Overview

overview

9

Static

static

xd.arm7

linux_armhf

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    xd.arm7

  • Size

    52KB

  • Sample

    211205-zm5z6achdk

  • MD5

    b033387845342b6c2767c999c72ce969

  • SHA1

    9814c1acf39a196f149bc692dd5ec65851a47018

  • SHA256

    798870c2cc058fd83cfdae3c3d2543afee3085e19ce28df0a897e031bc0cb3ee

  • SHA512

    0650cbda952061a7824be02706e2f0bbcb6cc2c8c1b45140112224f26b60cd00b1bbec78a4af056d158b42f86e7fc886856b963b619a75cd97e2fab0ea1c5647

Score
9/10
linux

Malware Config

Targets

    • Target

      xd.arm7

    • Size

      52KB

    • MD5

      b033387845342b6c2767c999c72ce969

    • SHA1

      9814c1acf39a196f149bc692dd5ec65851a47018

    • SHA256

      798870c2cc058fd83cfdae3c3d2543afee3085e19ce28df0a897e031bc0cb3ee

    • SHA512

      0650cbda952061a7824be02706e2f0bbcb6cc2c8c1b45140112224f26b60cd00b1bbec78a4af056d158b42f86e7fc886856b963b619a75cd97e2fab0ea1c5647

    Score
    9/10

    • Modifies the Watchdog daemon

      Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

    • Writes file to system bin folder

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

    • Write file to user bin folder

    • Reads system network configuration

      Uses contents of /proc filesystem to enumerate network settings.

    • Reads runtime system information

      Reads data from /proc virtual filesystem.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hijack Execution Flow

2
T1574

Privilege Escalation

Hijack Execution Flow

2
T1574

Defense Evasion

Impair Defenses

1
T1562

Hijack Execution Flow

2
T1574

Credential Access

Discovery

System Network Connections Discovery

1
T1049

System Network Configuration Discovery

1
T1016

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks