Analysis
-
max time kernel
149s -
max time network
128s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
30-01-2025 03:43
Behavioral task
behavioral1
Sample
f4ce9770558764339cce8d8f8d334c2a36849a9d7b773b5aa8583cdfdf9fdf3f.elf
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
6 signatures
150 seconds
General
-
Target
f4ce9770558764339cce8d8f8d334c2a36849a9d7b773b5aa8583cdfdf9fdf3f.elf
-
Size
21KB
-
MD5
2be0ffbd739e3310964dfd237b27a5cb
-
SHA1
a9fc0a34c6d673215c92b2d784b222a34a365cfe
-
SHA256
f4ce9770558764339cce8d8f8d334c2a36849a9d7b773b5aa8583cdfdf9fdf3f
-
SHA512
f7aaf9c3dbe047b7fbfd5bcb90d8c38184da7798d0f8b0f9b1fb97c28e606cdada5a7d7da906748c32af4a61fdd5291111ac4d5ff677bd01618b59bad421cb3c
-
SSDEEP
384:MGbrJRQKbj8s/qPGajVhXLGj9OP6uX3mK7tSAv/Ojgv2h/j8e80Rceq5+7Sybh:Dhn8oDoVlGjcCO3VRHmjhxBq+Bbh
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc File opened for modification /dev/misc/watchdog File opened for modification /dev/watchdog -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc File opened for modification /sbin/watchdog File opened for modification /bin/watchdog -
description ioc File opened for reading /proc/1238/cmdline File opened for reading /proc/1352/cmdline File opened for reading /proc/413/cmdline File opened for reading /proc/1038/cmdline File opened for reading /proc/870/cmdline File opened for reading /proc/1163/cmdline File opened for reading /proc/1570/cmdline File opened for reading /proc/586/cmdline File opened for reading /proc/1507/cmdline File opened for reading /proc/1434/cmdline File opened for reading /proc/1569/cmdline File opened for reading /proc/607/cmdline File opened for reading /proc/675/cmdline File opened for reading /proc/409/cmdline File opened for reading /proc/499/cmdline File opened for reading /proc/747/cmdline File opened for reading /proc/866/cmdline File opened for reading /proc/1160/cmdline File opened for reading /proc/1165/cmdline File opened for reading /proc/517/cmdline File opened for reading /proc/590/cmdline File opened for reading /proc/781/cmdline File opened for reading /proc/635/cmdline File opened for reading /proc/1158/cmdline File opened for reading /proc/1248/cmdline File opened for reading /proc/1487/cmdline File opened for reading /proc/454/cmdline File opened for reading /proc/594/cmdline File opened for reading /proc/1157/cmdline File opened for reading /proc/1013/cmdline File opened for reading /proc/1054/cmdline File opened for reading /proc/1344/cmdline File opened for reading /proc/1554/cmdline File opened for reading /proc/742/cmdline File opened for reading /proc/771/cmdline File opened for reading /proc/1091/cmdline File opened for reading /proc/1228/cmdline File opened for reading /proc/1372/cmdline File opened for reading /proc/614/cmdline File opened for reading /proc/636/cmdline File opened for reading /proc/634/cmdline File opened for reading /proc/991/cmdline File opened for reading /proc/1044/cmdline File opened for reading /proc/1166/cmdline File opened for reading /proc/1170/cmdline File opened for reading /proc/1222/cmdline File opened for reading /proc/746/cmdline File opened for reading /proc/837/cmdline File opened for reading /proc/1197/cmdline File opened for reading /proc/1254/cmdline File opened for reading /proc/640/cmdline File opened for reading /proc/1142/cmdline File opened for reading /proc/1098/cmdline File opened for reading /proc/1184/cmdline File opened for reading /proc/1192/cmdline File opened for reading /proc/589/cmdline File opened for reading /proc/1053/cmdline File opened for reading /proc/1543/cmdline File opened for reading /proc/1261/cmdline File opened for reading /proc/1452/cmdline File opened for reading /proc/1555/cmdline File opened for reading /proc/1114/cmdline File opened for reading /proc/1280/cmdline File opened for reading /proc/845/cmdline