Analysis
-
max time kernel
0s -
max time network
54s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240522.1-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240522.1-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
26-12-2024 02:11
Behavioral task
behavioral1
Sample
5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf
Resource
ubuntu2204-amd64-20240522.1-en
ubuntu-22.04-amd64
5 signatures
150 seconds
General
-
Target
5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf
-
Size
39KB
-
MD5
2c34b1d26adb50c974d1d390199331b6
-
SHA1
827616062ac11405ebe097d44438aca19b013569
-
SHA256
5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e
-
SHA512
3d4101885f85846e2eab8927c8c8fcf8cd34410e5f7670a0a12f63a6e6c41a054ff22d7f96cdc68889bf1cc52ee541282a3f80a1dd71efc6247c59fde2b10e58
-
SSDEEP
768:oCvR44PLfnqsB4UzbYuC4BNeF0Y6722iEZiLwp1VuSorn3NLJIy:oi3P7n7B4UzyFR6CfEcsVujrD7
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for modification /dev/misc/watchdog 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/160/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/609/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/713/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/214/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/377/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/412/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/27/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/81/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/82/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/98/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/527/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/1167/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/1257/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/3/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/21/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/77/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/114/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/1032/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/1052/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/1237/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/1564/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/408/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/754/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/962/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/1567/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/10/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/15/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/22/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/97/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/95/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/200/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/851/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/768/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/self/exe 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/196/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/587/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/697/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/216/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/225/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/1160/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/17/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/75/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/110/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/159/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/1178/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/1272/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/12/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/90/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/1097/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/1106/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/775/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/1175/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/1098/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/1158/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/73/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/119/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/867/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/1092/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/195/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/505/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/531/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/592/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/8/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf File opened for reading /proc/14/cmdline 5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e.elf