Analysis
-
max time kernel
149s -
max time network
132s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20240729-en -
resource tags
arch:amd64arch:i386image:ubuntu2004-amd64-20240729-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system -
submitted
08-01-2025 20:01
Behavioral task
behavioral1
Sample
boatnet.x86.elf
Resource
ubuntu2004-amd64-20240729-en
ubuntu-20.04-amd64
6 signatures
150 seconds
General
-
Target
boatnet.x86.elf
-
Size
20KB
-
MD5
8a7d61d2ef9b9f35399eb694251c7d4a
-
SHA1
455d77460b3b29a5fcef077360f2d4cc1d08af9a
-
SHA256
0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13
-
SHA512
253d7a69c52d35d92952a31b1fb93c6d8890e32b7490511fb8aa5dec5c4bf7804584ae3d6c797ff54ab7b60d34661d0c5002cbf4ac8a150d2a69b7f475b8ab50
-
SSDEEP
384:Mg4Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTz:M98o08kxofBE+ZkXaITbp2F2TWul0c5H
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog boatnet.x86.elf File opened for modification /dev/misc/watchdog boatnet.x86.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog boatnet.x86.elf File opened for modification /bin/watchdog boatnet.x86.elf -
description ioc Process File opened for reading /proc/1096/cmdline boatnet.x86.elf File opened for reading /proc/1105/cmdline boatnet.x86.elf File opened for reading /proc/533/cmdline boatnet.x86.elf File opened for reading /proc/576/cmdline boatnet.x86.elf File opened for reading /proc/1084/cmdline boatnet.x86.elf File opened for reading /proc/774/cmdline boatnet.x86.elf File opened for reading /proc/789/cmdline boatnet.x86.elf File opened for reading /proc/919/cmdline boatnet.x86.elf File opened for reading /proc/955/cmdline boatnet.x86.elf File opened for reading /proc/1069/cmdline boatnet.x86.elf File opened for reading /proc/439/cmdline boatnet.x86.elf File opened for reading /proc/453/cmdline boatnet.x86.elf File opened for reading /proc/614/cmdline boatnet.x86.elf File opened for reading /proc/669/cmdline boatnet.x86.elf File opened for reading /proc/779/cmdline boatnet.x86.elf File opened for reading /proc/1419/cmdline boatnet.x86.elf File opened for reading /proc/1076/cmdline boatnet.x86.elf File opened for reading /proc/1468/cmdline boatnet.x86.elf File opened for reading /proc/1129/cmdline boatnet.x86.elf File opened for reading /proc/871/cmdline boatnet.x86.elf File opened for reading /proc/1091/cmdline boatnet.x86.elf File opened for reading /proc/1154/cmdline boatnet.x86.elf File opened for reading /proc/1462/cmdline boatnet.x86.elf File opened for reading /proc/1469/cmdline boatnet.x86.elf File opened for reading /proc/441/cmdline boatnet.x86.elf File opened for reading /proc/823/cmdline boatnet.x86.elf File opened for reading /proc/848/cmdline boatnet.x86.elf File opened for reading /proc/584/cmdline boatnet.x86.elf File opened for reading /proc/943/cmdline boatnet.x86.elf File opened for reading /proc/1031/cmdline boatnet.x86.elf File opened for reading /proc/1035/cmdline boatnet.x86.elf File opened for reading /proc/1124/cmdline boatnet.x86.elf File opened for reading /proc/438/cmdline boatnet.x86.elf File opened for reading /proc/491/cmdline boatnet.x86.elf File opened for reading /proc/578/cmdline boatnet.x86.elf File opened for reading /proc/1132/cmdline boatnet.x86.elf File opened for reading /proc/1311/cmdline boatnet.x86.elf File opened for reading /proc/1337/cmdline boatnet.x86.elf File opened for reading /proc/991/cmdline boatnet.x86.elf File opened for reading /proc/1022/cmdline boatnet.x86.elf File opened for reading /proc/1087/cmdline boatnet.x86.elf File opened for reading /proc/1102/cmdline boatnet.x86.elf File opened for reading /proc/475/cmdline boatnet.x86.elf File opened for reading /proc/531/cmdline boatnet.x86.elf File opened for reading /proc/611/cmdline boatnet.x86.elf File opened for reading /proc/1048/cmdline boatnet.x86.elf File opened for reading /proc/1088/cmdline boatnet.x86.elf File opened for reading /proc/1240/cmdline boatnet.x86.elf File opened for reading /proc/1294/cmdline boatnet.x86.elf File opened for reading /proc/1295/cmdline boatnet.x86.elf File opened for reading /proc/635/cmdline boatnet.x86.elf File opened for reading /proc/685/cmdline boatnet.x86.elf File opened for reading /proc/757/cmdline boatnet.x86.elf File opened for reading /proc/1421/cmdline boatnet.x86.elf File opened for reading /proc/853/cmdline boatnet.x86.elf File opened for reading /proc/856/cmdline boatnet.x86.elf File opened for reading /proc/450/cmdline boatnet.x86.elf File opened for reading /proc/452/cmdline boatnet.x86.elf File opened for reading /proc/496/cmdline boatnet.x86.elf File opened for reading /proc/1059/cmdline boatnet.x86.elf File opened for reading /proc/1080/cmdline boatnet.x86.elf File opened for reading /proc/1222/cmdline boatnet.x86.elf File opened for reading /proc/1420/cmdline boatnet.x86.elf File opened for reading /proc/573/cmdline boatnet.x86.elf