Resubmissions
14-09-2021 14:07
210914-re6mqaaggl 914-09-2021 10:32
210914-mlb98saefk 913-09-2021 16:04
210913-th7qashbdm 113-09-2021 13:37
210913-qwth2sdge2 113-09-2021 13:36
210913-qwd4csghan 913-09-2021 12:44
210913-pygrlaggcj 111-09-2021 09:23
210911-lcz49secgr 910-09-2021 12:58
210910-p71k3adbhq 910-09-2021 12:51
210910-p3wfjsabc2 912-08-2021 11:26
210812-ycj7sbk332 9General
-
Target
5377
-
Size
83KB
-
Sample
210913-qwd4csghan
-
MD5
5377e8f2ebdb280216c37a6195da9d6c
-
SHA1
b54c705193b7963a0d40699a91cdb34fedecbe88
-
SHA256
020f1fa6072108c79ed6f553f4f8b08e157bf17f9c260a76353300230fed09f0
-
SHA512
65e5aec56ddde56f245a20f88553d2f76bd7dd8e1940e9d49637d51a868fe73003b8a95fffeb9481110579f6ee4790fc9af1668d435930d4c01b116490908eed
Malware Config
Targets
-
-
Target
5377
-
Size
83KB
-
MD5
5377e8f2ebdb280216c37a6195da9d6c
-
SHA1
b54c705193b7963a0d40699a91cdb34fedecbe88
-
SHA256
020f1fa6072108c79ed6f553f4f8b08e157bf17f9c260a76353300230fed09f0
-
SHA512
65e5aec56ddde56f245a20f88553d2f76bd7dd8e1940e9d49637d51a868fe73003b8a95fffeb9481110579f6ee4790fc9af1668d435930d4c01b116490908eed
Score9/10-
Modifies the Watchdog daemon
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
-
Modifies hosts file
Adds to hosts file used for mapping hosts to IP addresses.
-
Writes DNS configuration
Writes data to DNS resolver config file.
-
Enumerates active TCP sockets
Gets active TCP sockets from /proc virtual filesystem.
-
Reads system routing table
Gets active network interfaces from /proc virtual filesystem.
-
Reads system network configuration
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory
Malware often drops required files in the /tmp directory.
-