Analysis
- max time kernel
146s - max time network
129s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260126-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260126-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
29/04/2026, 05:16
Behavioral task
behavioral1
Sample
boatnet.x86_64.elf
Resource
ubuntu1804-amd64-20260126-en
ubuntu-18.04-amd64
5 signatures
150 seconds
General
- Target boatnet.x86_64.elf
- Size 22KB
- Sample260429-fx7f7act8n
- SHA256 519dfc20fd53aa8a5a81e1f86323b266f1b35ca05de6a05ef71cd15c06c7cadf
- MD5 25eee253247600056347e9faa7ae58a7
- SHA1 1cfb7ada7b75c24612d9be2c598531706c761a57
- SHA512 ae985e2acb08ff50d53db2904b791a9aee8338d7950ca1fa2df8254b6cf3bff53ac84276588251c1550ce84f1267e44c2678a0365001f8b2160010f401b8e54f
- SSDEEP 384:oWR+ruZc1EBD0BEnaGr9iYnznQ2sIOKqQ7+D7N+B1/BFvDzcuiFqcJP:oWRQuZvXnZr9zzQ2AKq38B1jvHnst
- TLSH T197A2E06AD165C39ED2C6423D74C70173382F5C446B88AB07BD00A9D3219807AA8FFF34
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
Botnet
-
LZRD
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog boatnet.x86_64.elf File opened for modification /dev/misc/watchdog boatnet.x86_64.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog boatnet.x86_64.elf File opened for modification /bin/watchdog boatnet.x86_64.elf -
description ioc Process File opened for reading /proc/496/cmdline boatnet.x86_64.elf File opened for reading /proc/658/cmdline boatnet.x86_64.elf File opened for reading /proc/899/cmdline boatnet.x86_64.elf File opened for reading /proc/909/cmdline boatnet.x86_64.elf File opened for reading /proc/1205/cmdline boatnet.x86_64.elf File opened for reading /proc/1513/cmdline boatnet.x86_64.elf File opened for reading /proc/677/cmdline boatnet.x86_64.elf File opened for reading /proc/901/cmdline boatnet.x86_64.elf File opened for reading /proc/948/cmdline boatnet.x86_64.elf File opened for reading /proc/1046/cmdline boatnet.x86_64.elf File opened for reading /proc/1092/cmdline boatnet.x86_64.elf File opened for reading /proc/1151/cmdline boatnet.x86_64.elf File opened for reading /proc/1523/cmdline boatnet.x86_64.elf File opened for reading /proc/1529/cmdline boatnet.x86_64.elf File opened for reading /proc/418/cmdline boatnet.x86_64.elf File opened for reading /proc/612/cmdline boatnet.x86_64.elf File opened for reading /proc/1268/cmdline boatnet.x86_64.elf File opened for reading /proc/1518/cmdline boatnet.x86_64.elf File opened for reading /proc/1549/cmdline boatnet.x86_64.elf File opened for reading /proc/1561/cmdline boatnet.x86_64.elf File opened for reading /proc/1612/cmdline boatnet.x86_64.elf File opened for reading /proc/928/cmdline boatnet.x86_64.elf File opened for reading /proc/1007/cmdline boatnet.x86_64.elf File opened for reading /proc/1017/cmdline boatnet.x86_64.elf File opened for reading /proc/1037/cmdline boatnet.x86_64.elf File opened for reading /proc/1175/cmdline boatnet.x86_64.elf File opened for reading /proc/1194/cmdline boatnet.x86_64.elf File opened for reading /proc/1348/cmdline boatnet.x86_64.elf File opened for reading /proc/1524/cmdline boatnet.x86_64.elf File opened for reading /proc/613/cmdline boatnet.x86_64.elf File opened for reading /proc/1033/cmdline boatnet.x86_64.elf File opened for reading /proc/1051/cmdline boatnet.x86_64.elf File opened for reading /proc/1069/cmdline boatnet.x86_64.elf File opened for reading /proc/1073/cmdline boatnet.x86_64.elf File opened for reading /proc/1085/cmdline boatnet.x86_64.elf File opened for reading /proc/1158/cmdline boatnet.x86_64.elf File opened for reading /proc/1380/cmdline boatnet.x86_64.elf File opened for reading /proc/479/cmdline boatnet.x86_64.elf File opened for reading /proc/490/cmdline boatnet.x86_64.elf File opened for reading /proc/689/cmdline boatnet.x86_64.elf File opened for reading /proc/1095/cmdline boatnet.x86_64.elf File opened for reading /proc/534/cmdline boatnet.x86_64.elf File opened for reading /proc/961/cmdline boatnet.x86_64.elf File opened for reading /proc/1056/cmdline boatnet.x86_64.elf File opened for reading /proc/1191/cmdline boatnet.x86_64.elf File opened for reading /proc/1541/cmdline boatnet.x86_64.elf File opened for reading /proc/1606/cmdline boatnet.x86_64.elf File opened for reading /proc/415/cmdline boatnet.x86_64.elf File opened for reading /proc/539/cmdline boatnet.x86_64.elf File opened for reading /proc/923/cmdline boatnet.x86_64.elf File opened for reading /proc/965/cmdline boatnet.x86_64.elf File opened for reading /proc/988/cmdline boatnet.x86_64.elf File opened for reading /proc/1555/cmdline boatnet.x86_64.elf File opened for reading /proc/1588/cmdline boatnet.x86_64.elf File opened for reading /proc/1600/cmdline boatnet.x86_64.elf File opened for reading /proc/454/cmdline boatnet.x86_64.elf File opened for reading /proc/674/cmdline boatnet.x86_64.elf File opened for reading /proc/906/cmdline boatnet.x86_64.elf File opened for reading /proc/942/cmdline boatnet.x86_64.elf File opened for reading /proc/969/cmdline boatnet.x86_64.elf File opened for reading /proc/1042/cmdline boatnet.x86_64.elf File opened for reading /proc/1516/cmdline boatnet.x86_64.elf File opened for reading /proc/421/cmdline boatnet.x86_64.elf File opened for reading /proc/717/cmdline boatnet.x86_64.elf