Analysis
-
max time kernel
149s -
max time network
128s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20240729-en -
resource tags
arch:amd64arch:i386image:ubuntu2404-amd64-20240729-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system -
submitted
24-01-2025 22:03
Behavioral task
behavioral1
Sample
night.x86_64.elf
Resource
ubuntu2404-amd64-20240729-en
ubuntu-24.04-amd64
6 signatures
150 seconds
General
-
Target
night.x86_64.elf
-
Size
31KB
-
MD5
c082f5b58ec1b2e7c88ce9f0eb0dceba
-
SHA1
de72ee895a47cd59162f1280f963bf0eea74adfa
-
SHA256
979cc95e6b2ff5edaa5ceced00b304ce39ca825d872ffbf6996b2168595ecb9f
-
SHA512
eda8a6c4929a0f9868ebab938d28ae36616073d9e92fe399afe77831ae400d38715744d12f6bfde3cbb02cd726bccd95ea3796dbea9cf58bc933f32488c84d0f
-
SSDEEP
768:iAGs1DDudwSC64ADv1p0LXevxHQVhrC+E8Oix070:tjSJ9BC6H4bHO0
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog night.x86_64.elf File opened for modification /dev/misc/watchdog night.x86_64.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog night.x86_64.elf File opened for modification /bin/watchdog night.x86_64.elf -
description ioc Process File opened for reading /proc/757/cmdline night.x86_64.elf File opened for reading /proc/1991/cmdline night.x86_64.elf File opened for reading /proc/1994/cmdline night.x86_64.elf File opened for reading /proc/2495/cmdline night.x86_64.elf File opened for reading /proc/785/cmdline night.x86_64.elf File opened for reading /proc/1059/cmdline night.x86_64.elf File opened for reading /proc/1067/cmdline night.x86_64.elf File opened for reading /proc/1982/cmdline night.x86_64.elf File opened for reading /proc/2008/cmdline night.x86_64.elf File opened for reading /proc/2207/cmdline night.x86_64.elf File opened for reading /proc/2245/cmdline night.x86_64.elf File opened for reading /proc/2531/cmdline night.x86_64.elf File opened for reading /proc/2316/cmdline night.x86_64.elf File opened for reading /proc/597/cmdline night.x86_64.elf File opened for reading /proc/1121/cmdline night.x86_64.elf File opened for reading /proc/2064/cmdline night.x86_64.elf File opened for reading /proc/2139/cmdline night.x86_64.elf File opened for reading /proc/1261/cmdline night.x86_64.elf File opened for reading /proc/1925/cmdline night.x86_64.elf File opened for reading /proc/2220/cmdline night.x86_64.elf File opened for reading /proc/1819/cmdline night.x86_64.elf File opened for reading /proc/588/cmdline night.x86_64.elf File opened for reading /proc/1344/cmdline night.x86_64.elf File opened for reading /proc/2098/cmdline night.x86_64.elf File opened for reading /proc/2159/cmdline night.x86_64.elf File opened for reading /proc/2213/cmdline night.x86_64.elf File opened for reading /proc/2290/cmdline night.x86_64.elf File opened for reading /proc/2502/cmdline night.x86_64.elf File opened for reading /proc/1718/cmdline night.x86_64.elf File opened for reading /proc/1974/cmdline night.x86_64.elf File opened for reading /proc/2003/cmdline night.x86_64.elf File opened for reading /proc/2226/cmdline night.x86_64.elf File opened for reading /proc/1876/cmdline night.x86_64.elf File opened for reading /proc/2039/cmdline night.x86_64.elf File opened for reading /proc/2255/cmdline night.x86_64.elf File opened for reading /proc/2304/cmdline night.x86_64.elf File opened for reading /proc/1705/cmdline night.x86_64.elf File opened for reading /proc/2156/cmdline night.x86_64.elf File opened for reading /proc/1710/cmdline night.x86_64.elf File opened for reading /proc/2110/cmdline night.x86_64.elf File opened for reading /proc/457/cmdline night.x86_64.elf File opened for reading /proc/1049/cmdline night.x86_64.elf File opened for reading /proc/816/cmdline night.x86_64.elf File opened for reading /proc/1076/cmdline night.x86_64.elf File opened for reading /proc/1700/cmdline night.x86_64.elf File opened for reading /proc/1951/cmdline night.x86_64.elf File opened for reading /proc/2038/cmdline night.x86_64.elf File opened for reading /proc/2263/cmdline night.x86_64.elf File opened for reading /proc/2435/cmdline night.x86_64.elf File opened for reading /proc/790/cmdline night.x86_64.elf File opened for reading /proc/1092/cmdline night.x86_64.elf File opened for reading /proc/1123/cmdline night.x86_64.elf File opened for reading /proc/1898/cmdline night.x86_64.elf File opened for reading /proc/1956/cmdline night.x86_64.elf File opened for reading /proc/2493/cmdline night.x86_64.elf File opened for reading /proc/599/cmdline night.x86_64.elf File opened for reading /proc/778/cmdline night.x86_64.elf File opened for reading /proc/814/cmdline night.x86_64.elf File opened for reading /proc/1792/cmdline night.x86_64.elf File opened for reading /proc/1921/cmdline night.x86_64.elf File opened for reading /proc/1055/cmdline night.x86_64.elf File opened for reading /proc/1124/cmdline night.x86_64.elf File opened for reading /proc/1900/cmdline night.x86_64.elf File opened for reading /proc/2116/cmdline night.x86_64.elf