Analysis
-
max time kernel
145s -
max time network
147s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20240508-en -
resource tags
arch:amd64arch:i386image:ubuntu2004-amd64-20240508-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system -
submitted
27-12-2024 02:27
Behavioral task
behavioral1
Sample
8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf
Resource
ubuntu2004-amd64-20240508-en
ubuntu-20.04-amd64
6 signatures
150 seconds
General
-
Target
8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf
-
Size
37KB
-
MD5
cab2fc62b63f28cd95c3fdca9ecec6d0
-
SHA1
df33b92944b8436e7310b0a03ca9038b70c65a56
-
SHA256
8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871
-
SHA512
dd2bdb170092fc31e19e072f4b637ccff00a26ca59ddb4e02f01ff189d382c8f0b267eafd3b508ee9fffb076ac8204e2453a6769f7bb2a25b40fd043dd7d2224
-
SSDEEP
768:dxaYe0syQ8V3uZJYDR+AGJyQlYuOwqakXzEp3Lj7z20z49nbcuyD7UrQRj5:CYgBe3uZgR+zZiw807j7S0wnouy8ry9
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for modification /dev/misc/watchdog 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for modification /bin/watchdog 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf -
description ioc Process File opened for reading /proc/1079/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/1107/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/16/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/79/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/499/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/519/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/1111/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/1349/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/12/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/118/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/691/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/1073/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/1075/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/1381/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/265/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/483/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/585/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/776/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/2/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/394/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/1347/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/1020/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/1221/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/105/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/302/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/891/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/993/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/89/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/172/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/615/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/951/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/167/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/175/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/270/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/480/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/8/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/82/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/90/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/163/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/800/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/1025/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/1061/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/1351/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/798/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/855/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/967/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/1003/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/22/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/455/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/488/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/581/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/1350/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/1412/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/454/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/577/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/1097/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/1370/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/4/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/72/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/173/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/453/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/500/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/978/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf File opened for reading /proc/1105/status 8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871.elf