Analysis
-
max time kernel
148s -
max time network
152s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
06-01-2025 02:58
Behavioral task
behavioral1
Sample
a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
6 signatures
150 seconds
General
-
Target
a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf
-
Size
38KB
-
MD5
51ac76a50f6b669ab90ebd8c5e903f8d
-
SHA1
e1847908d10cdd7face1f7ec73cd7842f02a3b90
-
SHA256
a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9
-
SHA512
2195b914ceacee800778a74a7fda7f8ce9bce361856ce062a01129b928c83abf197eda8ddc414b70e7993207a68ac62bd90664811581f342f8f5f5408ab8d398
-
SSDEEP
768:9favOe6etQzOE6JfpdbHVNM5HegIvcLjCPyUvnS5vVWVOs/nbcuyD7UrQRjl:Evh6etuOE6JbbHVNMDlSyK8vwVOs/noh
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for modification /dev/misc/watchdog a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for modification /bin/watchdog a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf -
description ioc Process File opened for reading /proc/219/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/399/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/759/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/1030/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/1071/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/1158/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/1565/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/86/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/216/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/761/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/1097/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/1312/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/1371/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/215/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/25/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/222/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/1259/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/10/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/9/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/13/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/21/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/27/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/78/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/109/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/118/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/6/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/91/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/95/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/410/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/1142/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/17/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/980/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/307/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/525/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/1116/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/223/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/259/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/734/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/1157/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/1179/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/1429/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/221/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/211/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/425/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/527/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/1090/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/16/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/24/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/89/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/113/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/600/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/603/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/745/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/767/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/22/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/1294/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/833/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/74/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/93/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/112/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/218/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/630/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/840/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf File opened for reading /proc/868/status a23f0f8effeec0ea89d80aaae567e5c3d118a108b8feea8e39b4d3aa10fb7bf9.elf