Analysis
-
max time kernel
299s -
max time network
11s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
15-01-2025 15:18
Behavioral task
behavioral1
Sample
ub8ehJSePAfc9FYqZIT6.arm6.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
7 signatures
300 seconds
General
-
Target
ub8ehJSePAfc9FYqZIT6.arm6.elf
-
Size
22KB
-
MD5
76e0e8df12ca4d1804dfc1640a5ff664
-
SHA1
59c1f1704f3efc009f60d7b46e50041f82540bb9
-
SHA256
655cd3483b35ffea03fb1f3277f3fcb38c8e684723f7e459077099130de6ff31
-
SHA512
3ba900fb8d5b0f49357470cf791c35fe241dabb4b2b3613be33f623ac27dcd1dc2dfb5cddc56641fc253ea53a554fb0cba3eab8c52d294878ea693558ecc66ed
-
SSDEEP
384:F/BctKdlw4DUrpZoNcepO235FUeZ062Zy46wMTa/bictgJwIlh7qmdGUEpiao:F/Bldlw4DUvgtpO2LUeC62E4cW/bttMB
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for modification /dev/misc/watchdog ub8ehJSePAfc9FYqZIT6.arm6.elf -
Traces itself 1 IoCs
Traces itself to prevent debugging attempts
pid Process 654 ub8ehJSePAfc9FYqZIT6.arm6.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for modification /bin/watchdog ub8ehJSePAfc9FYqZIT6.arm6.elf -
description ioc Process File opened for reading /proc/773/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/781/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/813/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/787/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/803/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/657/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/664/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/779/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/722/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/771/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/775/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/777/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/801/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/self/exe ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/652/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/716/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/805/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/817/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/821/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/811/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/815/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/823/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/748/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/766/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/792/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/819/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/646/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/789/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/798/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/651/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/658/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/717/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/730/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/764/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/598/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/600/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/606/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/783/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/785/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/809/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/790/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/794/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/800/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/590/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/653/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/718/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/807/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/605/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/749/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/796/cmdline ub8ehJSePAfc9FYqZIT6.arm6.elf