d5601202dff3017db238145ff21857415f663031aca9b3d534bec8991b12179a

General

Target

sample
Size

83KB
MD5

b8ed2cb3e9fedec5b164ce84ad5a08d0
SHA1

b45ef9ad0a29b0a402d1613b10c3f6e95686230c
SHA256

d5601202dff3017db238145ff21857415f663031aca9b3d534bec8991b12179a
SHA512

98aa6abf6bc6b27ea2833122c468e436c267ef40c5ecbbd6446174d0859920e7b7bbcec617e12d7aa9e89e0492e5dcf4cf49a6208e7252fd0619047818454a31

Score

9^/10

Malware Config

Signatures

Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

Impair Defenses
T1562
Modifies hosts file 1 IoCs
Adds to hosts file used for mapping hosts to IP addresses.

Processes:

description ioc

/etc/hosts /etc/hosts
Writes DNS configuration 1 TTPs 1 IoCs
Writes data to DNS resolver config file.

Dynamic Resolution
T1568

Processes:

description ioc

/etc/resolv.conf /etc/resolv.conf
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.

System Network Connections Discovery
T1049

Processes:

description ioc

/proc/net/tcp /proc/net/tcp
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.

System Network Configuration Discovery
T1016

Processes:

sample

description ioc process

/proc/net/route /proc/net/route sample
Reads system network configuration 1 TTPs 3 IoCs
Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery
T1016

Processes:

sample

description ioc process

/proc/net/route /proc/net/route sample
/proc/net/tcp /proc/net/tcp
/proc/net/tcp6 /proc/net/tcp6

description	ioc
/etc/hosts	/etc/hosts

description	ioc
/etc/resolv.conf	/etc/resolv.conf

description	ioc
/proc/net/tcp	/proc/net/tcp

description	ioc	process
/proc/net/route	/proc/net/route	sample

description	ioc	process
/proc/net/route	/proc/net/route	sample
/proc/net/tcp	/proc/net/tcp
/proc/net/tcp6	/proc/net/tcp6

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

description	ioc
/proc/301/fd	/proc/301/fd
/proc/251/fd	/proc/251/fd
/proc/81/cmdline	/proc/81/cmdline
/proc/291/cmdline	/proc/291/cmdline
/proc/224/fd	/proc/224/fd
/proc/115/cmdline	/proc/115/cmdline
/proc/77/cmdline	/proc/77/cmdline
/proc/13/cmdline	/proc/13/cmdline
/proc/209/cmdline	/proc/209/cmdline
/proc/156/cmdline	/proc/156/cmdline
/proc/19/cmdline	/proc/19/cmdline
/proc/10/cmdline	/proc/10/cmdline
/proc/282/fd	/proc/282/fd
/proc/72/cmdline	/proc/72/cmdline
/proc/17/cmdline	/proc/17/cmdline
/proc/4/cmdline	/proc/4/cmdline
/proc/18/cmdline	/proc/18/cmdline
/proc/325/cmdline	/proc/325/cmdline
/proc/156/fd	/proc/156/fd
/proc/145/cmdline	/proc/145/cmdline
/proc/37/cmdline	/proc/37/cmdline
/proc/23/cmdline	/proc/23/cmdline
/proc/258/cmdline	/proc/258/cmdline
/proc/209/fd	/proc/209/fd
/proc/9/cmdline	/proc/9/cmdline
/proc/6/cmdline	/proc/6/cmdline
/proc/1/fd	/proc/1/fd
/proc/301/cmdline	/proc/301/cmdline
/proc/224/cmdline	/proc/224/cmdline
/proc/5/cmdline	/proc/5/cmdline
/proc/228/cmdline	/proc/228/cmdline
/proc/76/cmdline	/proc/76/cmdline
/proc/284/cmdline	/proc/284/cmdline
/proc/251/cmdline	/proc/251/cmdline
/proc/250/fd	/proc/250/fd
/proc/69/cmdline	/proc/69/cmdline
/proc/228/fd	/proc/228/fd
/proc/225/fd	/proc/225/fd
/proc/141/cmdline	/proc/141/cmdline
/proc/16/cmdline	/proc/16/cmdline
/proc/15/cmdline	/proc/15/cmdline
/proc/36/cmdline	/proc/36/cmdline
/proc/22/cmdline	/proc/22/cmdline
/proc/14/cmdline	/proc/14/cmdline
/proc/329/cmdline	/proc/329/cmdline
/proc/327/cmdline	/proc/327/cmdline
/proc/291/fd	/proc/291/fd
/proc/105/cmdline	/proc/105/cmdline
/proc/75/cmdline	/proc/75/cmdline
/proc/329/fd	/proc/329/fd
/proc/12/cmdline	/proc/12/cmdline
/proc/2/cmdline	/proc/2/cmdline
/proc/20/cmdline	/proc/20/cmdline
/proc/284/fd	/proc/284/fd
/proc/229/cmdline	/proc/229/cmdline
/proc/229/fd	/proc/229/fd
/proc/141/fd	/proc/141/fd
/proc/83/cmdline	/proc/83/cmdline
/proc/282/cmdline	/proc/282/cmdline
/proc/258/fd	/proc/258/fd
/proc/78/cmdline	/proc/78/cmdline
/proc/71/cmdline	/proc/71/cmdline
/proc/1/cmdline	/proc/1/cmdline
/proc/24/cmdline	/proc/24/cmdline

Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.

Processes:

description ioc

/tmp/ftpupdate.sh /tmp/ftpupdate.sh
/tmp/ftpupload.sh /tmp/ftpupload.sh

description	ioc
/tmp/ftpupdate.sh	/tmp/ftpupdate.sh
/tmp/ftpupload.sh	/tmp/ftpupload.sh

./sample
./sample
1⤵
- Reads system routing table
- Reads system network configuration
PID:327

/bin/sh
sh -c "iptables -A INPUT -p tcp --destination-port 23 -j DROP"
1⤵
PID:330
- /sbin/iptables
  iptables -A INPUT -p tcp --destination-port 23 -j DROP
  2⤵
  PID:331

/bin/sh
sh -c "iptables -A INPUT -p tcp --destination-port 7547 -j DROP"
1⤵
PID:340
- /sbin/iptables
  iptables -A INPUT -p tcp --destination-port 7547 -j DROP
  2⤵
  PID:341

/bin/sh
sh -c "iptables -A INPUT -p tcp --destination-port 5555 -j DROP"
1⤵
PID:342
- /sbin/iptables
  iptables -A INPUT -p tcp --destination-port 5555 -j DROP
  2⤵
  PID:343

/bin/sh
sh -c "iptables -A INPUT -p tcp --destination-port 5358 -j DROP"
1⤵
PID:344
- /sbin/iptables
  iptables -A INPUT -p tcp --destination-port 5358 -j DROP
  2⤵
  PID:345

/bin/sh
sh -c "iptables -D INPUT -j CWMP_CR"
1⤵
PID:346
- /sbin/iptables
  iptables -D INPUT -j CWMP_CR
  2⤵
  PID:347

/bin/sh
sh -c "iptables -X CWMP_CR"
1⤵
PID:348
- /sbin/iptables
  iptables -X CWMP_CR
  2⤵
  PID:349

/bin/sh
sh -c "iptables -I INPUT -p udp --dport 37714 -j ACCEPT"
1⤵
PID:350
- /sbin/iptables
  iptables -I INPUT -p udp --dport 37714 -j ACCEPT
  2⤵
  PID:351