Analysis
-
max time kernel
149s -
max time network
9s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
16-01-2025 03:08
Behavioral task
behavioral1
Sample
90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
6 signatures
150 seconds
General
-
Target
90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c.elf
-
Size
21KB
-
MD5
fc95c5a4d7d9c1e178a8e80e090b8905
-
SHA1
5fb56e634e84971799b2669d4ccea3b8fc33411b
-
SHA256
90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c
-
SHA512
f6314e069f33beff7489022f0a0c297d72598bbd7bfbfbc4139ec834a46d0caf1a2368bf5f5a3e38865a0da8d79d06f366cbfdbac465e2f7b67cf20f9b1224b2
-
SSDEEP
384:UvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjAghymdGUop5hn:UvQn4j+ZO5fKAlxcgs3Uozl
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c.elf File opened for modification /dev/misc/watchdog 90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c.elf File opened for modification /bin/watchdog 90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c.elf -
description ioc Process File opened for reading /proc/761/cmdline 90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c.elf File opened for reading /proc/462/cmdline 90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c.elf File opened for reading /proc/605/cmdline 90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c.elf File opened for reading /proc/642/cmdline 90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c.elf File opened for reading /proc/680/cmdline 90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c.elf File opened for reading /proc/741/cmdline 90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c.elf File opened for reading /proc/747/cmdline 90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c.elf File opened for reading /proc/self/exe 90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c.elf File opened for reading /proc/401/cmdline 90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c.elf File opened for reading /proc/643/cmdline 90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c.elf File opened for reading /proc/649/cmdline 90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c.elf File opened for reading /proc/708/cmdline 90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c.elf File opened for reading /proc/694/cmdline 90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c.elf File opened for reading /proc/700/cmdline 90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c.elf File opened for reading /proc/762/cmdline 90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c.elf File opened for reading /proc/766/cmdline 90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c.elf File opened for reading /proc/770/cmdline 90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c.elf File opened for reading /proc/656/cmdline 90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c.elf File opened for reading /proc/779/cmdline 90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c.elf File opened for reading /proc/783/cmdline 90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c.elf File opened for reading /proc/775/cmdline 90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c.elf File opened for reading /proc/648/cmdline 90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c.elf File opened for reading /proc/658/cmdline 90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c.elf File opened for reading /proc/668/cmdline 90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c.elf File opened for reading /proc/713/cmdline 90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c.elf File opened for reading /proc/752/cmdline 90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c.elf File opened for reading /proc/647/cmdline 90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c.elf File opened for reading /proc/653/cmdline 90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c.elf File opened for reading /proc/725/cmdline 90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c.elf File opened for reading /proc/772/cmdline 90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c.elf File opened for reading /proc/777/cmdline 90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c.elf File opened for reading /proc/785/cmdline 90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c.elf File opened for reading /proc/787/cmdline 90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c.elf File opened for reading /proc/414/cmdline 90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c.elf File opened for reading /proc/461/cmdline 90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c.elf File opened for reading /proc/724/cmdline 90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c.elf File opened for reading /proc/768/cmdline 90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c.elf File opened for reading /proc/781/cmdline 90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c.elf File opened for reading /proc/717/cmdline 90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c.elf File opened for reading /proc/774/cmdline 90d6eda71edf95d4725c5964e91f20773216f2a3fd2612f622c84f9882f8d76c.elf