Analysis
-
max time kernel
148s -
max time network
149s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20240523-en -
resource tags
arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system -
submitted
13-01-2025 22:35
Behavioral task
behavioral1
Sample
camp.x86_64.elf
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
6 signatures
150 seconds
General
-
Target
camp.x86_64.elf
-
Size
36KB
-
MD5
5872e361c75eb6d934fec4f7ae32dc70
-
SHA1
6d5c97236ba057e124b51445d49e5df7602fa915
-
SHA256
e5dd3b3de502814e1bc66d6b3bb3244eb848cb299b85c323586347d939563f1d
-
SHA512
c05b6151584da7ba6724ce780287cdf96e26d3489f633e195ac34af21d4ad3d7ca73df53535aed6d9fe01d45b790613d0856d33be05e66c69b571970fa02a448
-
SSDEEP
768:AwS0nQr9tpJEu0annIBqVqVHmwIHWUFtGtzXKT1oS7tUx0nZG:rOX80VqVi2otGtzXEqMZG
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog camp.x86_64.elf File opened for modification /dev/misc/watchdog camp.x86_64.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog camp.x86_64.elf File opened for modification /bin/watchdog camp.x86_64.elf -
description ioc Process File opened for reading /proc/12/status camp.x86_64.elf File opened for reading /proc/194/status camp.x86_64.elf File opened for reading /proc/1117/status camp.x86_64.elf File opened for reading /proc/1393/status camp.x86_64.elf File opened for reading /proc/1923/status camp.x86_64.elf File opened for reading /proc/1935/status camp.x86_64.elf File opened for reading /proc/2/status camp.x86_64.elf File opened for reading /proc/7/status camp.x86_64.elf File opened for reading /proc/42/status camp.x86_64.elf File opened for reading /proc/79/status camp.x86_64.elf File opened for reading /proc/494/status camp.x86_64.elf File opened for reading /proc/6/status camp.x86_64.elf File opened for reading /proc/31/status camp.x86_64.elf File opened for reading /proc/56/status camp.x86_64.elf File opened for reading /proc/188/status camp.x86_64.elf File opened for reading /proc/199/status camp.x86_64.elf File opened for reading /proc/386/status camp.x86_64.elf File opened for reading /proc/816/status camp.x86_64.elf File opened for reading /proc/1845/status camp.x86_64.elf File opened for reading /proc/4/status camp.x86_64.elf File opened for reading /proc/29/status camp.x86_64.elf File opened for reading /proc/235/status camp.x86_64.elf File opened for reading /proc/457/status camp.x86_64.elf File opened for reading /proc/1925/status camp.x86_64.elf File opened for reading /proc/1929/status camp.x86_64.elf File opened for reading /proc/2156/status camp.x86_64.elf File opened for reading /proc/18/status camp.x86_64.elf File opened for reading /proc/585/status camp.x86_64.elf File opened for reading /proc/1653/status camp.x86_64.elf File opened for reading /proc/1821/status camp.x86_64.elf File opened for reading /proc/1919/status camp.x86_64.elf File opened for reading /proc/2172/status camp.x86_64.elf File opened for reading /proc/191/status camp.x86_64.elf File opened for reading /proc/22/status camp.x86_64.elf File opened for reading /proc/46/status camp.x86_64.elf File opened for reading /proc/70/status camp.x86_64.elf File opened for reading /proc/202/status camp.x86_64.elf File opened for reading /proc/1737/status camp.x86_64.elf File opened for reading /proc/2191/status camp.x86_64.elf File opened for reading /proc/2245/status camp.x86_64.elf File opened for reading /proc/3/status camp.x86_64.elf File opened for reading /proc/181/status camp.x86_64.elf File opened for reading /proc/1650/status camp.x86_64.elf File opened for reading /proc/43/status camp.x86_64.elf File opened for reading /proc/38/status camp.x86_64.elf File opened for reading /proc/45/status camp.x86_64.elf File opened for reading /proc/49/status camp.x86_64.elf File opened for reading /proc/63/status camp.x86_64.elf File opened for reading /proc/189/status camp.x86_64.elf File opened for reading /proc/384/status camp.x86_64.elf File opened for reading /proc/1934/status camp.x86_64.elf File opened for reading /proc/23/status camp.x86_64.elf File opened for reading /proc/2259/status camp.x86_64.elf File opened for reading /proc/51/status camp.x86_64.elf File opened for reading /proc/65/status camp.x86_64.elf File opened for reading /proc/389/status camp.x86_64.elf File opened for reading /proc/1903/status camp.x86_64.elf File opened for reading /proc/1921/status camp.x86_64.elf File opened for reading /proc/1927/status camp.x86_64.elf File opened for reading /proc/2452/status camp.x86_64.elf File opened for reading /proc/26/status camp.x86_64.elf File opened for reading /proc/417/status camp.x86_64.elf File opened for reading /proc/1394/status camp.x86_64.elf File opened for reading /proc/1843/status camp.x86_64.elf