Analysis
-
max time kernel
136s -
max time network
148s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240611-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
27-12-2024 02:03
Behavioral task
behavioral1
Sample
036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf
Resource
debian9-mipsbe-20240611-en
debian-9-mips
6 signatures
150 seconds
General
-
Target
036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf
-
Size
43KB
-
MD5
64fa0599b70a18403044c5ead883bb4a
-
SHA1
a36e9a7e4989cacce45ab21473fc96f450d1585a
-
SHA256
036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90
-
SHA512
5b8738b611cf774d494dec0703e19c5fc54a246eb27e08c6f7a1a1be72aeccd5ee8bdb6916c0676a3bc6625954a91a6f02441ecc2903d7d5a5db072d2f323b85
-
SSDEEP
768:57ph1LjFGpx652lJXasyEk6JGbr6MWiNIx8FwEEosJgGlzDpbuR1JXK:5zA65yk6JGbrbNwQ6okVJug
Score
10/10
Malware Config
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for modification /dev/misc/watchdog 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for modification /bin/watchdog 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf -
description ioc Process File opened for reading /proc/696/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/702/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/9/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/11/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/37/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/71/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/359/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/412/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/703/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/7/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/8/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/70/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/118/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/698/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/14/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/146/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/665/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/673/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/681/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/707/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/15/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/16/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/328/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/330/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/700/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/167/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/669/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/22/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/74/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/695/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/3/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/6/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/36/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/109/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/227/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/10/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/13/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/78/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/82/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/243/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/376/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/21/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/72/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/361/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/704/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/331/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/381/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/701/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/2/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/12/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/24/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/375/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/76/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/77/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/680/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/685/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/18/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/23/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/73/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/119/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/1/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/17/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/150/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf File opened for reading /proc/4/status 036a4c6d7e77446c407820f59b351b834aa4cb0c7d3075aed5830474bc355f90.elf