Analysis
-
max time kernel
0s -
max time network
54s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240522.1-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240522.1-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
23-12-2024 02:14
Behavioral task
behavioral1
Sample
883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf
Resource
ubuntu2204-amd64-20240522.1-en
ubuntu-22.04-amd64
5 signatures
150 seconds
General
-
Target
883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf
-
Size
36KB
-
MD5
7f450c92cd48f89e76cc42545287a95c
-
SHA1
417afaa1961773ef81080998fbeeb04e112e8f30
-
SHA256
883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0
-
SHA512
f3e0c0e883fdec93644309bb4fb214c6b92adab7ca62ed34e4c2416157f5e336f88bf3093de474d0dca1784854078aa2561ffd7d61ca6244403afcdc82e24591
-
SSDEEP
768:7SIF9NtuCtdnD4cqrgVJbKGbVDTETaOZHHYkRGnbcuyD7UFe:+hCn1qrgzbNmHrGnouy8U
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for modification /dev/misc/watchdog 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/17/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/91/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/858/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/1050/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/1078/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/13/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/207/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/213/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/228/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/409/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/616/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/1066/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/456/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/646/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/737/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/827/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/991/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/3/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/93/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/95/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/205/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/26/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/664/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/956/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/1055/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/211/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/219/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/425/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/1/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/5/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/10/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/11/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/81/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/98/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/416/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/640/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/1545/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/9/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/15/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/758/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/1193/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/1260/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/1432/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/1543/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/79/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/531/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/828/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/1141/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/1534/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/77/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/102/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/721/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/741/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/1125/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/6/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/428/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/608/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/768/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/871/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/21/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/27/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/78/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/215/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/407/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf