.elf