Analysis
-
max time kernel
149s -
max time network
132s -
platform
debian-12_armhf -
resource
debian12-armhf-20240221-en -
resource tags
arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
16-01-2025 02:48
Behavioral task
behavioral1
Sample
6036c270c86bcbf4c5fb6cd1369abc51e1e16e1e93024d66f43375d0424154fa.elf
Resource
debian12-armhf-20240221-en
debian-12-armhf
6 signatures
150 seconds
General
-
Target
6036c270c86bcbf4c5fb6cd1369abc51e1e16e1e93024d66f43375d0424154fa.elf
-
Size
39KB
-
MD5
76066fdc5b1d4dbebee4d4994349bacc
-
SHA1
86129514917b7e8f231024ebd60b475b000b38f7
-
SHA256
6036c270c86bcbf4c5fb6cd1369abc51e1e16e1e93024d66f43375d0424154fa
-
SHA512
33d003dfe3c0e3431cf97f9b405747c643ec754d0960d1271d7b3fb1342a5e4ba799930c588e4090d98a9667f39ceef050b233ab4ea9b6931537a271af11171c
-
SSDEEP
768:1eCg7FkMe9VToKaaRtxbGcxwtxXB79q3UEL7oAKnZx/7mPFFrP6Q6Z:1eCQFbe9VMKNxb8tmLzqWFr6Z
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 6036c270c86bcbf4c5fb6cd1369abc51e1e16e1e93024d66f43375d0424154fa.elf File opened for modification /dev/misc/watchdog 6036c270c86bcbf4c5fb6cd1369abc51e1e16e1e93024d66f43375d0424154fa.elf -
Traces itself 1 IoCs
Traces itself to prevent debugging attempts
pid Process 705 6036c270c86bcbf4c5fb6cd1369abc51e1e16e1e93024d66f43375d0424154fa.elf -
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 6036c270c86bcbf4c5fb6cd1369abc51e1e16e1e93024d66f43375d0424154fa.elf File opened for modification /bin/watchdog 6036c270c86bcbf4c5fb6cd1369abc51e1e16e1e93024d66f43375d0424154fa.elf -
description ioc Process File opened for reading /proc/712/cmdline 6036c270c86bcbf4c5fb6cd1369abc51e1e16e1e93024d66f43375d0424154fa.elf File opened for reading /proc/711/cmdline 6036c270c86bcbf4c5fb6cd1369abc51e1e16e1e93024d66f43375d0424154fa.elf File opened for reading /proc/636/cmdline 6036c270c86bcbf4c5fb6cd1369abc51e1e16e1e93024d66f43375d0424154fa.elf File opened for reading /proc/self/exe 6036c270c86bcbf4c5fb6cd1369abc51e1e16e1e93024d66f43375d0424154fa.elf File opened for reading /proc/492/cmdline 6036c270c86bcbf4c5fb6cd1369abc51e1e16e1e93024d66f43375d0424154fa.elf File opened for reading /proc/637/cmdline 6036c270c86bcbf4c5fb6cd1369abc51e1e16e1e93024d66f43375d0424154fa.elf File opened for reading /proc/665/cmdline 6036c270c86bcbf4c5fb6cd1369abc51e1e16e1e93024d66f43375d0424154fa.elf File opened for reading /proc/698/cmdline 6036c270c86bcbf4c5fb6cd1369abc51e1e16e1e93024d66f43375d0424154fa.elf File opened for reading /proc/703/cmdline 6036c270c86bcbf4c5fb6cd1369abc51e1e16e1e93024d66f43375d0424154fa.elf File opened for reading /proc/485/cmdline 6036c270c86bcbf4c5fb6cd1369abc51e1e16e1e93024d66f43375d0424154fa.elf File opened for reading /proc/702/cmdline 6036c270c86bcbf4c5fb6cd1369abc51e1e16e1e93024d66f43375d0424154fa.elf File opened for reading /proc/710/cmdline 6036c270c86bcbf4c5fb6cd1369abc51e1e16e1e93024d66f43375d0424154fa.elf File opened for reading /proc/761/cmdline 6036c270c86bcbf4c5fb6cd1369abc51e1e16e1e93024d66f43375d0424154fa.elf File opened for reading /proc/680/cmdline 6036c270c86bcbf4c5fb6cd1369abc51e1e16e1e93024d66f43375d0424154fa.elf