Overview

overview

9

Static

static

5377

linux_mips

9

Resubmissions

09-10-2021 06:22

211009-g4zklafbcj 9

07-10-2021 13:06

211007-qcjvhacdd7 9

07-10-2021 12:37

211007-pthhbscfar 1

03-10-2021 12:52

211003-p32bssfdf5 9

01-10-2021 09:38

211001-lmftdabden 9

30-09-2021 14:37

210930-ry4mgahhf3 9

24-09-2021 10:09

210924-l64dsagef7 1

24-09-2021 08:47

210924-kpzhtsgddq 9

24-09-2021 07:54

210924-jr1y1agcfj 1

23-09-2021 18:15

210923-wv15dsfab9 9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5377

  • Size

    83KB

  • Sample

    210930-ry4mgahhf3

  • MD5

    5377e8f2ebdb280216c37a6195da9d6c

  • SHA1

    b54c705193b7963a0d40699a91cdb34fedecbe88

  • SHA256

    020f1fa6072108c79ed6f553f4f8b08e157bf17f9c260a76353300230fed09f0

  • SHA512

    65e5aec56ddde56f245a20f88553d2f76bd7dd8e1940e9d49637d51a868fe73003b8a95fffeb9481110579f6ee4790fc9af1668d435930d4c01b116490908eed

Score
9/10
linux

Malware Config

Targets

    • Target

      5377

    • Size

      83KB

    • MD5

      5377e8f2ebdb280216c37a6195da9d6c

    • SHA1

      b54c705193b7963a0d40699a91cdb34fedecbe88

    • SHA256

      020f1fa6072108c79ed6f553f4f8b08e157bf17f9c260a76353300230fed09f0

    • SHA512

      65e5aec56ddde56f245a20f88553d2f76bd7dd8e1940e9d49637d51a868fe73003b8a95fffeb9481110579f6ee4790fc9af1668d435930d4c01b116490908eed

    Score
    9/10

    • Modifies the Watchdog daemon

      Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

    • Modifies hosts file

      Adds to hosts file used for mapping hosts to IP addresses.

    • Writes DNS configuration

      Writes data to DNS resolver config file.

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

    • Reads system network configuration

      Uses contents of /proc filesystem to enumerate network settings.

    • Reads runtime system information

      Reads data from /proc virtual filesystem.

    • Writes file to tmp directory

      Malware often drops required files in the /tmp directory.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

1
T1562

Credential Access

Discovery

System Network Connections Discovery

1
T1049

System Network Configuration Discovery

2
T1016

Lateral Movement

Collection

Exfiltration

Command and Control

Dynamic Resolution

1
T1568

Impact

Tasks