Analysis
-
max time kernel
149s -
max time network
131s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
27-12-2024 01:32
Behavioral task
behavioral1
Sample
4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
6 signatures
150 seconds
General
-
Target
4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf
-
Size
20KB
-
MD5
83f32c8c232e9a047bb44e64ad73124e
-
SHA1
d68475b31c4c1b9eff42876633446c3629214f5c
-
SHA256
4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23
-
SHA512
ddb6d1fc06b14f5a389afb8bd8bbea7d55ec5ee46531e169f0da15f1481ccc2fc2c99a6539a4756f8bcb750c83d75400e273029b8967fd4576f320f5697cc12f
-
SSDEEP
384:M0DLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTv:x98o08kxofBE+ZkXaITbp2F2TWul0c5L
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for modification /dev/misc/watchdog 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for modification /bin/watchdog 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf -
description ioc Process File opened for reading /proc/424/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1058/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1154/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1158/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1586/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1683/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1288/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1471/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1572/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/406/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/590/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1138/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/631/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/980/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1184/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1633/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/747/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1153/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/412/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/445/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/498/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/582/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/584/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/745/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1174/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1479/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1637/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1049/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1274/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/644/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/780/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1071/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1087/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/499/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/738/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1105/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1129/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1162/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1177/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1269/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1398/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1682/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/632/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/693/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1114/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1156/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1539/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/408/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/766/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1100/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1328/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1406/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/862/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/968/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1074/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1182/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1379/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1429/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1010/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1030/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1684/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/987/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1109/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf File opened for reading /proc/1169/cmdline 4f033b47f5ab517ce7414cfbe15ec995a097e6189fbaf7a271e6d276fadcda23.elf