Overview

overview

9

Static

static

8

Mozi.m

linux_mips

9

Analysis

  • max time kernel
    0s
  • max time network
    17s
  • platform
    linux_mips
  • resource
    debian9-mipsbe
  • submitted
    29-05-2021 21:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Mozi.m

  • Size

    300KB

  • MD5

    ca59062514850185df19a37b6011fc1a

  • SHA1

    8a795a67ff333bed5a62dc632c551220bde5c756

  • SHA256

    195339746b4509f1e0c43141e129c08c0a2d27ea4b0a5e184513fe4cacae795e

  • SHA512

    181c7eac6a6df459836aa2da854a918f509f7fbf6af91e6aa2ce17a33e0f839a435cbe02b42a4b8ea3098bf8c4bc3f8137ac32a68153757d8efb94e2fec0b660

Score
9/10

Malware Config

Signatures

  • Modifies the Watchdog daemon 1 TTPs

    Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

  • Writes file to system bin folder 1 TTPs 2 IoCs
  • Modifies hosts file 1 IoCs

    Adds to hosts file used for mapping hosts to IP addresses.

  • Enumerates active TCP sockets 1 TTPs 1 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

  • Reads system routing table 1 TTPs 1 IoCs

    Gets active network interfaces from /proc virtual filesystem.

  • Reads system network configuration 1 TTPs 3 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

  • Reads runtime system information 1 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • ./Mozi.m
    ./Mozi.m
    1⤵
    • Enumerates active TCP sockets
    • Reads system network configuration
    • Reads runtime system information
    PID:327
  • /bin/sh
    sh -c "killall -9 telnetd utelnetd scfgmgr"
    1⤵
      PID:330

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads