Analysis
-
max time kernel
2s -
max time network
7s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
27-12-2024 02:52
Behavioral task
behavioral1
Sample
cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
5 signatures
150 seconds
General
-
Target
cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf
-
Size
44KB
-
MD5
f165746e8de7cdc0fa16481d510a2be6
-
SHA1
488fdf89f700da37888baa4a38442a7817bb82f2
-
SHA256
cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f
-
SHA512
e59db812eaf71e932a2ab70d15b1cfa5cfdac72eb419d4a33c78b2b88fa8b4ddd6e8e899091b50940196d8e6da3017ce274f019ec428c5dcea6f0473bcf56e75
-
SSDEEP
768:yOZuPmRa6EAaO6BWeWEM5Sa2Nz8713kn4nWInItcfZ73QboQ1bjwKQMPe6EB6MLU:DZuPAa6PaO6ulsHJ85UnT+Iy7AJhlQXO
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for modification /dev/misc/watchdog cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/305/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/649/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/660/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/141/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/14/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/7/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/23/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/313/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/658/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/15/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/12/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/18/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/21/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/25/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/26/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/27/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/28/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/4/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/97/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/106/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/43/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/147/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/655/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/661/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/109/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/463/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/8/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/10/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/42/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/274/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/304/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/413/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/618/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/self/exe cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/9/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/29/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/3/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/11/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/279/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/662/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/5/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/24/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/218/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/656/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/664/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/667/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/16/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/137/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/276/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/6/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/2/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/17/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/75/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/165/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/275/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/1/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/426/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/22/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/138/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/280/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/339/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/108/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/19/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf File opened for reading /proc/20/cmdline cd328409653b8bd3123a29504c1195dd3b557c02e944fb7266b5ec063c9f820f.elf