Analysis
-
max time kernel
149s -
max time network
150s -
platform
debian-9_armhf -
resource
debian9-armhf-20240418-en -
resource tags
arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
26-12-2024 09:18
Behavioral task
behavioral1
Sample
byte.arm7.elf
Resource
debian9-armhf-20240418-en
debian-9-armhf
5 signatures
150 seconds
General
-
Target
byte.arm7.elf
-
Size
75KB
-
MD5
90bd554fab4841989971c525d079acf2
-
SHA1
293f70bf16a9ca84b9a5d267f73014d07f37155b
-
SHA256
5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0
-
SHA512
8bfdfa4df4f48773be7e8c66d24529560536a602ff918fc3c847436b0260d77d378e3a973c96ea5497d7697a866cc175eb2a5036a346eb4bc979fcaa3f23732b
-
SSDEEP
1536:sh7Ny3WFKPlBeGsniiGrXFPO8XsxttzhXMnQk1n8uZY2CG6nH9I:i7pFGBeZahO88XtzhXMxnrYysdI
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog byte.arm7.elf File opened for modification /dev/misc/watchdog byte.arm7.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/13/cmdline byte.arm7.elf File opened for reading /proc/15/cmdline byte.arm7.elf File opened for reading /proc/317/cmdline byte.arm7.elf File opened for reading /proc/593/cmdline byte.arm7.elf File opened for reading /proc/639/cmdline byte.arm7.elf File opened for reading /proc/730/cmdline byte.arm7.elf File opened for reading /proc/588/cmdline byte.arm7.elf File opened for reading /proc/630/cmdline byte.arm7.elf File opened for reading /proc/299/cmdline byte.arm7.elf File opened for reading /proc/592/cmdline byte.arm7.elf File opened for reading /proc/652/cmdline byte.arm7.elf File opened for reading /proc/709/cmdline byte.arm7.elf File opened for reading /proc/43/cmdline byte.arm7.elf File opened for reading /proc/135/cmdline byte.arm7.elf File opened for reading /proc/676/cmdline byte.arm7.elf File opened for reading /proc/681/cmdline byte.arm7.elf File opened for reading /proc/14/cmdline byte.arm7.elf File opened for reading /proc/21/cmdline byte.arm7.elf File opened for reading /proc/280/cmdline byte.arm7.elf File opened for reading /proc/660/cmdline byte.arm7.elf File opened for reading /proc/661/cmdline byte.arm7.elf File opened for reading /proc/11/cmdline byte.arm7.elf File opened for reading /proc/16/cmdline byte.arm7.elf File opened for reading /proc/157/cmdline byte.arm7.elf File opened for reading /proc/165/cmdline byte.arm7.elf File opened for reading /proc/265/cmdline byte.arm7.elf File opened for reading /proc/650/cmdline byte.arm7.elf File opened for reading /proc/651/cmdline byte.arm7.elf File opened for reading /proc/693/cmdline byte.arm7.elf File opened for reading /proc/3/cmdline byte.arm7.elf File opened for reading /proc/9/cmdline byte.arm7.elf File opened for reading /proc/12/cmdline byte.arm7.elf File opened for reading /proc/17/cmdline byte.arm7.elf File opened for reading /proc/27/cmdline byte.arm7.elf File opened for reading /proc/269/cmdline byte.arm7.elf File opened for reading /proc/107/cmdline byte.arm7.elf File opened for reading /proc/6/cmdline byte.arm7.elf File opened for reading /proc/138/cmdline byte.arm7.elf File opened for reading /proc/636/cmdline byte.arm7.elf File opened for reading /proc/662/cmdline byte.arm7.elf File opened for reading /proc/724/cmdline byte.arm7.elf File opened for reading /proc/1/cmdline byte.arm7.elf File opened for reading /proc/647/cmdline byte.arm7.elf File opened for reading /proc/712/cmdline byte.arm7.elf File opened for reading /proc/649/cmdline byte.arm7.elf File opened for reading /proc/8/cmdline byte.arm7.elf File opened for reading /proc/590/cmdline byte.arm7.elf File opened for reading /proc/637/cmdline byte.arm7.elf File opened for reading /proc/645/cmdline byte.arm7.elf File opened for reading /proc/670/cmdline byte.arm7.elf File opened for reading /proc/722/cmdline byte.arm7.elf File opened for reading /proc/677/cmdline byte.arm7.elf File opened for reading /proc/711/cmdline byte.arm7.elf File opened for reading /proc/4/cmdline byte.arm7.elf File opened for reading /proc/108/cmdline byte.arm7.elf File opened for reading /proc/656/cmdline byte.arm7.elf File opened for reading /proc/663/cmdline byte.arm7.elf File opened for reading /proc/680/cmdline byte.arm7.elf File opened for reading /proc/701/cmdline byte.arm7.elf File opened for reading /proc/7/cmdline byte.arm7.elf File opened for reading /proc/23/cmdline byte.arm7.elf File opened for reading /proc/671/cmdline byte.arm7.elf File opened for reading /proc/22/cmdline byte.arm7.elf File opened for reading /proc/635/cmdline byte.arm7.elf