Analysis
-
max time kernel
150s -
max time network
12s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240611-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
18-12-2024 14:40
Behavioral task
behavioral1
Sample
boatnet.mips.elf
Resource
debian9-mipsbe-20240611-en
General
-
Target
boatnet.mips.elf
-
Size
23KB
-
MD5
3bdca38ef6a4b0c3aba6c2aeb9adf306
-
SHA1
6644331553bc4b14d5409e43ca833a246a48f942
-
SHA256
072a76e22e93f371f6110b43b1f270a4f5c2e9dbdc919315ffcd81c5979b202c
-
SHA512
1afafe5654a371e5d472437b26b5a496444f4a057e913e146d01c6c81e4b8c7806cd3bf6ffe51dfffd760a7ec73f8449675d01322ef9a917f233f1a3bfc60863
-
SSDEEP
384:YeD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtui20mdtJgGlzDpH7uNj1JA3:YeD8ZSWvZHZbs1row697qohQvg9/itJl
Malware Config
Extracted
mirai
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog boatnet.mips.elf File opened for modification /dev/watchdog boatnet.mips.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog boatnet.mips.elf File opened for modification /bin/watchdog boatnet.mips.elf -
description ioc Process File opened for reading /proc/682/cmdline boatnet.mips.elf File opened for reading /proc/696/cmdline boatnet.mips.elf File opened for reading /proc/769/cmdline boatnet.mips.elf File opened for reading /proc/797/cmdline boatnet.mips.elf File opened for reading /proc/708/cmdline boatnet.mips.elf File opened for reading /proc/766/cmdline boatnet.mips.elf File opened for reading /proc/814/cmdline boatnet.mips.elf File opened for reading /proc/733/cmdline boatnet.mips.elf File opened for reading /proc/770/cmdline boatnet.mips.elf File opened for reading /proc/778/cmdline boatnet.mips.elf File opened for reading /proc/787/cmdline boatnet.mips.elf File opened for reading /proc/791/cmdline boatnet.mips.elf File opened for reading /proc/465/cmdline boatnet.mips.elf File opened for reading /proc/493/cmdline boatnet.mips.elf File opened for reading /proc/697/cmdline boatnet.mips.elf File opened for reading /proc/703/cmdline boatnet.mips.elf File opened for reading /proc/715/cmdline boatnet.mips.elf File opened for reading /proc/809/cmdline boatnet.mips.elf File opened for reading /proc/457/cmdline boatnet.mips.elf File opened for reading /proc/753/cmdline boatnet.mips.elf File opened for reading /proc/502/cmdline boatnet.mips.elf File opened for reading /proc/741/cmdline boatnet.mips.elf File opened for reading /proc/763/cmdline boatnet.mips.elf File opened for reading /proc/701/cmdline boatnet.mips.elf File opened for reading /proc/702/cmdline boatnet.mips.elf File opened for reading /proc/747/cmdline boatnet.mips.elf File opened for reading /proc/777/cmdline boatnet.mips.elf File opened for reading /proc/709/cmdline boatnet.mips.elf File opened for reading /proc/803/cmdline boatnet.mips.elf -
System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 704 boatnet.mips.elf