Analysis
-
max time kernel
149s -
max time network
129s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
31-12-2024 02:35
Behavioral task
behavioral1
Sample
75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
6 signatures
150 seconds
General
-
Target
75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf
-
Size
28KB
-
MD5
d2610e796559edd586be4f3cfea659da
-
SHA1
67ac4e25ed9856b839f2b11c32e758766a140e23
-
SHA256
75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6
-
SHA512
910228016a57f6c76fcf29e7bd0a4d79a6772cda30489b99d9a10b92a00f56fc6829b35460ee09bc99c9fa7dc9607763dd01f39c0730c9975988c595c58bdf7a
-
SSDEEP
768:0IUEbJVnDejywrBh61e+bRTCfol+52qCu:qqyhrB0e+bsfoW
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for modification /dev/misc/watchdog 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for modification /bin/watchdog 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf -
description ioc Process File opened for reading /proc/1188/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/1192/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/1539/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/737/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/1327/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/1042/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/1193/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/1545/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/1070/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/501/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/565/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/693/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/1507/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/1103/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/1153/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/1236/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/473/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/555/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/1078/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/1195/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/1508/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/1599/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/486/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/963/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/1274/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/1122/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/1355/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/1551/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/1504/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/533/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/534/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/956/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/972/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/1066/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/1090/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/1143/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/1194/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/589/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/605/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/910/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/1337/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/1581/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/1258/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/1260/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/1295/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/1118/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/1480/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/1513/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/653/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/1094/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/500/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/1022/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/1139/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/1148/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/1519/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/482/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/546/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/1157/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/968/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/418/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/493/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/640/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/1131/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf File opened for reading /proc/1180/cmdline 75754fcc1c6ecbdee1bc04eb2e4a986d6fb12a63e8a6b663a012ff41b031aef6.elf