Analysis
-
max time kernel
0s -
max time network
53s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240729-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240729-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
17-01-2025 07:00
Behavioral task
behavioral1
Sample
eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf
Resource
ubuntu2204-amd64-20240729-en
ubuntu-22.04-amd64
3 signatures
150 seconds
General
-
Target
eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf
-
Size
73KB
-
MD5
a999e004765e2021a58c7f482885b6bc
-
SHA1
5afce80a370313bad25608c2f64fb68902d955c0
-
SHA256
eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f
-
SHA512
af4faa5c281a6f32e696e407ddbc5afa5eb0d109bbdf3baa151e1e12f6a00e31be08c662cc387e722d1d2dc9d2d84a5fdfc314143d09173a41334c1df580c546
-
SSDEEP
1536:aSYXBbJKbFe5AQZqOtRjX1lxQ7//S2xnLs+IJrF/DOn/YUTB/:ybIbFe5wOtB3m7XS2xLCJdinJt/
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for modification /dev/misc/watchdog eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/977/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/1283/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/8/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/9/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/18/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/101/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/527/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/98/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/199/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/688/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/1125/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/1562/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/1145/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/1162/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/1253/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/10/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/27/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/416/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/769/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/1094/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/1271/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/214/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/736/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/1561/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/19/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/586/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/958/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/1088/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/1156/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/1504/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/1568/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/204/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/377/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/723/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/732/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/937/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/1045/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/1240/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/81/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/201/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/408/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/590/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/640/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/20/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/85/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/764/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/1034/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/1374/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/1141/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/1539/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/76/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/202/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/212/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/263/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/970/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/1565/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/75/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/77/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/93/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/641/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/1105/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/740/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/783/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf File opened for reading /proc/793/cmdline eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f.elf