Analysis
-
max time kernel
149s -
max time network
128s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20240523-en -
resource tags
arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system -
submitted
21-12-2024 03:00
Behavioral task
behavioral1
Sample
b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
6 signatures
150 seconds
General
-
Target
b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf
-
Size
22KB
-
MD5
957ea75ddf1944fd680e923628a7a5d3
-
SHA1
4852bf8573d343edbcaabdd7a62b1768e8cea4cb
-
SHA256
b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba
-
SHA512
de98e358bc5cce88425078f57564e9d1db26916c3ef4b35cdb1f3fc1e0340d689ebc2cc0797cf20c4d7cbb86d99afba5d2f6599c7143423190e322b408b43e25
-
SSDEEP
384:pFYfwf/izXcR3fivuQUhJX9tDttg9D4cbJYjg5zl35j3kpt1hTzKk+xzN2lM5B7C:HikKzXctauJX9tyBmCR3V3kL+ZxzNSM2
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for modification /dev/misc/watchdog b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for modification /bin/watchdog b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf -
description ioc Process File opened for reading /proc/2260/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/2405/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/1070/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/2125/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/2243/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/2473/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/2769/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/779/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/1095/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/2515/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/747/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/792/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/2057/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/2494/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/2289/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/2291/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/2325/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/2428/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/419/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/2186/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/586/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/2072/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/2204/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/2256/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/2586/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/510/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/1101/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/1125/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/2084/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/2410/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/2762/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/1341/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/1403/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/830/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/2251/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/2560/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/438/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/2475/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/2539/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/1990/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/2199/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/2214/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/2252/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/509/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/837/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/1067/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/1900/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/2064/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/2247/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/432/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/727/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/1082/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/1255/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/795/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/1400/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/2094/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/2172/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/2525/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/1130/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/2092/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/2779/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/582/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/1123/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf File opened for reading /proc/2246/cmdline b699d1673c8dc2346ef917bce6367081777700322c740c736cc10b3c8a28cdba.elf