Analysis
-
max time kernel
0s -
max time network
4s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20240729-en -
resource tags
arch:amd64arch:i386image:ubuntu2004-amd64-20240729-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system -
submitted
24-12-2024 01:26
Behavioral task
behavioral1
Sample
883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf
Resource
ubuntu2004-amd64-20240729-en
ubuntu-20.04-amd64
5 signatures
150 seconds
Errors
Reason
Reading agent response: unexpected EOF
General
-
Target
883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf
-
Size
36KB
-
MD5
7f450c92cd48f89e76cc42545287a95c
-
SHA1
417afaa1961773ef81080998fbeeb04e112e8f30
-
SHA256
883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0
-
SHA512
f3e0c0e883fdec93644309bb4fb214c6b92adab7ca62ed34e4c2416157f5e336f88bf3093de474d0dca1784854078aa2561ffd7d61ca6244403afcdc82e24591
-
SSDEEP
768:7SIF9NtuCtdnD4cqrgVJbKGbVDTETaOZHHYkRGnbcuyD7UFe:+hCn1qrgzbNmHrGnouy8U
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for modification /dev/misc/watchdog 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/159/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/167/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/172/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/self/exe 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/6/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/7/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/10/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/72/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/177/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/242/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/479/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/500/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/534/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/169/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/170/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/440/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/13/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/85/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/89/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/161/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/164/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/539/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/303/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/439/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/476/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/74/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/79/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/81/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/93/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/162/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/495/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/568/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/12/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/14/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/20/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/165/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/503/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/16/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/515/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/22/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/166/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/171/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/444/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/453/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/73/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/78/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/105/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/163/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/394/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/2/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/19/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/76/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/168/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/201/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/505/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/5/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/24/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/71/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/90/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/158/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/522/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/75/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/87/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf File opened for reading /proc/102/cmdline 883e0e27500a5dd5d22ebe043110896ec2223dfb1ce2dd152fe2da1a7f85aca0.elf