Analysis
-
max time kernel
149s -
max time network
128s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240729-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240729-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
01-01-2025 03:01
Behavioral task
behavioral1
Sample
b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf
Resource
ubuntu2204-amd64-20240729-en
ubuntu-22.04-amd64
6 signatures
150 seconds
General
-
Target
b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf
-
Size
27KB
-
MD5
9e6da56f2e4b29e5d019938932a7d02d
-
SHA1
2039359cee130eb95673ba1d21a91965a87dc564
-
SHA256
b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a
-
SHA512
2084c8b7057d9fb9dc6587237c3e1a3172ae3cf51774097d587a2e2c6d0168b82d834b0c80d4f8672953df408e3b97dfc391f9aeb2ae263a2f12cbc12e34e382
-
SSDEEP
768:Hac0rOyubkgG13ShHdYHBR2RmY9zlF0SsG:6c0KFq3w9YHXqhJFH
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for modification /dev/misc/watchdog b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for modification /bin/watchdog b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf -
description ioc Process File opened for reading /proc/1248/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/1376/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/1567/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/500/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/764/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/1236/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/790/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/1163/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/427/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/451/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/522/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/666/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/775/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/1427/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/686/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/966/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/991/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/1367/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/417/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/585/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/664/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/1198/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/1384/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/752/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/783/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/958/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/1100/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/1160/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/1314/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/741/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/965/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/1124/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/774/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/1161/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/1484/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/411/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/589/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/640/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/1317/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/1566/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/676/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/1560/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/811/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/1070/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/1184/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/929/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/946/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/1079/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/1083/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/1309/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/593/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/634/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/722/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/1359/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/1052/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/409/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/499/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/612/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/616/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/638/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/1144/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/1192/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/1334/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf File opened for reading /proc/762/cmdline b528a15b83072c5d848eba0700eedf37dbfb35938a29e41c4529bee4e325203a.elf