Analysis
-
max time kernel
135s -
max time network
148s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20240729-en -
resource tags
arch:amd64arch:i386image:ubuntu2404-amd64-20240729-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system -
submitted
26-12-2024 21:06
Behavioral task
behavioral1
Sample
ub8ehJSePAfc9FYqZIT6.x86_64.elf
Resource
ubuntu2404-amd64-20240729-en
ubuntu-24.04-amd64
6 signatures
150 seconds
General
-
Target
ub8ehJSePAfc9FYqZIT6.x86_64.elf
-
Size
36KB
-
MD5
8c12d2392db8546a0f1a870c8d8da4bb
-
SHA1
41857b0229bb9533a6e9949b30b593504ab05404
-
SHA256
c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479
-
SHA512
6c47d0d9c80681443b8fab1490ab9eb7081a5aa3242b26dc7e38789a1e8d8825b32b0e95209de17df338f15a6900e9d39e906005e9dc660f86292944209a3323
-
SSDEEP
768:GLR/W7ThZdFW7v2Sv4BB4lA+YVzzHiyCxVwpGtj94/fL/1RWx0o:GV2zdIT5v4BBH+Ydi76MSj6R
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for modification /dev/misc/watchdog ub8ehJSePAfc9FYqZIT6.x86_64.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for modification /bin/watchdog ub8ehJSePAfc9FYqZIT6.x86_64.elf -
description ioc Process File opened for reading /proc/189/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/197/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/432/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/861/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/44/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/48/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/50/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/80/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/1904/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/1935/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/2249/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/2302/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/2245/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/2480/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/3/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/582/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/1700/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/2136/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/338/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/757/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/785/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/1792/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/23/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/43/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/196/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/200/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/1963/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/1997/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/2127/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/34/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/41/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/42/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/51/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/778/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/1692/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/1938/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/5/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/16/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/49/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/384/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/25/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/35/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/52/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/1075/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/10/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/13/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/14/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/18/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/1122/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/1123/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/1128/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/53/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/191/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/202/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/2145/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/29/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/190/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/1403/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/1946/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/1863/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/15/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/33/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/67/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/1260/status ub8ehJSePAfc9FYqZIT6.x86_64.elf