Analysis
-
max time kernel
149s -
max time network
128s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
10-01-2025 04:16
Behavioral task
behavioral1
Sample
f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
6 signatures
150 seconds
General
-
Target
f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf
-
Size
20KB
-
MD5
29ef0763121cbdb75d7a0f196afdd8aa
-
SHA1
22bf2948a5bef3356b4a246012d8bacea8c758b2
-
SHA256
f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de
-
SHA512
76960dcddf809785e59b7ce569805d8283122e4b0c64b306e207de93425a6c16b847ead3e67b1d2580058cbb74451cd4580e075a121683b8a1f53307c0d000a1
-
SSDEEP
384:Mg4Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTw:M98o08kxofBE+ZkXaITbp2F2TWul0c5k
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for modification /dev/watchdog f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for modification /bin/watchdog f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf -
description ioc Process File opened for reading /proc/1593/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/686/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/1193/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/530/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/614/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/728/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/962/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/447/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/485/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/1503/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/1605/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/454/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/677/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/1090/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/1139/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/1509/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/1557/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/1017/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/1042/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/1131/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/1318/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/480/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/1075/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/1343/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/1522/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/1587/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/955/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/1156/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/1118/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/1127/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/1202/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/1123/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/491/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/529/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/552/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/1194/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/1266/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/1352/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/428/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/471/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/1289/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/1385/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/1563/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/1148/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/1070/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/1073/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/1080/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/961/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/1299/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/1500/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/970/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/979/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/1103/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/1581/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/481/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/656/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/1228/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/1599/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/567/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/653/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/1200/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/654/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/1502/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf File opened for reading /proc/1180/cmdline f9408ca8aa9716bd4561bf719a6a8f80b88a26cc5379e994f397d3f9b9e8b2de.elf