Analysis
-
max time kernel
150s -
max time network
10s -
platform
debian-12_mipsel -
resource
debian12-mipsel-20240729-en -
resource tags
arch:mipselimage:debian12-mipsel-20240729-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem -
submitted
03-01-2025 03:24
Behavioral task
behavioral1
Sample
3a6a4967af4027d1b80e8996ca34d42877fa1e71972f7ec53eeba34c2c2e905d.elf
Resource
debian12-mipsel-20240729-en
debian-12-mipsel
5 signatures
150 seconds
General
-
Target
3a6a4967af4027d1b80e8996ca34d42877fa1e71972f7ec53eeba34c2c2e905d.elf
-
Size
24KB
-
MD5
1fdfbb5c96a12dac461f4a56bfcecf0f
-
SHA1
523f9e36908fed0e467bf278e1c0b03422fa55fb
-
SHA256
3a6a4967af4027d1b80e8996ca34d42877fa1e71972f7ec53eeba34c2c2e905d
-
SHA512
2f9a05f4f90938a978165b386c8bd897261c7c8b0517b9f90f972a3d83f533406d864367f605b81a0579e8a14fcb840b0af7f220609e727242036297ec43e8b9
-
SSDEEP
768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBp2ZqSWvP:4QlS07FUXqIYSXQKquaqn
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 3a6a4967af4027d1b80e8996ca34d42877fa1e71972f7ec53eeba34c2c2e905d.elf File opened for modification /dev/misc/watchdog 3a6a4967af4027d1b80e8996ca34d42877fa1e71972f7ec53eeba34c2c2e905d.elf -
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 3a6a4967af4027d1b80e8996ca34d42877fa1e71972f7ec53eeba34c2c2e905d.elf File opened for modification /bin/watchdog 3a6a4967af4027d1b80e8996ca34d42877fa1e71972f7ec53eeba34c2c2e905d.elf -
description ioc Process File opened for reading /proc/679/cmdline 3a6a4967af4027d1b80e8996ca34d42877fa1e71972f7ec53eeba34c2c2e905d.elf File opened for reading /proc/734/cmdline 3a6a4967af4027d1b80e8996ca34d42877fa1e71972f7ec53eeba34c2c2e905d.elf File opened for reading /proc/735/cmdline 3a6a4967af4027d1b80e8996ca34d42877fa1e71972f7ec53eeba34c2c2e905d.elf File opened for reading /proc/755/cmdline 3a6a4967af4027d1b80e8996ca34d42877fa1e71972f7ec53eeba34c2c2e905d.elf File opened for reading /proc/722/cmdline 3a6a4967af4027d1b80e8996ca34d42877fa1e71972f7ec53eeba34c2c2e905d.elf File opened for reading /proc/748/cmdline 3a6a4967af4027d1b80e8996ca34d42877fa1e71972f7ec53eeba34c2c2e905d.elf File opened for reading /proc/439/cmdline 3a6a4967af4027d1b80e8996ca34d42877fa1e71972f7ec53eeba34c2c2e905d.elf File opened for reading /proc/700/cmdline 3a6a4967af4027d1b80e8996ca34d42877fa1e71972f7ec53eeba34c2c2e905d.elf File opened for reading /proc/712/cmdline 3a6a4967af4027d1b80e8996ca34d42877fa1e71972f7ec53eeba34c2c2e905d.elf File opened for reading /proc/697/cmdline 3a6a4967af4027d1b80e8996ca34d42877fa1e71972f7ec53eeba34c2c2e905d.elf File opened for reading /proc/718/cmdline 3a6a4967af4027d1b80e8996ca34d42877fa1e71972f7ec53eeba34c2c2e905d.elf File opened for reading /proc/664/cmdline 3a6a4967af4027d1b80e8996ca34d42877fa1e71972f7ec53eeba34c2c2e905d.elf File opened for reading /proc/681/cmdline 3a6a4967af4027d1b80e8996ca34d42877fa1e71972f7ec53eeba34c2c2e905d.elf File opened for reading /proc/682/cmdline 3a6a4967af4027d1b80e8996ca34d42877fa1e71972f7ec53eeba34c2c2e905d.elf