Analysis
-
max time kernel
149s -
max time network
160s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
26-12-2024 09:12
Behavioral task
behavioral1
Sample
byte.arm7.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
5 signatures
150 seconds
General
-
Target
byte.arm7.elf
-
Size
75KB
-
MD5
90bd554fab4841989971c525d079acf2
-
SHA1
293f70bf16a9ca84b9a5d267f73014d07f37155b
-
SHA256
5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0
-
SHA512
8bfdfa4df4f48773be7e8c66d24529560536a602ff918fc3c847436b0260d77d378e3a973c96ea5497d7697a866cc175eb2a5036a346eb4bc979fcaa3f23732b
-
SSDEEP
1536:sh7Ny3WFKPlBeGsniiGrXFPO8XsxttzhXMnQk1n8uZY2CG6nH9I:i7pFGBeZahO88XtzhXMxnrYysdI
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog byte.arm7.elf File opened for modification /dev/misc/watchdog byte.arm7.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/284/cmdline byte.arm7.elf File opened for reading /proc/139/cmdline byte.arm7.elf File opened for reading /proc/167/cmdline byte.arm7.elf File opened for reading /proc/2/cmdline byte.arm7.elf File opened for reading /proc/725/cmdline byte.arm7.elf File opened for reading /proc/18/cmdline byte.arm7.elf File opened for reading /proc/25/cmdline byte.arm7.elf File opened for reading /proc/110/cmdline byte.arm7.elf File opened for reading /proc/140/cmdline byte.arm7.elf File opened for reading /proc/656/cmdline byte.arm7.elf File opened for reading /proc/22/cmdline byte.arm7.elf File opened for reading /proc/689/cmdline byte.arm7.elf File opened for reading /proc/264/cmdline byte.arm7.elf File opened for reading /proc/648/cmdline byte.arm7.elf File opened for reading /proc/676/cmdline byte.arm7.elf File opened for reading /proc/5/cmdline byte.arm7.elf File opened for reading /proc/29/cmdline byte.arm7.elf File opened for reading /proc/660/cmdline byte.arm7.elf File opened for reading /proc/733/cmdline byte.arm7.elf File opened for reading /proc/4/cmdline byte.arm7.elf File opened for reading /proc/16/cmdline byte.arm7.elf File opened for reading /proc/598/cmdline byte.arm7.elf File opened for reading /proc/748/cmdline byte.arm7.elf File opened for reading /proc/11/cmdline byte.arm7.elf File opened for reading /proc/653/cmdline byte.arm7.elf File opened for reading /proc/726/cmdline byte.arm7.elf File opened for reading /proc/1/cmdline byte.arm7.elf File opened for reading /proc/186/cmdline byte.arm7.elf File opened for reading /proc/297/cmdline byte.arm7.elf File opened for reading /proc/650/cmdline byte.arm7.elf File opened for reading /proc/659/cmdline byte.arm7.elf File opened for reading /proc/41/cmdline byte.arm7.elf File opened for reading /proc/268/cmdline byte.arm7.elf File opened for reading /proc/703/cmdline byte.arm7.elf File opened for reading /proc/741/cmdline byte.arm7.elf File opened for reading /proc/19/cmdline byte.arm7.elf File opened for reading /proc/732/cmdline byte.arm7.elf File opened for reading /proc/662/cmdline byte.arm7.elf File opened for reading /proc/674/cmdline byte.arm7.elf File opened for reading /proc/691/cmdline byte.arm7.elf File opened for reading /proc/705/cmdline byte.arm7.elf File opened for reading /proc/269/cmdline byte.arm7.elf File opened for reading /proc/708/cmdline byte.arm7.elf File opened for reading /proc/322/cmdline byte.arm7.elf File opened for reading /proc/680/cmdline byte.arm7.elf File opened for reading /proc/681/cmdline byte.arm7.elf File opened for reading /proc/301/cmdline byte.arm7.elf File opened for reading /proc/15/cmdline byte.arm7.elf File opened for reading /proc/23/cmdline byte.arm7.elf File opened for reading /proc/24/cmdline byte.arm7.elf File opened for reading /proc/43/cmdline byte.arm7.elf File opened for reading /proc/141/cmdline byte.arm7.elf File opened for reading /proc/601/cmdline byte.arm7.elf File opened for reading /proc/661/cmdline byte.arm7.elf File opened for reading /proc/13/cmdline byte.arm7.elf File opened for reading /proc/594/cmdline byte.arm7.elf File opened for reading /proc/152/cmdline byte.arm7.elf File opened for reading /proc/17/cmdline byte.arm7.elf File opened for reading /proc/20/cmdline byte.arm7.elf File opened for reading /proc/42/cmdline byte.arm7.elf File opened for reading /proc/98/cmdline byte.arm7.elf File opened for reading /proc/213/cmdline byte.arm7.elf File opened for reading /proc/646/cmdline byte.arm7.elf File opened for reading /proc/7/cmdline byte.arm7.elf