General
-
Target
e629334def73be9e166ecdd9d5d73d6be97ef7f7d16f05383892332acb324b73
-
Size
300KB
-
Sample
220305-2wxq9abbhl
-
MD5
106a736477f5e6efc07bdea0249986f9
-
SHA1
b8cb63180aad940b1356e310e9bcbfee30a028b5
-
SHA256
e629334def73be9e166ecdd9d5d73d6be97ef7f7d16f05383892332acb324b73
-
SHA512
85892182987a55f12a295c6bca9a4eb104b0a1c6c42670fa1b3ba274bfc7a3f2d522daea0022c09181c57cc1024ea21812300f189ef707e2dd66f775adbf3576
Malware Config
Targets
-
-
Target
e629334def73be9e166ecdd9d5d73d6be97ef7f7d16f05383892332acb324b73
-
Size
300KB
-
MD5
106a736477f5e6efc07bdea0249986f9
-
SHA1
b8cb63180aad940b1356e310e9bcbfee30a028b5
-
SHA256
e629334def73be9e166ecdd9d5d73d6be97ef7f7d16f05383892332acb324b73
-
SHA512
85892182987a55f12a295c6bca9a4eb104b0a1c6c42670fa1b3ba274bfc7a3f2d522daea0022c09181c57cc1024ea21812300f189ef707e2dd66f775adbf3576
Score10/10-
suricata: ET MALWARE Mirai Variant User-Agent (Outbound)
suricata: ET MALWARE Mirai Variant User-Agent (Outbound)
-
suricata: ET MALWARE Mozi Botnet DHT Config Sent
suricata: ET MALWARE Mozi Botnet DHT Config Sent
-
Modifies the Watchdog daemon
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
-
Writes file to system bin folder
-
Modifies hosts file
Adds to hosts file used for mapping hosts to IP addresses.
-
Writes DNS configuration
Writes data to DNS resolver config file.
-
Enumerates active TCP sockets
Gets active TCP sockets from /proc virtual filesystem.
-
Modifies init.d
Adds/modifies system service, likely for persistence.
-
Reads system routing table
Gets active network interfaces from /proc virtual filesystem.
-
Reads system network configuration
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory
Malware often drops required files in the /tmp directory.
-