Analysis
-
max time kernel
135s -
max time network
149s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20240729-en -
resource tags
arch:amd64arch:i386image:ubuntu2004-amd64-20240729-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system -
submitted
27-12-2024 02:45
Behavioral task
behavioral1
Sample
c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf
Resource
ubuntu2004-amd64-20240729-en
ubuntu-20.04-amd64
6 signatures
150 seconds
General
-
Target
c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf
-
Size
36KB
-
MD5
8c12d2392db8546a0f1a870c8d8da4bb
-
SHA1
41857b0229bb9533a6e9949b30b593504ab05404
-
SHA256
c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479
-
SHA512
6c47d0d9c80681443b8fab1490ab9eb7081a5aa3242b26dc7e38789a1e8d8825b32b0e95209de17df338f15a6900e9d39e906005e9dc660f86292944209a3323
-
SSDEEP
768:GLR/W7ThZdFW7v2Sv4BB4lA+YVzzHiyCxVwpGtj94/fL/1RWx0o:GV2zdIT5v4BBH+Ydi76MSj6R
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for modification /dev/misc/watchdog c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for modification /bin/watchdog c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf -
description ioc Process File opened for reading /proc/23/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/71/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/118/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/454/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/1347/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/1349/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/10/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/268/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/981/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/1122/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/1353/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/163/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/162/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/170/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/442/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/803/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/1041/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/1091/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/85/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/173/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/158/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/904/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/1402/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/1408/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/74/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/14/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/1037/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/1082/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/1088/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/1350/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/2/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/16/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/24/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/161/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/898/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/11/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/507/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/584/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/167/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/8/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/82/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/88/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/140/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/164/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/175/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/448/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/3/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/1114/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/1123/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/1152/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/1404/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/669/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/15/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/19/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/455/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/929/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/1130/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/1345/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/9/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/201/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/481/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/583/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/640/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf File opened for reading /proc/694/status c161ac5c4cf291df85f5aa76370cce82b05a99901821ef294052ab788e1e4479.elf