Analysis
-
max time kernel
144s -
max time network
144s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
12-01-2025 02:46
Behavioral task
behavioral1
Sample
80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
6 signatures
150 seconds
General
-
Target
80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf
-
Size
36KB
-
MD5
dbd52cab3f34236c5ea317dbef35c611
-
SHA1
21a1b60b973713a1bd6773ce307711eb67b93775
-
SHA256
80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df
-
SHA512
c3f76b9d9adc8791eea2309fa907b709bc35d8a0080b6d8ad3930bab504ec949f275531c0d95988066a40c7fc03150dc862f01e490bbb59f897a932bcafce0b9
-
SSDEEP
768:G+4qtvWUAASjjLMGz7/tjBQd4Mt8nEPH3Ggu6APvPWx01:19tvWrASjjL17/9BODtoPgu62WY
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for modification /dev/misc/watchdog 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for modification /bin/watchdog 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf -
description ioc Process File opened for reading /proc/418/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/511/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/1167/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/1227/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/211/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/406/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/1221/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/1559/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/1088/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/77/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/89/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/207/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/220/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/742/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/784/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/1036/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/1193/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/1232/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/1/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/8/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/82/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/110/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/213/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/452/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/1166/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/12/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/20/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/114/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/843/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/1077/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/1179/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/1434/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/74/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/76/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/200/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/217/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/377/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/634/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/1318/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/160/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/215/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/412/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/723/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/1284/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/614/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/636/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/643/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/746/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/783/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/1056/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/1491/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/1573/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/9/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/223/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/558/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/1111/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/1161/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/1168/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/1558/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/11/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/24/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/1148/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/203/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf File opened for reading /proc/1160/status 80e9d07dd1222b4908748d20dc9864d316a194b62bb541b130b4f054b8b504df.elf