Analysis
-
max time kernel
149s -
max time network
128s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
09-01-2025 19:22
Behavioral task
behavioral1
Sample
wind.x86.elf
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
6 signatures
150 seconds
General
-
Target
wind.x86.elf
-
Size
25KB
-
MD5
d1e9fb00e183751e20c925fb59987bad
-
SHA1
f4ace9a4af08c71ad4484b137abb1e119b910c51
-
SHA256
519516cd21153492a011b48782f1e272659dcd78c4bdf98f492467a5fbd3810a
-
SHA512
5a3fb587b124757512f5fc50e0fa14ab06da32c4af6bc67a26acd467e2f9f20482c1447242b0ecf2f7d5254608585720721890461d5591eaa789d549f9e0b489
-
SSDEEP
768:uyIWAEAOn2fvESB7DXZhKJ526I4OgW6rywkp7wbmy:u0pnUsSB7DXyOgWrRpcb1
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog wind.x86.elf File opened for modification /dev/misc/watchdog wind.x86.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog wind.x86.elf File opened for modification /bin/watchdog wind.x86.elf -
description ioc Process File opened for reading /proc/416/cmdline wind.x86.elf File opened for reading /proc/710/cmdline wind.x86.elf File opened for reading /proc/1133/cmdline wind.x86.elf File opened for reading /proc/1567/cmdline wind.x86.elf File opened for reading /proc/1581/cmdline wind.x86.elf File opened for reading /proc/1650/cmdline wind.x86.elf File opened for reading /proc/1187/cmdline wind.x86.elf File opened for reading /proc/1345/cmdline wind.x86.elf File opened for reading /proc/1512/cmdline wind.x86.elf File opened for reading /proc/1636/cmdline wind.x86.elf File opened for reading /proc/1182/cmdline wind.x86.elf File opened for reading /proc/1206/cmdline wind.x86.elf File opened for reading /proc/590/cmdline wind.x86.elf File opened for reading /proc/659/cmdline wind.x86.elf File opened for reading /proc/870/cmdline wind.x86.elf File opened for reading /proc/1044/cmdline wind.x86.elf File opened for reading /proc/1164/cmdline wind.x86.elf File opened for reading /proc/746/cmdline wind.x86.elf File opened for reading /proc/991/cmdline wind.x86.elf File opened for reading /proc/1053/cmdline wind.x86.elf File opened for reading /proc/1158/cmdline wind.x86.elf File opened for reading /proc/1226/cmdline wind.x86.elf File opened for reading /proc/409/cmdline wind.x86.elf File opened for reading /proc/589/cmdline wind.x86.elf File opened for reading /proc/776/cmdline wind.x86.elf File opened for reading /proc/992/cmdline wind.x86.elf File opened for reading /proc/1142/cmdline wind.x86.elf File opened for reading /proc/415/cmdline wind.x86.elf File opened for reading /proc/1314/cmdline wind.x86.elf File opened for reading /proc/1386/cmdline wind.x86.elf File opened for reading /proc/782/cmdline wind.x86.elf File opened for reading /proc/1239/cmdline wind.x86.elf File opened for reading /proc/1353/cmdline wind.x86.elf File opened for reading /proc/1188/cmdline wind.x86.elf File opened for reading /proc/418/cmdline wind.x86.elf File opened for reading /proc/756/cmdline wind.x86.elf File opened for reading /proc/1077/cmdline wind.x86.elf File opened for reading /proc/1111/cmdline wind.x86.elf File opened for reading /proc/1167/cmdline wind.x86.elf File opened for reading /proc/558/cmdline wind.x86.elf File opened for reading /proc/588/cmdline wind.x86.elf File opened for reading /proc/1378/cmdline wind.x86.elf File opened for reading /proc/1531/cmdline wind.x86.elf File opened for reading /proc/1649/cmdline wind.x86.elf File opened for reading /proc/1434/cmdline wind.x86.elf File opened for reading /proc/1439/cmdline wind.x86.elf File opened for reading /proc/1100/cmdline wind.x86.elf File opened for reading /proc/1159/cmdline wind.x86.elf File opened for reading /proc/1173/cmdline wind.x86.elf File opened for reading /proc/1275/cmdline wind.x86.elf File opened for reading /proc/412/cmdline wind.x86.elf File opened for reading /proc/637/cmdline wind.x86.elf File opened for reading /proc/980/cmdline wind.x86.elf File opened for reading /proc/1284/cmdline wind.x86.elf File opened for reading /proc/838/cmdline wind.x86.elf File opened for reading /proc/1054/cmdline wind.x86.elf File opened for reading /proc/1373/cmdline wind.x86.elf File opened for reading /proc/1648/cmdline wind.x86.elf File opened for reading /proc/769/cmdline wind.x86.elf File opened for reading /proc/1174/cmdline wind.x86.elf File opened for reading /proc/1491/cmdline wind.x86.elf File opened for reading /proc/1072/cmdline wind.x86.elf File opened for reading /proc/1092/cmdline wind.x86.elf File opened for reading /proc/1224/cmdline wind.x86.elf