Analysis
-
max time kernel
148s -
max time network
150s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20240523-en -
resource tags
arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system -
submitted
06-01-2025 02:22
Behavioral task
behavioral1
Sample
299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
6 signatures
150 seconds
General
-
Target
299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf
-
Size
36KB
-
MD5
61ac2e5987ae1549b1cbf1b9c4510b10
-
SHA1
0d98d37b2dd720b8beebc3847a2e1662862a95bf
-
SHA256
299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4
-
SHA512
266da73ea020a65e4b81e3ef890bf0f542729826c82d572a904c7c86e284c0d6acd855404cbd4c64ea42a4ae490088e23d4d8471d4842be2093828e354a617af
-
SSDEEP
768:b9yPVL9pDYfoWJjo+eNrHXCMaZIPTVhSb40miKx0z:epqRjo+4rHXCzIPTVh9Ni
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for modification /dev/misc/watchdog 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for modification /bin/watchdog 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf -
description ioc Process File opened for reading /proc/53/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/2179/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/2202/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/2446/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/6/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/47/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/194/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/1745/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/1894/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/2165/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/11/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/26/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/191/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/196/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/1087/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/18/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/190/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/585/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/1065/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/1765/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/2237/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/30/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/188/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/1653/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/1798/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/1903/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/2087/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/2172/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/2191/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/27/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/197/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/200/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/274/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/582/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/1334/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/1845/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/12/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/198/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/17/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/41/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/192/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/201/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/815/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/1824/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/1/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/8/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/1930/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/2096/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/2263/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/1908/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/1922/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/783/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/52/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/389/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/1250/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/1655/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/1923/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/2158/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/36/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/44/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/2445/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/1650/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/1737/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf File opened for reading /proc/1881/status 299b08f5438ec6cc8d81126654edd5430e0229d220626a3b787e848c68d933d4.elf