Analysis
-
max time kernel
136s -
max time network
146s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
13-01-2025 02:33
Behavioral task
behavioral1
Sample
9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
6 signatures
150 seconds
General
-
Target
9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf
-
Size
34KB
-
MD5
e464c12da31541e5b14e9d6a716589f0
-
SHA1
9f6fc1b010e7c64d58d8e3271914c9ce91aa711e
-
SHA256
9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b
-
SHA512
7ac06976d1a8b42db9c7a1b895fea84ccb99e5dec7cc890547b39ac51e5b1c35d478cbde09b16599e5041704b3f8f6c553b22ad8d4abfacd77dd986030e78338
-
SSDEEP
768:WCkGi0D/4BfI7dZnRh7/IN0BIesyoXKot5V4oEAIp1XHBx7nbcuyD7UHQRjK:WBGbyqhXrTBrQX4oE/HTnouy8HyG
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for modification /dev/misc/watchdog 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for modification /bin/watchdog 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf -
description ioc Process File opened for reading /proc/79/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/217/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/1216/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/1230/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/1313/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/12/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/452/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/746/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/733/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/1310/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/1566/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/25/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/196/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/409/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/637/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/661/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/102/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/426/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/827/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/1076/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/1333/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/16/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/1119/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/1290/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/1487/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/1054/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/1086/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/1555/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/11/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/195/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/585/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/859/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/867/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/1095/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/1131/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/119/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/635/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/678/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/740/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/962/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/2/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/97/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/219/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/377/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/971/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/113/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/201/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/314/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/1239/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/1142/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/1179/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/8/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/85/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/164/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/613/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/990/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/73/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/634/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/770/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/991/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/1178/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/1547/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/75/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf File opened for reading /proc/76/status 9b575c4bc969c455014d87cbfcd78d819cd44840ae51b5648be30d699e1f085b.elf