Analysis
-
max time kernel
149s -
max time network
150s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240522.1-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240522.1-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
22-12-2024 11:56
Behavioral task
behavioral1
Sample
byte.x86.elf
Resource
ubuntu2204-amd64-20240522.1-en
ubuntu-22.04-amd64
5 signatures
150 seconds
General
-
Target
byte.x86.elf
-
Size
36KB
-
MD5
7f450c92cd48f89e76cc42545287a95c
-
SHA1
417afaa1961773ef81080998fbeeb04e112e8f30
-
SHA256
883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0
-
SHA512
f3e0c0e883fdec93644309bb4fb214c6b92adab7ca62ed34e4c2416157f5e336f88bf3093de474d0dca1784854078aa2561ffd7d61ca6244403afcdc82e24591
-
SSDEEP
768:7SIF9NtuCtdnD4cqrgVJbKGbVDTETaOZHHYkRGnbcuyD7UFe:+hCn1qrgzbNmHrGnouy8U
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog byte.x86.elf File opened for modification /dev/watchdog byte.x86.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/77/cmdline byte.x86.elf File opened for reading /proc/96/cmdline byte.x86.elf File opened for reading /proc/1636/cmdline byte.x86.elf File opened for reading /proc/1723/cmdline byte.x86.elf File opened for reading /proc/85/cmdline byte.x86.elf File opened for reading /proc/114/cmdline byte.x86.elf File opened for reading /proc/659/cmdline byte.x86.elf File opened for reading /proc/1653/cmdline byte.x86.elf File opened for reading /proc/1794/cmdline byte.x86.elf File opened for reading /proc/98/cmdline byte.x86.elf File opened for reading /proc/709/cmdline byte.x86.elf File opened for reading /proc/755/cmdline byte.x86.elf File opened for reading /proc/1076/cmdline byte.x86.elf File opened for reading /proc/1146/cmdline byte.x86.elf File opened for reading /proc/15/cmdline byte.x86.elf File opened for reading /proc/22/cmdline byte.x86.elf File opened for reading /proc/110/cmdline byte.x86.elf File opened for reading /proc/1575/cmdline byte.x86.elf File opened for reading /proc/1623/cmdline byte.x86.elf File opened for reading /proc/1078/cmdline byte.x86.elf File opened for reading /proc/1123/cmdline byte.x86.elf File opened for reading /proc/1604/cmdline byte.x86.elf File opened for reading /proc/1637/cmdline byte.x86.elf File opened for reading /proc/1708/cmdline byte.x86.elf File opened for reading /proc/1/cmdline byte.x86.elf File opened for reading /proc/4/cmdline byte.x86.elf File opened for reading /proc/376/cmdline byte.x86.elf File opened for reading /proc/629/cmdline byte.x86.elf File opened for reading /proc/1585/cmdline byte.x86.elf File opened for reading /proc/1806/cmdline byte.x86.elf File opened for reading /proc/3/cmdline byte.x86.elf File opened for reading /proc/414/cmdline byte.x86.elf File opened for reading /proc/634/cmdline byte.x86.elf File opened for reading /proc/1605/cmdline byte.x86.elf File opened for reading /proc/1618/cmdline byte.x86.elf File opened for reading /proc/21/cmdline byte.x86.elf File opened for reading /proc/83/cmdline byte.x86.elf File opened for reading /proc/225/cmdline byte.x86.elf File opened for reading /proc/1630/cmdline byte.x86.elf File opened for reading /proc/1645/cmdline byte.x86.elf File opened for reading /proc/739/cmdline byte.x86.elf File opened for reading /proc/1062/cmdline byte.x86.elf File opened for reading /proc/1710/cmdline byte.x86.elf File opened for reading /proc/221/cmdline byte.x86.elf File opened for reading /proc/226/cmdline byte.x86.elf File opened for reading /proc/1592/cmdline byte.x86.elf File opened for reading /proc/1595/cmdline byte.x86.elf File opened for reading /proc/1192/cmdline byte.x86.elf File opened for reading /proc/1596/cmdline byte.x86.elf File opened for reading /proc/14/cmdline byte.x86.elf File opened for reading /proc/99/cmdline byte.x86.elf File opened for reading /proc/451/cmdline byte.x86.elf File opened for reading /proc/588/cmdline byte.x86.elf File opened for reading /proc/763/cmdline byte.x86.elf File opened for reading /proc/12/cmdline byte.x86.elf File opened for reading /proc/1576/cmdline byte.x86.elf File opened for reading /proc/1644/cmdline byte.x86.elf File opened for reading /proc/208/cmdline byte.x86.elf File opened for reading /proc/219/cmdline byte.x86.elf File opened for reading /proc/1685/cmdline byte.x86.elf File opened for reading /proc/1760/cmdline byte.x86.elf File opened for reading /proc/16/cmdline byte.x86.elf File opened for reading /proc/1120/cmdline byte.x86.elf File opened for reading /proc/1163/cmdline byte.x86.elf