Overview

overview

9

Static

static

5377

linux_mips

9

Resubmissions

14-09-2021 14:07

210914-re6mqaaggl 9

14-09-2021 10:32

210914-mlb98saefk 9

13-09-2021 16:04

210913-th7qashbdm 1

13-09-2021 13:37

210913-qwth2sdge2 1

13-09-2021 13:36

210913-qwd4csghan 9

13-09-2021 12:44

210913-pygrlaggcj 1

11-09-2021 09:23

210911-lcz49secgr 9

10-09-2021 12:58

210910-p71k3adbhq 9

10-09-2021 12:51

210910-p3wfjsabc2 9

12-08-2021 11:26

210812-ycj7sbk332 9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5377

  • Size

    83KB

  • Sample

    210914-mlb98saefk

  • MD5

    5377e8f2ebdb280216c37a6195da9d6c

  • SHA1

    b54c705193b7963a0d40699a91cdb34fedecbe88

  • SHA256

    020f1fa6072108c79ed6f553f4f8b08e157bf17f9c260a76353300230fed09f0

  • SHA512

    65e5aec56ddde56f245a20f88553d2f76bd7dd8e1940e9d49637d51a868fe73003b8a95fffeb9481110579f6ee4790fc9af1668d435930d4c01b116490908eed

Score
9/10
linux

Malware Config

Targets

    • Target

      5377

    • Size

      83KB

    • MD5

      5377e8f2ebdb280216c37a6195da9d6c

    • SHA1

      b54c705193b7963a0d40699a91cdb34fedecbe88

    • SHA256

      020f1fa6072108c79ed6f553f4f8b08e157bf17f9c260a76353300230fed09f0

    • SHA512

      65e5aec56ddde56f245a20f88553d2f76bd7dd8e1940e9d49637d51a868fe73003b8a95fffeb9481110579f6ee4790fc9af1668d435930d4c01b116490908eed

    Score
    9/10

    • Modifies the Watchdog daemon

      Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

    • Modifies hosts file

      Adds to hosts file used for mapping hosts to IP addresses.

    • Writes DNS configuration

      Writes data to DNS resolver config file.

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

    • Reads system network configuration

      Uses contents of /proc filesystem to enumerate network settings.

    • Reads runtime system information

      Reads data from /proc virtual filesystem.

    • Writes file to tmp directory

      Malware often drops required files in the /tmp directory.

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks