Analysis
-
max time kernel
149s -
max time network
129s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240522.1-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240522.1-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
18-01-2025 05:17
Behavioral task
behavioral1
Sample
eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf
Resource
ubuntu2204-amd64-20240522.1-en
ubuntu-22.04-amd64
6 signatures
150 seconds
General
-
Target
eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf
-
Size
31KB
-
MD5
7d0e58794721924425ff5e29bbf821ae
-
SHA1
4d31cbee7a8f5cbb1d7b603a452b2f4d51b2068a
-
SHA256
eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008
-
SHA512
71bbc125c2df316c0878d83d822c0220bc460d46a1eda360022ecf8e87a6efe7cb9e15e6c18faa519f5c3509a3c24c5f60dbc78b2e299014f34aea7913e8b32c
-
SSDEEP
768:y+T4bCNmgZ6Em3fpqGTSNOvh/f0l4LzPzlJCcRelRSeoDrCH/ThJNkM3:y+TmCF6xqGKQ4Qjejh4rO/T7GM3
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for modification /dev/misc/watchdog eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for modification /bin/watchdog eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf -
description ioc Process File opened for reading /proc/1259/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/1269/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/629/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/760/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/860/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/735/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/972/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/1158/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/1134/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/1147/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/1213/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/1235/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/425/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/762/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/829/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/1208/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/1211/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/1169/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/1174/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/1218/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/1241/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/830/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/984/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/1127/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/1382/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/1437/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/1548/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/1059/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/1096/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/1143/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/1499/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/411/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/501/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/1063/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/1076/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/1336/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/1108/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/426/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/631/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/768/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/452/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/630/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/963/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/991/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/1085/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/1219/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/1334/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/586/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/613/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/632/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/1440/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/748/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/1080/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/1166/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/868/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/1094/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/1412/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/1549/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/408/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/590/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/656/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/679/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/1167/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf File opened for reading /proc/1244/cmdline eee4c4030b37dcb39407239fb350d781d363d8e4d1d2f3a4d857849966820008.elf