Analysis
-
max time kernel
149s -
max time network
132s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240522.1-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240522.1-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
15-01-2025 15:51
Behavioral task
behavioral1
Sample
ub8ehJSePAfc9FYqZIT6.x86.elf
Resource
ubuntu2204-amd64-20240522.1-en
ubuntu-22.04-amd64
7 signatures
150 seconds
General
-
Target
ub8ehJSePAfc9FYqZIT6.x86.elf
-
Size
17KB
-
MD5
7047743c1c83a0795d0dca26866356f7
-
SHA1
a9460c8c41f103440b5073bc74b8bf1920c31629
-
SHA256
c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea
-
SHA512
96673f7f2faaa5b8cece9aec2dd6ed35af70e0f237a00806d155b14c6f617513ba539ccee32ac62743cc1005d0e3abc32d22468d570d9977382d10f843fbf39d
-
SSDEEP
384:MXVj+SEvm8rAKjYZuX4MIp3KcDjKeAY8E8eNkUpqTcQj0UXv1R9OTn:u+SjgX/mayjJd8INprUIn
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog ub8ehJSePAfc9FYqZIT6.x86.elf File opened for modification /dev/misc/watchdog ub8ehJSePAfc9FYqZIT6.x86.elf -
Traces itself 1 IoCs
Traces itself to prevent debugging attempts
pid Process 1552 ub8ehJSePAfc9FYqZIT6.x86.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog ub8ehJSePAfc9FYqZIT6.x86.elf File opened for modification /bin/watchdog ub8ehJSePAfc9FYqZIT6.x86.elf -
description ioc Process File opened for reading /proc/407/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/413/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/839/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/957/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1047/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/613/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/700/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1144/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1557/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1051/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1083/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1089/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1550/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1082/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1174/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/634/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/762/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/769/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1013/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1267/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/676/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/738/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1039/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1069/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/628/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/991/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1556/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/545/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/610/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1164/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/506/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/658/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/868/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1287/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/629/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1263/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/646/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1034/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1273/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/536/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/764/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/864/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/992/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1115/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1176/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1182/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/587/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1561/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1344/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1376/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/409/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/972/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1167/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1175/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/427/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1118/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1254/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1244/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1274/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/416/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/777/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/847/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/1056/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf File opened for reading /proc/589/cmdline ub8ehJSePAfc9FYqZIT6.x86.elf