Analysis
-
max time kernel
149s -
max time network
138s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20240729-en -
resource tags
arch:amd64arch:i386image:ubuntu2004-amd64-20240729-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system -
submitted
15-01-2025 14:48
Behavioral task
behavioral1
Sample
ub8ehJSePAfc9FYqZIT6.x86.elf
Resource
ubuntu2004-amd64-20240729-en
ubuntu-20.04-amd64
7 signatures
150 seconds
General
-
Target
ub8ehJSePAfc9FYqZIT6.x86.elf
-
Size
17KB
-
MD5
7047743c1c83a0795d0dca26866356f7
-
SHA1
a9460c8c41f103440b5073bc74b8bf1920c31629
-
SHA256
c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea
-
SHA512
96673f7f2faaa5b8cece9aec2dd6ed35af70e0f237a00806d155b14c6f617513ba539ccee32ac62743cc1005d0e3abc32d22468d570d9977382d10f843fbf39d
-
SSDEEP
384:MXVj+SEvm8rAKjYZuX4MIp3KcDjKeAY8E8eNkUpqTcQj0UXv1R9OTn:u+SjgX/mayjJd8INprUIn
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog ub8ehJSePAfc9FYqZIT6.x86.elf File opened for modification /dev/misc/watchdog ub8ehJSePAfc9FYqZIT6.x86.elf -
Traces itself 1 IoCs
Traces itself to prevent debugging attempts
pid Process 1398 ub8ehJSePAfc9FYqZIT6.x86.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog ub8ehJSePAfc9FYqZIT6.x86.elf File opened for modification /bin/watchdog ub8ehJSePAfc9FYqZIT6.x86.elf -
description ioc Process File opened for reading /proc/899/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1050/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1204/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1395/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/454/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/799/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/780/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/790/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/889/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/949/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1037/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1312/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/447/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/634/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1337/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1402/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/637/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/797/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1033/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1070/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1077/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1105/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/569/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/579/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1239/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1460/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1113/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1121/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/913/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1061/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1087/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1135/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1150/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/577/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/890/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/669/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1182/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1220/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1401/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/439/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/612/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/494/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/944/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/977/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1029/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1041/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1071/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/453/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/484/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/987/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1024/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1078/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1099/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/481/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/518/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1090/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1396/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/543/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/992/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/583/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/805/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/902/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1117/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/452/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf