Analysis
-
max time kernel
149s -
max time network
150s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
25-12-2024 10:15
Behavioral task
behavioral1
Sample
byte.x86.elf
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
5 signatures
150 seconds
General
-
Target
byte.x86.elf
-
Size
39KB
-
MD5
2c34b1d26adb50c974d1d390199331b6
-
SHA1
827616062ac11405ebe097d44438aca19b013569
-
SHA256
5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e
-
SHA512
3d4101885f85846e2eab8927c8c8fcf8cd34410e5f7670a0a12f63a6e6c41a054ff22d7f96cdc68889bf1cc52ee541282a3f80a1dd71efc6247c59fde2b10e58
-
SSDEEP
768:oCvR44PLfnqsB4UzbYuC4BNeF0Y6722iEZiLwp1VuSorn3NLJIy:oi3P7n7B4UzyFR6CfEcsVujrD7
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog byte.x86.elf File opened for modification /dev/misc/watchdog byte.x86.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/8/cmdline byte.x86.elf File opened for reading /proc/19/cmdline byte.x86.elf File opened for reading /proc/835/cmdline byte.x86.elf File opened for reading /proc/1696/cmdline byte.x86.elf File opened for reading /proc/1743/cmdline byte.x86.elf File opened for reading /proc/606/cmdline byte.x86.elf File opened for reading /proc/629/cmdline byte.x86.elf File opened for reading /proc/714/cmdline byte.x86.elf File opened for reading /proc/1077/cmdline byte.x86.elf File opened for reading /proc/1636/cmdline byte.x86.elf File opened for reading /proc/1690/cmdline byte.x86.elf File opened for reading /proc/22/cmdline byte.x86.elf File opened for reading /proc/92/cmdline byte.x86.elf File opened for reading /proc/313/cmdline byte.x86.elf File opened for reading /proc/871/cmdline byte.x86.elf File opened for reading /proc/1653/cmdline byte.x86.elf File opened for reading /proc/9/cmdline byte.x86.elf File opened for reading /proc/99/cmdline byte.x86.elf File opened for reading /proc/417/cmdline byte.x86.elf File opened for reading /proc/1638/cmdline byte.x86.elf File opened for reading /proc/25/cmdline byte.x86.elf File opened for reading /proc/585/cmdline byte.x86.elf File opened for reading /proc/1147/cmdline byte.x86.elf File opened for reading /proc/1166/cmdline byte.x86.elf File opened for reading /proc/1663/cmdline byte.x86.elf File opened for reading /proc/262/cmdline byte.x86.elf File opened for reading /proc/609/cmdline byte.x86.elf File opened for reading /proc/1096/cmdline byte.x86.elf File opened for reading /proc/1757/cmdline byte.x86.elf File opened for reading /proc/113/cmdline byte.x86.elf File opened for reading /proc/78/cmdline byte.x86.elf File opened for reading /proc/97/cmdline byte.x86.elf File opened for reading /proc/1016/cmdline byte.x86.elf File opened for reading /proc/1595/cmdline byte.x86.elf File opened for reading /proc/1662/cmdline byte.x86.elf File opened for reading /proc/94/cmdline byte.x86.elf File opened for reading /proc/729/cmdline byte.x86.elf File opened for reading /proc/846/cmdline byte.x86.elf File opened for reading /proc/1144/cmdline byte.x86.elf File opened for reading /proc/1438/cmdline byte.x86.elf File opened for reading /proc/1642/cmdline byte.x86.elf File opened for reading /proc/1687/cmdline byte.x86.elf File opened for reading /proc/12/cmdline byte.x86.elf File opened for reading /proc/209/cmdline byte.x86.elf File opened for reading /proc/1036/cmdline byte.x86.elf File opened for reading /proc/1597/cmdline byte.x86.elf File opened for reading /proc/1684/cmdline byte.x86.elf File opened for reading /proc/17/cmdline byte.x86.elf File opened for reading /proc/75/cmdline byte.x86.elf File opened for reading /proc/628/cmdline byte.x86.elf File opened for reading /proc/408/cmdline byte.x86.elf File opened for reading /proc/458/cmdline byte.x86.elf File opened for reading /proc/1585/cmdline byte.x86.elf File opened for reading /proc/1682/cmdline byte.x86.elf File opened for reading /proc/414/cmdline byte.x86.elf File opened for reading /proc/1159/cmdline byte.x86.elf File opened for reading /proc/1289/cmdline byte.x86.elf File opened for reading /proc/1562/cmdline byte.x86.elf File opened for reading /proc/1598/cmdline byte.x86.elf File opened for reading /proc/734/cmdline byte.x86.elf File opened for reading /proc/1583/cmdline byte.x86.elf File opened for reading /proc/1621/cmdline byte.x86.elf File opened for reading /proc/656/cmdline byte.x86.elf File opened for reading /proc/1197/cmdline byte.x86.elf