Analysis
-
max time kernel
2s -
max time network
8s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
27-12-2024 02:18
Behavioral task
behavioral1
Sample
5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
5 signatures
150 seconds
General
-
Target
5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf
-
Size
75KB
-
MD5
90bd554fab4841989971c525d079acf2
-
SHA1
293f70bf16a9ca84b9a5d267f73014d07f37155b
-
SHA256
5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0
-
SHA512
8bfdfa4df4f48773be7e8c66d24529560536a602ff918fc3c847436b0260d77d378e3a973c96ea5497d7697a866cc175eb2a5036a346eb4bc979fcaa3f23732b
-
SSDEEP
1536:sh7Ny3WFKPlBeGsniiGrXFPO8XsxttzhXMnQk1n8uZY2CG6nH9I:i7pFGBeZahO88XtzhXMxnrYysdI
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for modification /dev/misc/watchdog 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/2/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/10/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/19/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/27/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/17/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/25/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/28/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/98/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/13/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/293/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/665/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/678/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/21/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/676/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/679/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/18/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/20/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/23/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/42/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/14/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/15/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/24/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/6/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/108/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/671/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/672/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/488/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/1/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/7/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/8/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/9/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/12/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/43/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/281/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/145/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/295/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/429/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/489/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/673/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/3/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/106/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/315/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/666/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/11/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/26/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/137/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/167/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/291/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/318/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/326/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/16/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/109/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/629/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/5/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/22/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/77/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/220/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/222/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/280/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/345/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/669/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/self/exe 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/150/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf File opened for reading /proc/660/cmdline 5bfc72fd7e64791623fa6ae178a75bfd00e6fa4480f78c09e851a47a499d7fc0.elf