Analysis
-
max time kernel
149s -
max time network
9s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
16-01-2025 02:45
Behavioral task
behavioral1
Sample
574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
7 signatures
150 seconds
General
-
Target
574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf
-
Size
46KB
-
MD5
a38ea5dfea817b3e4a2d500556eb3c63
-
SHA1
b87b837df3fe9b468f054a99bd703e93fe46c601
-
SHA256
574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967
-
SHA512
d9cc096e5b1294b4e60cc2adc83b8c1a79ca7b6cd9b52d626f430803bd459a7cd94e465ecad67b88c1d1891aa1d7c5bbed3ee121a30a7b90d2aab99847949b4d
-
SSDEEP
768:hQB89QHj+4rFPUtN8P50LdleKzKvB+WQCpirXEAk+81NnkwZs3UozDx:hA3D+4ZPUX8PaWK0B+OOXfp81NnMzDx
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for modification /dev/misc/watchdog 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf -
Traces itself 1 IoCs
Traces itself to prevent debugging attempts
pid Process 661 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for modification /bin/watchdog 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf -
description ioc Process File opened for reading /proc/664/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/672/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/740/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/762/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/763/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/442/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/657/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/768/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/781/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/785/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/789/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/710/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/756/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/703/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/745/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/783/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/795/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/797/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/self/exe 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/659/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/716/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/787/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/791/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/650/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/665/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/702/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/717/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/736/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/779/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/793/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/667/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/696/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/724/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/728/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/733/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/775/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/438/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/690/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/798/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/651/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/777/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/660/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/746/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/757/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/769/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/790/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/613/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf File opened for reading /proc/658/cmdline 574302ca20d153fbfe0fff36380ae7b119eaa5694b0d390996f8913c3af4c967.elf