Overview

overview

9

Static

static

8

Mozi.m

linux_amd64

Mozi.m

linux_mipsel

Mozi.m

linux_mips

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Mozi.m

  • Size

    300KB

  • Sample

    210730-dd4lnsffz6

  • MD5

    129b68c2c0cb414a4067177963d24375

  • SHA1

    f7fac891f129251d35b1f6cc5b87324087bbb351

  • SHA256

    dea6d3eb289afa011e3dcbaaea9a00a6f90bdfc061447a741f10b863df0d9bab

  • SHA512

    877821748fed32db36299d4009518eb9a12057510b8601133e8fe954d88a8a068f3d7be767e2fd1b364dbe59ec0d97d7d067a0064006f36030216c3802c7eb88

Score
9/10
linux

Malware Config

Targets

    • Target

      Mozi.m

    • Size

      300KB

    • MD5

      129b68c2c0cb414a4067177963d24375

    • SHA1

      f7fac891f129251d35b1f6cc5b87324087bbb351

    • SHA256

      dea6d3eb289afa011e3dcbaaea9a00a6f90bdfc061447a741f10b863df0d9bab

    • SHA512

      877821748fed32db36299d4009518eb9a12057510b8601133e8fe954d88a8a068f3d7be767e2fd1b364dbe59ec0d97d7d067a0064006f36030216c3802c7eb88

    Score
    9/10

    • Modifies the Watchdog daemon

      Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

    • Writes file to system bin folder

    • Modifies hosts file

      Adds to hosts file used for mapping hosts to IP addresses.

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

    • Reads system network configuration

      Uses contents of /proc filesystem to enumerate network settings.

    • Reads runtime system information

      Reads data from /proc virtual filesystem.

    • Writes file to tmp directory

      Malware often drops required files in the /tmp directory.

    behavioral1behavioral2behavioral3

MITRE ATT&CK Enterprise v6

Tasks