Analysis
-
max time kernel
150s -
max time network
11s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240611-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
18-12-2024 18:35
Behavioral task
behavioral1
Sample
boatnet.mips.elf
Resource
debian9-mipsbe-20240611-en
debian-9-mips
7 signatures
150 seconds
General
-
Target
boatnet.mips.elf
-
Size
27KB
-
MD5
44aa227810db033c3e3f5bb509827490
-
SHA1
51f6c92605850f2eab60e906a67c1d0babb8ff66
-
SHA256
3daf3b22b433d1a39344d69c7929b425cc49f17808ce2097e674368fd17b62ef
-
SHA512
6dbcf29d10003610ba4061f1111a7f9831d4a7984dbe4d6740399433413cca56a3c56728a790ef5130ff3fbae609e4d45578e54cfc009e54b244687d33fb8d51
-
SSDEEP
768:x3KNQmJdODGwUNCttUTLeUzQYIBgSAgPJgGlzDpbuR1J4:x3uZJd2G1CrcCUzkAgNVJuy
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog boatnet.mips.elf File opened for modification /dev/misc/watchdog boatnet.mips.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog boatnet.mips.elf File opened for modification /bin/watchdog boatnet.mips.elf -
description ioc Process File opened for reading /proc/676/cmdline boatnet.mips.elf File opened for reading /proc/487/cmdline boatnet.mips.elf File opened for reading /proc/739/cmdline boatnet.mips.elf File opened for reading /proc/751/cmdline boatnet.mips.elf File opened for reading /proc/806/cmdline boatnet.mips.elf File opened for reading /proc/486/cmdline boatnet.mips.elf File opened for reading /proc/689/cmdline boatnet.mips.elf File opened for reading /proc/690/cmdline boatnet.mips.elf File opened for reading /proc/733/cmdline boatnet.mips.elf File opened for reading /proc/450/cmdline boatnet.mips.elf File opened for reading /proc/762/cmdline boatnet.mips.elf File opened for reading /proc/773/cmdline boatnet.mips.elf File opened for reading /proc/803/cmdline boatnet.mips.elf File opened for reading /proc/694/cmdline boatnet.mips.elf File opened for reading /proc/695/cmdline boatnet.mips.elf File opened for reading /proc/702/cmdline boatnet.mips.elf File opened for reading /proc/758/cmdline boatnet.mips.elf File opened for reading /proc/696/cmdline boatnet.mips.elf File opened for reading /proc/729/cmdline boatnet.mips.elf File opened for reading /proc/797/cmdline boatnet.mips.elf File opened for reading /proc/457/cmdline boatnet.mips.elf File opened for reading /proc/700/cmdline boatnet.mips.elf File opened for reading /proc/725/cmdline boatnet.mips.elf File opened for reading /proc/785/cmdline boatnet.mips.elf File opened for reading /proc/791/cmdline boatnet.mips.elf File opened for reading /proc/707/cmdline boatnet.mips.elf File opened for reading /proc/757/cmdline boatnet.mips.elf File opened for reading /proc/770/cmdline boatnet.mips.elf File opened for reading /proc/779/cmdline boatnet.mips.elf -
System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 697 boatnet.mips.elf