Analysis
-
max time kernel
149s -
max time network
154s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20241127-en -
resource tags
arch:amd64arch:i386image:ubuntu2004-amd64-20241127-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system -
submitted
11-01-2025 22:47
Behavioral task
behavioral1
Sample
camp.x86.elf
Resource
ubuntu2004-amd64-20241127-en
ubuntu-20.04-amd64
6 signatures
150 seconds
General
-
Target
camp.x86.elf
-
Size
34KB
-
MD5
6b451baba12ac4e4f1690b2b04ab61a4
-
SHA1
5ad2a6a0536d39ef7e57b80ac136b2c9973260ee
-
SHA256
2db3cd41a5b0d964624cbbf35587877cd84276122cca2ef07698b88ef5790680
-
SHA512
2fd843d8706a0853ee019460c7dd255c8ca63784369c1e5b953f9309742e770526fdd5b0cb56e7a74f0c04c3676fdf93b0ecaf36f43aa850d91629e285538f16
-
SSDEEP
768:WzbGjwng3vdORRd5c6VobQ5g7pTjGZ+hvGhgh1TnbcuyD7UHQRjR:GdnAqKyABsibnouy8HyF
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog camp.x86.elf File opened for modification /dev/misc/watchdog camp.x86.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog camp.x86.elf File opened for modification /bin/watchdog camp.x86.elf -
description ioc Process File opened for reading /proc/86/status camp.x86.elf File opened for reading /proc/1033/status camp.x86.elf File opened for reading /proc/1093/status camp.x86.elf File opened for reading /proc/1356/status camp.x86.elf File opened for reading /proc/1379/status camp.x86.elf File opened for reading /proc/1423/status camp.x86.elf File opened for reading /proc/175/status camp.x86.elf File opened for reading /proc/443/status camp.x86.elf File opened for reading /proc/792/status camp.x86.elf File opened for reading /proc/948/status camp.x86.elf File opened for reading /proc/995/status camp.x86.elf File opened for reading /proc/1353/status camp.x86.elf File opened for reading /proc/71/status camp.x86.elf File opened for reading /proc/81/status camp.x86.elf File opened for reading /proc/515/status camp.x86.elf File opened for reading /proc/751/status camp.x86.elf File opened for reading /proc/1116/status camp.x86.elf File opened for reading /proc/1159/status camp.x86.elf File opened for reading /proc/10/status camp.x86.elf File opened for reading /proc/163/status camp.x86.elf File opened for reading /proc/166/status camp.x86.elf File opened for reading /proc/1350/status camp.x86.elf File opened for reading /proc/1361/status camp.x86.elf File opened for reading /proc/1367/status camp.x86.elf File opened for reading /proc/1381/status camp.x86.elf File opened for reading /proc/11/status camp.x86.elf File opened for reading /proc/15/status camp.x86.elf File opened for reading /proc/402/status camp.x86.elf File opened for reading /proc/442/status camp.x86.elf File opened for reading /proc/456/status camp.x86.elf File opened for reading /proc/991/status camp.x86.elf File opened for reading /proc/14/status camp.x86.elf File opened for reading /proc/85/status camp.x86.elf File opened for reading /proc/88/status camp.x86.elf File opened for reading /proc/1128/status camp.x86.elf File opened for reading /proc/1129/status camp.x86.elf File opened for reading /proc/129/status camp.x86.elf File opened for reading /proc/959/status camp.x86.elf File opened for reading /proc/1023/status camp.x86.elf File opened for reading /proc/1028/status camp.x86.elf File opened for reading /proc/1418/status camp.x86.elf File opened for reading /proc/73/status camp.x86.elf File opened for reading /proc/242/status camp.x86.elf File opened for reading /proc/1045/status camp.x86.elf File opened for reading /proc/1179/status camp.x86.elf File opened for reading /proc/1363/status camp.x86.elf File opened for reading /proc/455/status camp.x86.elf File opened for reading /proc/533/status camp.x86.elf File opened for reading /proc/953/status camp.x86.elf File opened for reading /proc/1/status camp.x86.elf File opened for reading /proc/20/status camp.x86.elf File opened for reading /proc/1102/status camp.x86.elf File opened for reading /proc/22/status camp.x86.elf File opened for reading /proc/173/status camp.x86.elf File opened for reading /proc/666/status camp.x86.elf File opened for reading /proc/969/status camp.x86.elf File opened for reading /proc/1041/status camp.x86.elf File opened for reading /proc/1075/status camp.x86.elf File opened for reading /proc/76/status camp.x86.elf File opened for reading /proc/497/status camp.x86.elf File opened for reading /proc/558/status camp.x86.elf File opened for reading /proc/683/status camp.x86.elf File opened for reading /proc/1103/status camp.x86.elf File opened for reading /proc/3/status camp.x86.elf