Resubmissions
09-10-2021 06:22
211009-g4zklafbcj 907-10-2021 13:06
211007-qcjvhacdd7 907-10-2021 12:37
211007-pthhbscfar 103-10-2021 12:52
211003-p32bssfdf5 901-10-2021 09:38
211001-lmftdabden 930-09-2021 14:37
210930-ry4mgahhf3 924-09-2021 10:09
210924-l64dsagef7 124-09-2021 08:47
210924-kpzhtsgddq 924-09-2021 07:54
210924-jr1y1agcfj 123-09-2021 18:15
210923-wv15dsfab9 9General
-
Target
5377
-
Size
83KB
-
Sample
211009-g4zklafbcj
-
MD5
5377e8f2ebdb280216c37a6195da9d6c
-
SHA1
b54c705193b7963a0d40699a91cdb34fedecbe88
-
SHA256
020f1fa6072108c79ed6f553f4f8b08e157bf17f9c260a76353300230fed09f0
-
SHA512
65e5aec56ddde56f245a20f88553d2f76bd7dd8e1940e9d49637d51a868fe73003b8a95fffeb9481110579f6ee4790fc9af1668d435930d4c01b116490908eed
Malware Config
Targets
-
-
Target
5377
-
Size
83KB
-
MD5
5377e8f2ebdb280216c37a6195da9d6c
-
SHA1
b54c705193b7963a0d40699a91cdb34fedecbe88
-
SHA256
020f1fa6072108c79ed6f553f4f8b08e157bf17f9c260a76353300230fed09f0
-
SHA512
65e5aec56ddde56f245a20f88553d2f76bd7dd8e1940e9d49637d51a868fe73003b8a95fffeb9481110579f6ee4790fc9af1668d435930d4c01b116490908eed
Score9/10-
Modifies the Watchdog daemon
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
-
Modifies hosts file
Adds to hosts file used for mapping hosts to IP addresses.
-
Writes DNS configuration
Writes data to DNS resolver config file.
-
Enumerates active TCP sockets
Gets active TCP sockets from /proc virtual filesystem.
-
Reads system routing table
Gets active network interfaces from /proc virtual filesystem.
-
Reads system network configuration
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory
Malware often drops required files in the /tmp directory.
-