Analysis
-
max time kernel
149s -
max time network
9s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
26-12-2024 02:28
Behavioral task
behavioral1
Sample
e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
6 signatures
150 seconds
General
-
Target
e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf
-
Size
21KB
-
MD5
985b17fcc00dd03e78f08e636322999d
-
SHA1
33294faaaa3ab5a9a63087fe35576ff40b936190
-
SHA256
e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9
-
SHA512
54cfd0c2db9d82b805c188f0d9df85c6f8c4a8ef39a57d16b26befa762c562ba87cb291a03d399ab232ab8a79193eb8637c9634df7069b2acf58af25137a343a
-
SSDEEP
384:TvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjnvwhymdGUop5h4:TvQn4j+ZO5fKAlx7vws3UozC
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf File opened for modification /dev/misc/watchdog e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf File opened for modification /bin/watchdog e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf -
description ioc Process File opened for reading /proc/self/exe e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf File opened for reading /proc/461/cmdline e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf File opened for reading /proc/602/cmdline e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf File opened for reading /proc/640/cmdline e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf File opened for reading /proc/760/cmdline e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf File opened for reading /proc/773/cmdline e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf File opened for reading /proc/775/cmdline e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf File opened for reading /proc/779/cmdline e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf File opened for reading /proc/411/cmdline e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf File opened for reading /proc/644/cmdline e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf File opened for reading /proc/645/cmdline e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf File opened for reading /proc/658/cmdline e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf File opened for reading /proc/687/cmdline e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf File opened for reading /proc/706/cmdline e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf File opened for reading /proc/783/cmdline e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf File opened for reading /proc/785/cmdline e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf File opened for reading /proc/651/cmdline e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf File opened for reading /proc/686/cmdline e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf File opened for reading /proc/711/cmdline e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf File opened for reading /proc/745/cmdline e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf File opened for reading /proc/764/cmdline e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf File opened for reading /proc/781/cmdline e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf File opened for reading /proc/415/cmdline e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf File opened for reading /proc/646/cmdline e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf File opened for reading /proc/763/cmdline e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf File opened for reading /proc/698/cmdline e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf File opened for reading /proc/748/cmdline e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf File opened for reading /proc/759/cmdline e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf File opened for reading /proc/771/cmdline e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf File opened for reading /proc/777/cmdline e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf File opened for reading /proc/653/cmdline e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf File opened for reading /proc/681/cmdline e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf File opened for reading /proc/715/cmdline e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf File opened for reading /proc/722/cmdline e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf File opened for reading /proc/723/cmdline e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf File opened for reading /proc/460/cmdline e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf File opened for reading /proc/639/cmdline e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf File opened for reading /proc/770/cmdline e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf File opened for reading /proc/663/cmdline e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf File opened for reading /proc/737/cmdline e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf File opened for reading /proc/766/cmdline e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf File opened for reading /proc/768/cmdline e495466c63fe2160fd46a4230768e5df35a61895a432dbaa5cf4c3c1bdc30ab9.elf