Analysis
-
max time kernel
299s -
max time network
16s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
15-01-2025 15:26
Behavioral task
behavioral1
Sample
ub8ehJSePAfc9FYqZIT6.arm7.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
7 signatures
300 seconds
General
-
Target
ub8ehJSePAfc9FYqZIT6.arm7.elf
-
Size
39KB
-
MD5
76066fdc5b1d4dbebee4d4994349bacc
-
SHA1
86129514917b7e8f231024ebd60b475b000b38f7
-
SHA256
6036c270c86bcbf4c5fb6cd1369abc51e1e16e1e93024d66f43375d0424154fa
-
SHA512
33d003dfe3c0e3431cf97f9b405747c643ec754d0960d1271d7b3fb1342a5e4ba799930c588e4090d98a9667f39ceef050b233ab4ea9b6931537a271af11171c
-
SSDEEP
768:1eCg7FkMe9VToKaaRtxbGcxwtxXB79q3UEL7oAKnZx/7mPFFrP6Q6Z:1eCQFbe9VMKNxb8tmLzqWFr6Z
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for modification /dev/misc/watchdog ub8ehJSePAfc9FYqZIT6.arm7.elf -
Traces itself 1 IoCs
Traces itself to prevent debugging attempts
pid Process 648 ub8ehJSePAfc9FYqZIT6.arm7.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /bin/watchdog ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for modification /sbin/watchdog ub8ehJSePAfc9FYqZIT6.arm7.elf -
description ioc Process File opened for reading /proc/772/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/785/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/591/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/647/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/655/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/764/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/770/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/789/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/791/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/804/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/585/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/645/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/732/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/768/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/747/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/755/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/794/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/800/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/766/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/781/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/595/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/646/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/652/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/713/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/776/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/778/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/783/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/787/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/self/exe ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/596/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/757/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/762/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/806/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/812/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/588/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/644/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/780/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/796/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/721/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/731/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/802/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/810/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/792/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/798/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/808/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/814/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/638/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/651/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/709/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf File opened for reading /proc/774/cmdline ub8ehJSePAfc9FYqZIT6.arm7.elf