Analysis
-
max time kernel
149s -
max time network
151s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20240508-en -
resource tags
arch:amd64arch:i386image:ubuntu2004-amd64-20240508-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system -
submitted
25-12-2024 10:11
Behavioral task
behavioral1
Sample
byte.x86.elf
Resource
ubuntu2004-amd64-20240508-en
ubuntu-20.04-amd64
5 signatures
150 seconds
General
-
Target
byte.x86.elf
-
Size
39KB
-
MD5
2c34b1d26adb50c974d1d390199331b6
-
SHA1
827616062ac11405ebe097d44438aca19b013569
-
SHA256
5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e
-
SHA512
3d4101885f85846e2eab8927c8c8fcf8cd34410e5f7670a0a12f63a6e6c41a054ff22d7f96cdc68889bf1cc52ee541282a3f80a1dd71efc6247c59fde2b10e58
-
SSDEEP
768:oCvR44PLfnqsB4UzbYuC4BNeF0Y6722iEZiLwp1VuSorn3NLJIy:oi3P7n7B4UzyFR6CfEcsVujrD7
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog byte.x86.elf File opened for modification /dev/misc/watchdog byte.x86.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/1181/cmdline byte.x86.elf File opened for reading /proc/1340/cmdline byte.x86.elf File opened for reading /proc/1483/cmdline byte.x86.elf File opened for reading /proc/1502/cmdline byte.x86.elf File opened for reading /proc/1562/cmdline byte.x86.elf File opened for reading /proc/1607/cmdline byte.x86.elf File opened for reading /proc/77/cmdline byte.x86.elf File opened for reading /proc/1343/cmdline byte.x86.elf File opened for reading /proc/1407/cmdline byte.x86.elf File opened for reading /proc/172/cmdline byte.x86.elf File opened for reading /proc/1045/cmdline byte.x86.elf File opened for reading /proc/1336/cmdline byte.x86.elf File opened for reading /proc/1345/cmdline byte.x86.elf File opened for reading /proc/1419/cmdline byte.x86.elf File opened for reading /proc/1444/cmdline byte.x86.elf File opened for reading /proc/1471/cmdline byte.x86.elf File opened for reading /proc/9/cmdline byte.x86.elf File opened for reading /proc/73/cmdline byte.x86.elf File opened for reading /proc/481/cmdline byte.x86.elf File opened for reading /proc/893/cmdline byte.x86.elf File opened for reading /proc/164/cmdline byte.x86.elf File opened for reading /proc/586/cmdline byte.x86.elf File opened for reading /proc/1405/cmdline byte.x86.elf File opened for reading /proc/1464/cmdline byte.x86.elf File opened for reading /proc/1556/cmdline byte.x86.elf File opened for reading /proc/1614/cmdline byte.x86.elf File opened for reading /proc/270/cmdline byte.x86.elf File opened for reading /proc/538/cmdline byte.x86.elf File opened for reading /proc/140/cmdline byte.x86.elf File opened for reading /proc/1089/cmdline byte.x86.elf File opened for reading /proc/1208/cmdline byte.x86.elf File opened for reading /proc/1459/cmdline byte.x86.elf File opened for reading /proc/1472/cmdline byte.x86.elf File opened for reading /proc/1488/cmdline byte.x86.elf File opened for reading /proc/1463/cmdline byte.x86.elf File opened for reading /proc/18/cmdline byte.x86.elf File opened for reading /proc/455/cmdline byte.x86.elf File opened for reading /proc/894/cmdline byte.x86.elf File opened for reading /proc/1023/cmdline byte.x86.elf File opened for reading /proc/1344/cmdline byte.x86.elf File opened for reading /proc/1408/cmdline byte.x86.elf File opened for reading /proc/1426/cmdline byte.x86.elf File opened for reading /proc/10/cmdline byte.x86.elf File opened for reading /proc/88/cmdline byte.x86.elf File opened for reading /proc/497/cmdline byte.x86.elf File opened for reading /proc/534/cmdline byte.x86.elf File opened for reading /proc/1534/cmdline byte.x86.elf File opened for reading /proc/118/cmdline byte.x86.elf File opened for reading /proc/1541/cmdline byte.x86.elf File opened for reading /proc/1477/cmdline byte.x86.elf File opened for reading /proc/84/cmdline byte.x86.elf File opened for reading /proc/169/cmdline byte.x86.elf File opened for reading /proc/174/cmdline byte.x86.elf File opened for reading /proc/617/cmdline byte.x86.elf File opened for reading /proc/761/cmdline byte.x86.elf File opened for reading /proc/972/cmdline byte.x86.elf File opened for reading /proc/1374/cmdline byte.x86.elf File opened for reading /proc/102/cmdline byte.x86.elf File opened for reading /proc/168/cmdline byte.x86.elf File opened for reading /proc/243/cmdline byte.x86.elf File opened for reading /proc/1033/cmdline byte.x86.elf File opened for reading /proc/1037/cmdline byte.x86.elf File opened for reading /proc/1402/cmdline byte.x86.elf File opened for reading /proc/79/cmdline byte.x86.elf