Analysis
-
max time kernel
137s -
max time network
129s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20250307-en -
resource tags
arch:amd64arch:i386image:ubuntu2404-amd64-20250307-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system -
submitted
02/04/2025, 01:36
Behavioral task
behavioral1
Sample
eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0
Resource
ubuntu2404-amd64-20250307-en
ubuntu-24.04-amd64
6 signatures
150 seconds
General
-
Target
eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0
-
Size
60KB
-
MD5
832cf70f7a142ed654804c15171f1dad
-
SHA1
c4a13abe90eb0ecd706bf89e48322ad618d7b5f9
-
SHA256
eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0
-
SHA512
1b5c6b124db22c3705eb25ea9c209986c6d931907554b95e7a9a34469d8760d127cc6dc17134d1f1e7e94b4ef0364088b3e1a43bf19843d450a100818e98b073
-
SSDEEP
1536:6aF8D+xVQ7aUFMFUkEFarag8CMrkM7InwIafF+XVgq:6as+xm7aUO1EUaSxytFs
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for modification /dev/misc/watchdog eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for modification /bin/watchdog eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 -
description ioc Process File opened for reading /proc/2516/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/2515/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/1000/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/1070/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/1824/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/1987/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/2293/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/2341/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/1738/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/1854/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/1969/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/2009/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/2266/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/783/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/1432/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/1719/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/1852/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/1966/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/2007/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/2242/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/2253/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/1024/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/1220/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/414/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/2239/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/1990/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/2272/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/796/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/1064/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/1817/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/1932/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/1997/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/830/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/2179/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/2236/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/998/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/2008/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/2010/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/2145/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/587/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/798/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/512/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/1832/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/1956/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/1973/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/761/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/762/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/1037/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/1292/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/1960/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/1431/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/2190/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/772/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/422/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/795/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/1944/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/2457/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/2527/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/2299/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/1730/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/2076/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/2284/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/1908/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0 File opened for reading /proc/1971/cmdline eb394bf9755e417701235fccb542807296c690850630f0391df175a2a872b3d0