Analysis
-
max time kernel
149s -
max time network
129s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240522.1-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240522.1-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
03-02-2025 05:22
Behavioral task
behavioral1
Sample
boatnet.x86.elf
Resource
ubuntu2204-amd64-20240522.1-en
ubuntu-22.04-amd64
6 signatures
150 seconds
General
-
Target
boatnet.x86.elf
-
Size
20KB
-
MD5
36ef174eec017cda7f5e3b89127d18e1
-
SHA1
231d9ac3e39c7dfc64825611ca71ac89b617d19a
-
SHA256
2d5cf7e77337047b6f5b3d18127d08b17743029cb9e8511797330827f47de8f7
-
SHA512
a6aa1df06408eaec77d2b31278b9721934d8d465ee76ffb73b3da2273a489b300294c6b523e818f9010f43b0ada4bf88208bc3f79850b6c14754e3edfe834ece
-
SSDEEP
384:MgWLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oT4:O98o08kxofBE+ZkXaITbp2F2TWul0c58
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc File opened for modification /dev/watchdog File opened for modification /dev/misc/watchdog -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc File opened for modification /sbin/watchdog File opened for modification /bin/watchdog -
description ioc File opened for reading /proc/411/cmdline File opened for reading /proc/1190/cmdline File opened for reading /proc/1039/cmdline File opened for reading /proc/1070/cmdline File opened for reading /proc/1352/cmdline File opened for reading /proc/1170/cmdline File opened for reading /proc/1318/cmdline File opened for reading /proc/1054/cmdline File opened for reading /proc/766/cmdline File opened for reading /proc/789/cmdline File opened for reading /proc/731/cmdline File opened for reading /proc/1085/cmdline File opened for reading /proc/1389/cmdline File opened for reading /proc/518/cmdline File opened for reading /proc/689/cmdline File opened for reading /proc/1529/cmdline File opened for reading /proc/585/cmdline File opened for reading /proc/772/cmdline File opened for reading /proc/664/cmdline File opened for reading /proc/956/cmdline File opened for reading /proc/1034/cmdline File opened for reading /proc/1198/cmdline File opened for reading /proc/1336/cmdline File opened for reading /proc/609/cmdline File opened for reading /proc/613/cmdline File opened for reading /proc/612/cmdline File opened for reading /proc/1540/cmdline File opened for reading /proc/1158/cmdline File opened for reading /proc/1166/cmdline File opened for reading /proc/1183/cmdline File opened for reading /proc/1232/cmdline File opened for reading /proc/739/cmdline File opened for reading /proc/771/cmdline File opened for reading /proc/1257/cmdline File opened for reading /proc/1135/cmdline File opened for reading /proc/1559/cmdline File opened for reading /proc/639/cmdline File opened for reading /proc/794/cmdline File opened for reading /proc/1106/cmdline File opened for reading /proc/452/cmdline File opened for reading /proc/1178/cmdline File opened for reading /proc/1181/cmdline File opened for reading /proc/1057/cmdline File opened for reading /proc/1123/cmdline File opened for reading /proc/796/cmdline File opened for reading /proc/1448/cmdline File opened for reading /proc/408/cmdline File opened for reading /proc/633/cmdline File opened for reading /proc/1160/cmdline File opened for reading /proc/1279/cmdline File opened for reading /proc/1066/cmdline File opened for reading /proc/1493/cmdline File opened for reading /proc/521/cmdline File opened for reading /proc/735/cmdline File opened for reading /proc/682/cmdline File opened for reading /proc/1014/cmdline File opened for reading /proc/1175/cmdline File opened for reading /proc/415/cmdline File opened for reading /proc/722/cmdline File opened for reading /proc/1426/cmdline File opened for reading /proc/1555/cmdline File opened for reading /proc/992/cmdline File opened for reading /proc/1144/cmdline File opened for reading /proc/1068/cmdline