Overview

overview

9

Static

static

HEUR.Backd...da9d6c

linux_mips

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    HEUR.Backdoor.Linux.Hajime.b.5377e8f2ebdb280216c37a6195da9d6c

  • Size

    83KB

  • Sample

    201221-12lydenn12

  • MD5

    5377e8f2ebdb280216c37a6195da9d6c

  • SHA1

    b54c705193b7963a0d40699a91cdb34fedecbe88

  • SHA256

    020f1fa6072108c79ed6f553f4f8b08e157bf17f9c260a76353300230fed09f0

  • SHA512

    65e5aec56ddde56f245a20f88553d2f76bd7dd8e1940e9d49637d51a868fe73003b8a95fffeb9481110579f6ee4790fc9af1668d435930d4c01b116490908eed

Score
9/10
linux

Malware Config

Targets

    • Target

      HEUR.Backdoor.Linux.Hajime.b.5377e8f2ebdb280216c37a6195da9d6c

    • Size

      83KB

    • MD5

      5377e8f2ebdb280216c37a6195da9d6c

    • SHA1

      b54c705193b7963a0d40699a91cdb34fedecbe88

    • SHA256

      020f1fa6072108c79ed6f553f4f8b08e157bf17f9c260a76353300230fed09f0

    • SHA512

      65e5aec56ddde56f245a20f88553d2f76bd7dd8e1940e9d49637d51a868fe73003b8a95fffeb9481110579f6ee4790fc9af1668d435930d4c01b116490908eed

    Score
    9/10

    • Modifies the Watchdog daemon

      Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

    • Modifies hosts file

      Adds to hosts file used for mapping hosts to IP addresses.

    • Writes DNS configuration

      Writes data to DNS resolver config file.

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

    • Reads system network configuration

      Uses contents of /proc filesystem to enumerate network settings.

    • Reads runtime system information

      Reads data from /proc virtual filesystem.

    • Writes file to tmp directory

      Malware often drops required files in the /tmp directory.

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks