Analysis
-
max time kernel
149s -
max time network
128s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
02-01-2025 00:31
Behavioral task
behavioral1
Sample
x86.elf
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
6 signatures
150 seconds
General
-
Target
x86.elf
-
Size
20KB
-
MD5
2696d2b99111e232d78a0c9678a3e154
-
SHA1
19933c0b1d0b81348c862aaedbda11087b87c874
-
SHA256
3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379
-
SHA512
67a9bd12fe8499665fe2a4ae772f4685744a00bfec1452577236f626ddbd8087956609673a78b514a6e438538f815242c98dff15b83c1b8f4302130ea818b8bb
-
SSDEEP
384:Mg4Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTa:M98o08kxofBE+ZkXaITbp2F2TWul0c5m
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog x86.elf File opened for modification /dev/misc/watchdog x86.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog x86.elf File opened for modification /bin/watchdog x86.elf -
description ioc Process File opened for reading /proc/1487/cmdline x86.elf File opened for reading /proc/971/cmdline x86.elf File opened for reading /proc/1288/cmdline x86.elf File opened for reading /proc/1082/cmdline x86.elf File opened for reading /proc/1161/cmdline x86.elf File opened for reading /proc/1163/cmdline x86.elf File opened for reading /proc/1383/cmdline x86.elf File opened for reading /proc/607/cmdline x86.elf File opened for reading /proc/963/cmdline x86.elf File opened for reading /proc/788/cmdline x86.elf File opened for reading /proc/1358/cmdline x86.elf File opened for reading /proc/635/cmdline x86.elf File opened for reading /proc/640/cmdline x86.elf File opened for reading /proc/951/cmdline x86.elf File opened for reading /proc/1140/cmdline x86.elf File opened for reading /proc/590/cmdline x86.elf File opened for reading /proc/594/cmdline x86.elf File opened for reading /proc/680/cmdline x86.elf File opened for reading /proc/1507/cmdline x86.elf File opened for reading /proc/559/cmdline x86.elf File opened for reading /proc/676/cmdline x86.elf File opened for reading /proc/1194/cmdline x86.elf File opened for reading /proc/1435/cmdline x86.elf File opened for reading /proc/1095/cmdline x86.elf File opened for reading /proc/1159/cmdline x86.elf File opened for reading /proc/742/cmdline x86.elf File opened for reading /proc/762/cmdline x86.elf File opened for reading /proc/998/cmdline x86.elf File opened for reading /proc/1177/cmdline x86.elf File opened for reading /proc/1427/cmdline x86.elf File opened for reading /proc/1561/cmdline x86.elf File opened for reading /proc/511/cmdline x86.elf File opened for reading /proc/586/cmdline x86.elf File opened for reading /proc/1052/cmdline x86.elf File opened for reading /proc/1231/cmdline x86.elf File opened for reading /proc/1237/cmdline x86.elf File opened for reading /proc/1560/cmdline x86.elf File opened for reading /proc/1576/cmdline x86.elf File opened for reading /proc/514/cmdline x86.elf File opened for reading /proc/1043/cmdline x86.elf File opened for reading /proc/1124/cmdline x86.elf File opened for reading /proc/1245/cmdline x86.elf File opened for reading /proc/412/cmdline x86.elf File opened for reading /proc/556/cmdline x86.elf File opened for reading /proc/665/cmdline x86.elf File opened for reading /proc/1032/cmdline x86.elf File opened for reading /proc/1144/cmdline x86.elf File opened for reading /proc/1160/cmdline x86.elf File opened for reading /proc/1166/cmdline x86.elf File opened for reading /proc/1306/cmdline x86.elf File opened for reading /proc/589/cmdline x86.elf File opened for reading /proc/636/cmdline x86.elf File opened for reading /proc/810/cmdline x86.elf File opened for reading /proc/1155/cmdline x86.elf File opened for reading /proc/1229/cmdline x86.elf File opened for reading /proc/418/cmdline x86.elf File opened for reading /proc/740/cmdline x86.elf File opened for reading /proc/1103/cmdline x86.elf File opened for reading /proc/1158/cmdline x86.elf File opened for reading /proc/614/cmdline x86.elf File opened for reading /proc/774/cmdline x86.elf File opened for reading /proc/454/cmdline x86.elf File opened for reading /proc/775/cmdline x86.elf File opened for reading /proc/936/cmdline x86.elf