Analysis
-
max time kernel
152s -
max time network
165s -
platform
debian-12_mipsel -
resource
debian12-mipsel-20240221-en -
resource tags
arch:mipselimage:debian12-mipsel-20240221-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem -
submitted
12-01-2025 03:20
Behavioral task
behavioral1
Sample
d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf
Resource
debian12-mipsel-20240221-en
debian-12-mipsel
6 signatures
150 seconds
General
-
Target
d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf
-
Size
37KB
-
MD5
91d99a457e2507262fb29b8110f0a6ea
-
SHA1
ef2bcd5e493fd2f04a6790aa4a07a49b42677c17
-
SHA256
d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b
-
SHA512
44160b5262d2819c144df6f5f7d50d2612a6cc44f5ec9bb6af6296725456e1aff8120ae1863cec8b2a193ff7f98dcdd647c84b138c38c3df175b8f68156be83f
-
SSDEEP
768:UhpGLq2YEQh5q10MxYWt/y/1tgPUcDpLoKAjB8Wl:EpD2Ynjq10Qt/U89afp
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for modification /dev/misc/watchdog d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for modification /bin/watchdog d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf -
description ioc Process File opened for reading /proc/27/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/117/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/324/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/732/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/1/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/9/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/24/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/47/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/179/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/396/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/655/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/53/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/113/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/136/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/381/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/412/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/28/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/30/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/114/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/743/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/5/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/16/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/21/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/35/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/23/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/48/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/58/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/137/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/690/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/710/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/719/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/37/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/111/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/346/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/716/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/713/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/742/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/7/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/10/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/26/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/45/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/378/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/688/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/733/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/392/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/3/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/4/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/8/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/12/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/13/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/29/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/42/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/692/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/11/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/31/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/33/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/59/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/704/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/18/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/34/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/383/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/414/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/729/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf File opened for reading /proc/642/status d74da9a6f17ec3120d5bf51549dd48f22e391a3b1d7124c260ac313dfedc640b.elf