Analysis
-
max time kernel
146s -
max time network
151s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20240523-en -
resource tags
arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system -
submitted
13/01/2025, 22:17
Behavioral task
behavioral1
Sample
camp.x86_64.elf
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
6 signatures
150 seconds
General
-
Target
camp.x86_64.elf
-
Size
36KB
-
MD5
5872e361c75eb6d934fec4f7ae32dc70
-
SHA1
6d5c97236ba057e124b51445d49e5df7602fa915
-
SHA256
e5dd3b3de502814e1bc66d6b3bb3244eb848cb299b85c323586347d939563f1d
-
SHA512
c05b6151584da7ba6724ce780287cdf96e26d3489f633e195ac34af21d4ad3d7ca73df53535aed6d9fe01d45b790613d0856d33be05e66c69b571970fa02a448
-
SSDEEP
768:AwS0nQr9tpJEu0annIBqVqVHmwIHWUFtGtzXKT1oS7tUx0nZG:rOX80VqVi2otGtzXEqMZG
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog camp.x86_64.elf File opened for modification /dev/misc/watchdog camp.x86_64.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog camp.x86_64.elf File opened for modification /bin/watchdog camp.x86_64.elf -
description ioc Process File opened for reading /proc/3395/status camp.x86_64.elf File opened for reading /proc/3535/status camp.x86_64.elf File opened for reading /proc/3549/status camp.x86_64.elf File opened for reading /proc/3589/status camp.x86_64.elf File opened for reading /proc/185/status camp.x86_64.elf File opened for reading /proc/1408/status camp.x86_64.elf File opened for reading /proc/3283/status camp.x86_64.elf File opened for reading /proc/3476/status camp.x86_64.elf File opened for reading /proc/3501/status camp.x86_64.elf File opened for reading /proc/3551/status camp.x86_64.elf File opened for reading /proc/3554/status camp.x86_64.elf File opened for reading /proc/3556/status camp.x86_64.elf File opened for reading /proc/9/status camp.x86_64.elf File opened for reading /proc/10/status camp.x86_64.elf File opened for reading /proc/3895/status camp.x86_64.elf File opened for reading /proc/4006/status camp.x86_64.elf File opened for reading /proc/4065/status camp.x86_64.elf File opened for reading /proc/3578/status camp.x86_64.elf File opened for reading /proc/3737/status camp.x86_64.elf File opened for reading /proc/37/status camp.x86_64.elf File opened for reading /proc/202/status camp.x86_64.elf File opened for reading /proc/3517/status camp.x86_64.elf File opened for reading /proc/3564/status camp.x86_64.elf File opened for reading /proc/3824/status camp.x86_64.elf File opened for reading /proc/23/status camp.x86_64.elf File opened for reading /proc/29/status camp.x86_64.elf File opened for reading /proc/80/status camp.x86_64.elf File opened for reading /proc/391/status camp.x86_64.elf File opened for reading /proc/582/status camp.x86_64.elf File opened for reading /proc/3451/status camp.x86_64.elf File opened for reading /proc/15/status camp.x86_64.elf File opened for reading /proc/56/status camp.x86_64.elf File opened for reading /proc/34/status camp.x86_64.elf File opened for reading /proc/375/status camp.x86_64.elf File opened for reading /proc/418/status camp.x86_64.elf File opened for reading /proc/437/status camp.x86_64.elf File opened for reading /proc/3367/status camp.x86_64.elf File opened for reading /proc/3791/status camp.x86_64.elf File opened for reading /proc/1/status camp.x86_64.elf File opened for reading /proc/24/status camp.x86_64.elf File opened for reading /proc/791/status camp.x86_64.elf File opened for reading /proc/1081/status camp.x86_64.elf File opened for reading /proc/2708/status camp.x86_64.elf File opened for reading /proc/510/status camp.x86_64.elf File opened for reading /proc/730/status camp.x86_64.elf File opened for reading /proc/184/status camp.x86_64.elf File opened for reading /proc/372/status camp.x86_64.elf File opened for reading /proc/3293/status camp.x86_64.elf File opened for reading /proc/3559/status camp.x86_64.elf File opened for reading /proc/20/status camp.x86_64.elf File opened for reading /proc/43/status camp.x86_64.elf File opened for reading /proc/189/status camp.x86_64.elf File opened for reading /proc/195/status camp.x86_64.elf File opened for reading /proc/509/status camp.x86_64.elf File opened for reading /proc/3375/status camp.x86_64.elf File opened for reading /proc/14/status camp.x86_64.elf File opened for reading /proc/144/status camp.x86_64.elf File opened for reading /proc/457/status camp.x86_64.elf File opened for reading /proc/1049/status camp.x86_64.elf File opened for reading /proc/3473/status camp.x86_64.elf File opened for reading /proc/3567/status camp.x86_64.elf File opened for reading /proc/3716/status camp.x86_64.elf File opened for reading /proc/3722/status camp.x86_64.elf File opened for reading /proc/13/status camp.x86_64.elf