Analysis
-
max time kernel
149s -
max time network
8s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240611-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
21-01-2025 10:56
Behavioral task
behavioral1
Sample
193.200.78.24-boatnet.mips-2025-01-21T101458.elf
Resource
debian9-mipsbe-20240611-en
General
-
Target
193.200.78.24-boatnet.mips-2025-01-21T101458.elf
-
Size
23KB
-
MD5
419af9271063995aa7d8e36f7b9431cc
-
SHA1
048cefabc4702f4f301aba13a453592f862dac99
-
SHA256
7361c9bd5f6688bc9de5c6bd9ca7164edb537ccb08aa9c7522a620d4f410fba1
-
SHA512
eae11b558875bcd46845788e7b0a84ce9c97b80aa4909e34412bb9b9db449bd418421f14db3436adc53483737d21fe69b27a57f2098b24e27d0803d5fe01aa52
-
SSDEEP
384:YeD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtuivmdtJgGlzDpH7uNj1JA4V:YeD8ZSWvZHZbs1row697qohQvg9vitJO
Malware Config
Extracted
mirai
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 193.200.78.24-boatnet.mips-2025-01-21T101458.elf File opened for modification /dev/misc/watchdog 193.200.78.24-boatnet.mips-2025-01-21T101458.elf -
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 193.200.78.24-boatnet.mips-2025-01-21T101458.elf File opened for modification /bin/watchdog 193.200.78.24-boatnet.mips-2025-01-21T101458.elf -
description ioc Process File opened for reading /proc/702/cmdline 193.200.78.24-boatnet.mips-2025-01-21T101458.elf File opened for reading /proc/716/cmdline 193.200.78.24-boatnet.mips-2025-01-21T101458.elf File opened for reading /proc/717/cmdline 193.200.78.24-boatnet.mips-2025-01-21T101458.elf File opened for reading /proc/754/cmdline 193.200.78.24-boatnet.mips-2025-01-21T101458.elf File opened for reading /proc/787/cmdline 193.200.78.24-boatnet.mips-2025-01-21T101458.elf File opened for reading /proc/777/cmdline 193.200.78.24-boatnet.mips-2025-01-21T101458.elf File opened for reading /proc/783/cmdline 193.200.78.24-boatnet.mips-2025-01-21T101458.elf File opened for reading /proc/414/cmdline 193.200.78.24-boatnet.mips-2025-01-21T101458.elf File opened for reading /proc/668/cmdline 193.200.78.24-boatnet.mips-2025-01-21T101458.elf File opened for reading /proc/687/cmdline 193.200.78.24-boatnet.mips-2025-01-21T101458.elf File opened for reading /proc/771/cmdline 193.200.78.24-boatnet.mips-2025-01-21T101458.elf File opened for reading /proc/775/cmdline 193.200.78.24-boatnet.mips-2025-01-21T101458.elf File opened for reading /proc/813/cmdline 193.200.78.24-boatnet.mips-2025-01-21T101458.elf File opened for reading /proc/677/cmdline 193.200.78.24-boatnet.mips-2025-01-21T101458.elf File opened for reading /proc/678/cmdline 193.200.78.24-boatnet.mips-2025-01-21T101458.elf File opened for reading /proc/703/cmdline 193.200.78.24-boatnet.mips-2025-01-21T101458.elf File opened for reading /proc/714/cmdline 193.200.78.24-boatnet.mips-2025-01-21T101458.elf File opened for reading /proc/738/cmdline 193.200.78.24-boatnet.mips-2025-01-21T101458.elf File opened for reading /proc/671/cmdline 193.200.78.24-boatnet.mips-2025-01-21T101458.elf File opened for reading /proc/707/cmdline 193.200.78.24-boatnet.mips-2025-01-21T101458.elf File opened for reading /proc/708/cmdline 193.200.78.24-boatnet.mips-2025-01-21T101458.elf File opened for reading /proc/709/cmdline 193.200.78.24-boatnet.mips-2025-01-21T101458.elf File opened for reading /proc/744/cmdline 193.200.78.24-boatnet.mips-2025-01-21T101458.elf -
System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 710 193.200.78.24-boatnet.mips-2025-01-21T101458.elf