Overview

overview

9

Static

static

8

i

linux_amd64

i

linux_mipsel

i

linux_mips

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    i

  • Size

    129KB

  • Sample

    210218-1nted2letj

  • MD5

    dbc520ea1518748fec9fcfcf29755c30

  • SHA1

    0a427f86b4360fb603c6e3c5878c9be7ced59adc

  • SHA256

    c672798dca67f796972b42ad0c89e25d589d2e70eb41892d26adbb6a79f63887

  • SHA512

    6d42025c8c4b1778de583fb4468da72750e8d6022f24e1e8c5cd6b1ff853eb2cdeb9de75338e37da729be2576a7e8e8aa3cdf184b1a9f6b27b6169e23d724055

Score
9/10
linux

Malware Config

Targets

    • Target

      i

    • Size

      129KB

    • MD5

      dbc520ea1518748fec9fcfcf29755c30

    • SHA1

      0a427f86b4360fb603c6e3c5878c9be7ced59adc

    • SHA256

      c672798dca67f796972b42ad0c89e25d589d2e70eb41892d26adbb6a79f63887

    • SHA512

      6d42025c8c4b1778de583fb4468da72750e8d6022f24e1e8c5cd6b1ff853eb2cdeb9de75338e37da729be2576a7e8e8aa3cdf184b1a9f6b27b6169e23d724055

    Score
    9/10

    • Modifies the Watchdog daemon

      Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

    • Writes file to system bin folder

    • Modifies hosts file

      Adds to hosts file used for mapping hosts to IP addresses.

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

    • Reads system network configuration

      Uses contents of /proc filesystem to enumerate network settings.

    • Reads runtime system information

      Reads data from /proc virtual filesystem.

    • Writes file to tmp directory

      Malware often drops required files in the /tmp directory.

    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hijack Execution Flow

1
T1574

Privilege Escalation

Hijack Execution Flow

1
T1574

Defense Evasion

Impair Defenses

1
T1562

Hijack Execution Flow

1
T1574

Credential Access

Discovery

System Network Connections Discovery

1
T1049

System Network Configuration Discovery

2
T1016

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks