Analysis
- max time kernel
149s - max time network
128s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260127-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260127-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
05/04/2026, 05:15
Behavioral task
behavioral1
Sample
boatnet.x86_64.elf
Resource
ubuntu1804-amd64-20260127-en
ubuntu-18.04-amd64
6 signatures
150 seconds
General
- Target boatnet.x86_64.elf
- Size 22KB
- Sample260405-fxsysse14z
- SHA256 0eec972341affce434bb697a0918a7c40bb76c693bdbb01bc46c17393e26b6cc
- MD5 01ca6f88d37733046800de1f7373fe5a
- SHA1 ea5ef1b0da7951482dd4cdc42b724780ee4339e2
- SHA512 21102c2ac39b86935c9a9539f536c616e36a8fd480cd89d6bc91a8397b8aeafa5af4c6ba1a042eff8a8f60ea3611e43ca2e0000bfa868ed706414579cffbb7f4
- SSDEEP 384:TDYC95A2rM7RjFrvX2V6H2XJ8LaHYsbX1chiM4HhBJhpExUC03uhHB3QJmRxx+cj:TDZ5Dw7RjFjcU+O24sDS4HhrhpEguX39
- TLSH T1D2A2E17DFB20C18CF086847E2957127B456FF8A64B98420E6E15D0C701C3ADEE49AEB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
Botnet
-
LZRD
Signatures
- Mirai family
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog boatnet.x86_64.elf File opened for modification /dev/misc/watchdog boatnet.x86_64.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog boatnet.x86_64.elf File opened for modification /bin/watchdog boatnet.x86_64.elf -
description ioc Process File opened for reading /proc/1006/cmdline boatnet.x86_64.elf File opened for reading /proc/1055/cmdline boatnet.x86_64.elf File opened for reading /proc/1088/cmdline boatnet.x86_64.elf File opened for reading /proc/1637/cmdline boatnet.x86_64.elf File opened for reading /proc/1643/cmdline boatnet.x86_64.elf File opened for reading /proc/469/cmdline boatnet.x86_64.elf File opened for reading /proc/1028/cmdline boatnet.x86_64.elf File opened for reading /proc/1048/cmdline boatnet.x86_64.elf File opened for reading /proc/1572/cmdline boatnet.x86_64.elf File opened for reading /proc/1616/cmdline boatnet.x86_64.elf File opened for reading /proc/664/cmdline boatnet.x86_64.elf File opened for reading /proc/975/cmdline boatnet.x86_64.elf File opened for reading /proc/1050/cmdline boatnet.x86_64.elf File opened for reading /proc/1252/cmdline boatnet.x86_64.elf File opened for reading /proc/1549/cmdline boatnet.x86_64.elf File opened for reading /proc/477/cmdline boatnet.x86_64.elf File opened for reading /proc/720/cmdline boatnet.x86_64.elf File opened for reading /proc/967/cmdline boatnet.x86_64.elf File opened for reading /proc/1032/cmdline boatnet.x86_64.elf File opened for reading /proc/1135/cmdline boatnet.x86_64.elf File opened for reading /proc/995/cmdline boatnet.x86_64.elf File opened for reading /proc/1148/cmdline boatnet.x86_64.elf File opened for reading /proc/1191/cmdline boatnet.x86_64.elf File opened for reading /proc/1655/cmdline boatnet.x86_64.elf File opened for reading /proc/413/cmdline boatnet.x86_64.elf File opened for reading /proc/468/cmdline boatnet.x86_64.elf File opened for reading /proc/478/cmdline boatnet.x86_64.elf File opened for reading /proc/492/cmdline boatnet.x86_64.elf File opened for reading /proc/530/cmdline boatnet.x86_64.elf File opened for reading /proc/689/cmdline boatnet.x86_64.elf File opened for reading /proc/730/cmdline boatnet.x86_64.elf File opened for reading /proc/1036/cmdline boatnet.x86_64.elf File opened for reading /proc/448/cmdline boatnet.x86_64.elf File opened for reading /proc/479/cmdline boatnet.x86_64.elf File opened for reading /proc/580/cmdline boatnet.x86_64.elf File opened for reading /proc/907/cmdline boatnet.x86_64.elf File opened for reading /proc/1064/cmdline boatnet.x86_64.elf File opened for reading /proc/1067/cmdline boatnet.x86_64.elf File opened for reading /proc/1076/cmdline boatnet.x86_64.elf File opened for reading /proc/1090/cmdline boatnet.x86_64.elf File opened for reading /proc/559/cmdline boatnet.x86_64.elf File opened for reading /proc/659/cmdline boatnet.x86_64.elf File opened for reading /proc/926/cmdline boatnet.x86_64.elf File opened for reading /proc/963/cmdline boatnet.x86_64.elf File opened for reading /proc/1095/cmdline boatnet.x86_64.elf File opened for reading /proc/1553/cmdline boatnet.x86_64.elf File opened for reading /proc/1578/cmdline boatnet.x86_64.elf File opened for reading /proc/1598/cmdline boatnet.x86_64.elf File opened for reading /proc/463/cmdline boatnet.x86_64.elf File opened for reading /proc/464/cmdline boatnet.x86_64.elf File opened for reading /proc/608/cmdline boatnet.x86_64.elf File opened for reading /proc/662/cmdline boatnet.x86_64.elf File opened for reading /proc/899/cmdline boatnet.x86_64.elf File opened for reading /proc/921/cmdline boatnet.x86_64.elf File opened for reading /proc/1065/cmdline boatnet.x86_64.elf File opened for reading /proc/1083/cmdline boatnet.x86_64.elf File opened for reading /proc/473/cmdline boatnet.x86_64.elf File opened for reading /proc/531/cmdline boatnet.x86_64.elf File opened for reading /proc/904/cmdline boatnet.x86_64.elf File opened for reading /proc/1020/cmdline boatnet.x86_64.elf File opened for reading /proc/1089/cmdline boatnet.x86_64.elf File opened for reading /proc/1149/cmdline boatnet.x86_64.elf File opened for reading /proc/1338/cmdline boatnet.x86_64.elf File opened for reading /proc/1566/cmdline boatnet.x86_64.elf