Analysis
- max time kernel
148s - max time network
155s - platform
debian-12_mipsel - resource
debian12-mipsel-20250619-en - resource tags
arch:mipselimage:debian12-mipsel-20250619-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem - submitted
04/12/2025, 06:32
Behavioral task
behavioral1
Sample
ub8ehJSePAfc9FYqZIT6.mpsl.elf
Resource
debian12-mipsel-20250619-en
debian-12-mipsel
6 signatures
150 seconds
General
- Target ub8ehJSePAfc9FYqZIT6.mpsl.elf
- Size 37KB
- Sample251204-hatb6aej9y
- SHA256 436962fa88d60ef9cd91886d4fa31d8868c72fca45eea552d9a8bbe5a30fb3a7
- MD5 8d9d938cf6c433f56f6459cc8536ae16
- SHA1 7d992925cccce845cae49e1c2fe8b60685f18398
- SHA512 83300bc111da88a3ab37e08300a4fa746dc36319c8f11474804b8c6a3477855526821361ecb5be50f0e6a77d3e98b43f4f0a4d2797fa77b90f48d50ecd62cc56
- SSDEEP 768:CF4o5gt3IEG6Ks1mqDUKf+8hr89kxcEDV/SLXQlov0zBZLvad4mwu0FrzWW:El5JnsrXvrKy9QjyBZLvDmR0Fr7
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
mirai
Botnet
-
LZRD
Signatures
- Mirai family
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for modification /dev/misc/watchdog ub8ehJSePAfc9FYqZIT6.mpsl.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for modification /bin/watchdog ub8ehJSePAfc9FYqZIT6.mpsl.elf -
description ioc Process File opened for reading /proc/112/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/138/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/202/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/31/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/110/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/385/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/419/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/764/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/137/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/388/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/705/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/24/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/258/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/699/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/799/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/805/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/10/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/20/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/111/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/363/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/761/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/762/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/53/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/119/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/179/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/27/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/22/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/23/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/33/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/395/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/15/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/29/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/117/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/370/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/677/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/775/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/797/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/7/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/8/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/11/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/17/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/30/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/47/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/48/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/812/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/35/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/37/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/58/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/806/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/2/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/3/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/5/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/12/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/393/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/802/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/811/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/16/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/34/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/59/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/372/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/14/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/21/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/25/status ub8ehJSePAfc9FYqZIT6.mpsl.elf File opened for reading /proc/32/status ub8ehJSePAfc9FYqZIT6.mpsl.elf