Analysis
-
max time kernel
149s -
max time network
140s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20241127-en -
resource tags
arch:amd64arch:i386image:ubuntu2004-amd64-20241127-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system -
submitted
10/01/2025, 01:32
Behavioral task
behavioral1
Sample
0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf
Resource
ubuntu2004-amd64-20241127-en
ubuntu-20.04-amd64
6 signatures
150 seconds
General
-
Target
0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf
-
Size
20KB
-
MD5
8a7d61d2ef9b9f35399eb694251c7d4a
-
SHA1
455d77460b3b29a5fcef077360f2d4cc1d08af9a
-
SHA256
0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13
-
SHA512
253d7a69c52d35d92952a31b1fb93c6d8890e32b7490511fb8aa5dec5c4bf7804584ae3d6c797ff54ab7b60d34661d0c5002cbf4ac8a150d2a69b7f475b8ab50
-
SSDEEP
384:Mg4Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTz:M98o08kxofBE+ZkXaITbp2F2TWul0c5H
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for modification /dev/misc/watchdog 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /bin/watchdog 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for modification /sbin/watchdog 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf -
description ioc Process File opened for reading /proc/1109/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/670/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/768/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/1130/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/1335/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/626/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/1383/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/453/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/560/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/1046/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/1098/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/1117/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/440/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/797/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/914/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/1328/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/1371/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/531/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/1008/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/1088/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/1201/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/1341/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/447/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/535/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/581/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/1029/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/488/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/896/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/949/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/798/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/902/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/1118/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/1333/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/1391/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/516/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/666/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/751/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/831/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/934/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/960/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/970/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/1116/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/1339/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/1340/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/454/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/564/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/1077/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/1145/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/1329/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/455/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/496/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/649/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/567/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/795/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/439/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/629/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/1399/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/683/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/1024/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/1034/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/504/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/1082/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/1103/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf File opened for reading /proc/512/cmdline 0768cb7a311c893d5e10d749b18f2092436c59b581a0b86f19db23aa240c6a13.elf