Analysis
-
max time kernel
135s -
max time network
148s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20250307-en -
resource tags
arch:amd64arch:i386image:ubuntu2404-amd64-20250307-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system -
submitted
01/04/2025, 03:03
Behavioral task
behavioral1
Sample
ub8ehJSePAfc9FYqZIT6.x86_64.elf
Resource
ubuntu2404-amd64-20250307-en
ubuntu-24.04-amd64
6 signatures
150 seconds
General
-
Target
ub8ehJSePAfc9FYqZIT6.x86_64.elf
-
Size
36KB
-
MD5
bd2e05897033fc35109d20da6c3771b0
-
SHA1
42ad14dbd0fbecefa36e311cf079df742a314caa
-
SHA256
4572a23b7279591e36420a39899e63b236eab041e317a94a16dda43e4f2b36fa
-
SHA512
883fbc08403223ddf2679a356ac526bc2d6c46dc342ba2650a4dc7b892db8179e2cafdced709df48c5a5ff03bbd43d5ad1316285706816a69260ed3e54aead08
-
SSDEEP
768:u+4qtvWUAASUOJCQ28QG4CSXLCDjU2ejus6Rg8eU8CWx0L:t9tvWrASUOJZS2jUiRgjUEC
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for modification /dev/misc/watchdog ub8ehJSePAfc9FYqZIT6.x86_64.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for modification /bin/watchdog ub8ehJSePAfc9FYqZIT6.x86_64.elf -
description ioc Process File opened for reading /proc/761/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/773/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/1879/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/1981/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/1996/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/2185/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/38/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/70/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/198/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/782/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/1024/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/1256/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/1946/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/2019/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/1/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/9/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/10/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/195/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/1748/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/2036/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/2059/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/2283/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/4/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/13/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/1889/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/2293/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/2294/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/2503/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/2560/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/2563/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/6/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/48/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/235/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/584/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/1870/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/2383/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/19/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/338/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/2372/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/18/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/65/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/1292/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/2332/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/2387/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/3/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/1061/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/37/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/438/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/790/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/1017/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/1038/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/1921/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/1999/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/1009/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/26/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/30/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/51/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/181/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/760/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/1855/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/2008/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/45/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/199/status ub8ehJSePAfc9FYqZIT6.x86_64.elf File opened for reading /proc/511/status ub8ehJSePAfc9FYqZIT6.x86_64.elf