Analysis
-
max time kernel
149s -
max time network
135s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20241127-en -
resource tags
arch:amd64arch:i386image:ubuntu2004-amd64-20241127-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system -
submitted
20-01-2025 02:01
Behavioral task
behavioral1
Sample
05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf
Resource
ubuntu2004-amd64-20241127-en
ubuntu-20.04-amd64
6 signatures
150 seconds
General
-
Target
05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf
-
Size
29KB
-
MD5
3fc96545548025bcbd0277799269fc56
-
SHA1
f9377264f4a4b6f41b3e85fe67d2f5e660184b3e
-
SHA256
05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c
-
SHA512
9a1e94900ca4368192f3931847824cd2bb2bf928fcbcaea3197d90e0814dadba3a1258ad2f593f00c8036017bc49fd68369d8e2e32238f5903c5e30016d8b5d1
-
SSDEEP
768:qzMioRCNCbSRVmFspQa/bXaAgaO850fE5E2vHnbcuyD7UoQRj4:ScIRshSXaAgaO850ynouy8oyM
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for modification /dev/misc/watchdog 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for modification /bin/watchdog 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf -
description ioc Process File opened for reading /proc/636/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/1119/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/489/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/547/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/805/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/1092/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/488/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/1325/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/1396/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/533/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/967/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/1002/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/452/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/679/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/1145/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/1334/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/454/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/1398/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/1339/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/1093/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/1105/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/1203/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/1329/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/1076/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/751/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/803/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/813/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/960/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/1024/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/1094/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/453/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/1326/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/1177/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/832/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/1331/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/1333/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/441/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/925/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/982/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/1088/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/401/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/949/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/1055/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/1107/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/1330/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/945/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/1085/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/954/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/1114/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/1392/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/508/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/516/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/773/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/898/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/1084/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/1447/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/440/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/1391/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/562/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/618/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/639/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/806/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/559/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf File opened for reading /proc/1038/cmdline 05541f50057a9eb86c2391be07c968453e00f63c1def17b659cfa30f981d8c2c.elf