Analysis
-
max time kernel
149s -
max time network
128s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
26-12-2024 02:09
Behavioral task
behavioral1
Sample
4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
6 signatures
150 seconds
General
-
Target
4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf
-
Size
20KB
-
MD5
83f32c8c232e9a047bb44e64ad73124e
-
SHA1
d68475b31c4c1b9eff42876633446c3629214f5c
-
SHA256
4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23
-
SHA512
ddb6d1fc06b14f5a389afb8bd8bbea7d55ec5ee46531e169f0da15f1481ccc2fc2c99a6539a4756f8bcb750c83d75400e273029b8967fd4576f320f5697cc12f
-
SSDEEP
384:M0DLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTv:x98o08kxofBE+ZkXaITbp2F2TWul0c5L
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for modification /dev/misc/watchdog 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for modification /bin/watchdog 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf -
description ioc Process File opened for reading /proc/632/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/636/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/796/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1170/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1210/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1234/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/426/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/613/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1080/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1061/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1275/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1525/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/948/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1315/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/506/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/588/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1171/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1186/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/634/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/674/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/732/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/979/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1107/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/780/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/794/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/986/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1435/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/587/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/635/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/680/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/728/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/768/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1091/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1277/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1382/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1303/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1358/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1359/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/843/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1143/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/741/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1139/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1231/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1417/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/414/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1074/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/409/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/530/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/839/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1082/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1032/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1187/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1198/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/415/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/967/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1159/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/411/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/451/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/658/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1337/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1507/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1312/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1052/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1175/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf