Analysis
-
max time kernel
149s -
max time network
129s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240522.1-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240522.1-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
16-01-2025 02:38
Behavioral task
behavioral1
Sample
43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf
Resource
ubuntu2204-amd64-20240522.1-en
ubuntu-22.04-amd64
7 signatures
150 seconds
General
-
Target
43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf
-
Size
17KB
-
MD5
eadf195933f9d4ba0fc3687b56fcf912
-
SHA1
a0b4328d78fb5746529d2f5e1db26e1074013a58
-
SHA256
43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e
-
SHA512
dd8aefa57936685c0aca304777fb7cf8e20fe1760e0c795981e9091946a6c4928dc0416593e3ab831eca5db2e8b0b089f786ab74cef52c2a32f7d0373227ffb9
-
SSDEEP
384:llWw+Jg28pCVYNFZIpU4RiRvmxPlPtAutTWcaiFqcJ0y:mw+VGZh4GvIWbsCy
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for modification /dev/misc/watchdog 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf -
Traces itself 1 IoCs
Traces itself to prevent debugging attempts
pid Process 1566 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for modification /bin/watchdog 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf -
description ioc Process File opened for reading /proc/589/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/1507/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/1167/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/748/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/775/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/963/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/1066/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/608/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/612/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/1136/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/846/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/1108/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/1177/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/1440/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/408/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/413/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/416/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/588/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/1129/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/1554/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/751/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/786/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/1017/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/1058/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/1249/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/426/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/1042/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/1186/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/1239/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/866/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/972/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/1297/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/664/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/1289/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/1453/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/1216/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/1570/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/749/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/957/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/1162/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/700/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/1181/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/1294/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/415/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/771/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/1160/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/1555/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/1100/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/1164/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/1171/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/1179/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/1387/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/1571/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/848/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/1048/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/1166/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/1569/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/635/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/1187/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/1255/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/634/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/1057/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/1076/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf File opened for reading /proc/633/cmdline 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e.elf