Analysis
-
max time kernel
149s -
max time network
128s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
03-01-2025 03:25
Behavioral task
behavioral1
Sample
3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
6 signatures
150 seconds
General
-
Target
3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf
-
Size
20KB
-
MD5
2696d2b99111e232d78a0c9678a3e154
-
SHA1
19933c0b1d0b81348c862aaedbda11087b87c874
-
SHA256
3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379
-
SHA512
67a9bd12fe8499665fe2a4ae772f4685744a00bfec1452577236f626ddbd8087956609673a78b514a6e438538f815242c98dff15b83c1b8f4302130ea818b8bb
-
SSDEEP
384:Mg4Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTa:M98o08kxofBE+ZkXaITbp2F2TWul0c5m
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for modification /dev/misc/watchdog 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for modification /bin/watchdog 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf -
description ioc Process File opened for reading /proc/413/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/1193/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/588/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/1178/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/943/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/987/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/1052/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/1363/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/843/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/759/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/1109/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/1447/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/839/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/1124/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/1156/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/1362/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/1373/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/1426/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/986/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/1043/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/1162/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/1200/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/1242/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/1196/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/1053/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/1174/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/1176/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/1144/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/1213/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/640/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/779/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/1140/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/730/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/1553/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/411/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/1074/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/1317/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/749/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/1099/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/1506/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/795/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/1231/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/1305/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/678/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/712/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/739/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/1210/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/1434/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/1061/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/1309/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/1486/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/636/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/780/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/1032/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/660/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/967/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/1283/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/606/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/633/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/1185/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/1532/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/454/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/609/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf File opened for reading /proc/1087/cmdline 3cd86a5cc82976251f617c7ca32d6d0fa5e757a4489f0e60dd1cccff28f8b379.elf