Analysis
-
max time kernel
11962s -
max time network
165s -
platform
linux_armhf -
resource
debian9-armhf-en-20211208 -
submitted
25-04-2022 22:19
Static task
static1
Behavioral task
behavioral1
Sample
iyajkhazz
Resource
debian9-armhf-en-20211208
General
-
Target
iyajkhazz
-
Size
78KB
-
MD5
9b6c3518a91d23ed77504b5416bfb5b3
-
SHA1
0a2d170abbf5031566377b01431e3b82d342630a
-
SHA256
a04ac6d98ad989312783d4fe3456c53730b212c79a426fb215708b6c6daa3de3
-
SHA512
b2b08d5d5e6c6708d88b793e9340a780d47b5dce61e0a3026b4cdea8a9e4cbf9824037255e4ea4a40fee5bce956485232376d4677ce72ccb6c7f00badd09956e
Malware Config
Signatures
-
Contacts a large (4776) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
-
Modifies hosts file 1 IoCs
Adds to hosts file used for mapping hosts to IP addresses.
Processes:
description ioc /etc/hosts /etc/hosts -
Writes DNS configuration 1 TTPs 1 IoCs
Writes data to DNS resolver config file.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
Processes:
iyajkhazzdescription ioc process /proc/net/route /proc/net/route iyajkhazz -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Reads system network configuration 1 TTPs 3 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes:
iyajkhazzdescription ioc process /proc/net/route /proc/net/route iyajkhazz /proc/net/tcp /proc/net/tcp /proc/net/tcp6 /proc/net/tcp6 -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
description ioc /proc/291/cmdline /proc/291/cmdline /proc/280/fd /proc/280/fd /proc/112/cmdline /proc/112/cmdline /proc/4/cmdline /proc/4/cmdline /proc/283/cmdline /proc/283/cmdline /proc/236/fd /proc/236/fd /proc/157/cmdline /proc/157/cmdline /proc/28/cmdline /proc/28/cmdline /proc/21/cmdline /proc/21/cmdline /proc/19/cmdline /proc/19/cmdline /proc/358/fd /proc/358/fd /proc/315/cmdline /proc/315/cmdline /proc/283/fd /proc/283/fd /proc/26/cmdline /proc/26/cmdline /proc/23/cmdline /proc/23/cmdline /proc/16/cmdline /proc/16/cmdline /proc/1/fd /proc/1/fd /proc/358/cmdline /proc/358/cmdline /proc/357/cmdline /proc/357/cmdline /proc/308/cmdline /proc/308/cmdline /proc/291/fd /proc/291/fd /proc/279/fd /proc/279/fd /proc/236/cmdline /proc/236/cmdline /proc/217/fd /proc/217/fd /proc/43/cmdline /proc/43/cmdline /proc/6/cmdline /proc/6/cmdline /proc/308/fd /proc/308/fd /proc/139/cmdline /proc/139/cmdline /proc/80/cmdline /proc/80/cmdline /proc/42/cmdline /proc/42/cmdline /proc/20/cmdline /proc/20/cmdline /proc/7/cmdline /proc/7/cmdline /proc/169/fd /proc/169/fd /proc/27/cmdline /proc/27/cmdline /proc/12/cmdline /proc/12/cmdline /proc/314/fd /proc/314/fd /proc/312/fd /proc/312/fd /proc/238/cmdline /proc/238/cmdline /proc/18/cmdline /proc/18/cmdline /proc/3/cmdline /proc/3/cmdline /proc/1/cmdline /proc/1/cmdline /proc/280/cmdline /proc/280/cmdline /proc/217/cmdline /proc/217/cmdline /proc/11/cmdline /proc/11/cmdline /proc/5/cmdline /proc/5/cmdline /proc/2/cmdline /proc/2/cmdline /proc/13/cmdline /proc/13/cmdline /proc/9/cmdline /proc/9/cmdline /proc/315/fd /proc/315/fd /proc/233/cmdline /proc/233/cmdline /proc/152/cmdline /proc/152/cmdline /proc/147/fd /proc/147/fd /proc/101/cmdline /proc/101/cmdline /proc/29/cmdline /proc/29/cmdline /proc/233/fd /proc/233/fd /proc/113/cmdline /proc/113/cmdline /proc/25/cmdline /proc/25/cmdline /proc/14/cmdline /proc/14/cmdline /proc/10/cmdline /proc/10/cmdline /proc/8/cmdline /proc/8/cmdline /proc/353/cmdline /proc/353/cmdline /proc/24/cmdline /proc/24/cmdline /proc/22/cmdline /proc/22/cmdline /proc/17/cmdline /proc/17/cmdline -
Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
Processes:
description ioc /tmp/ftpupdate.sh /tmp/ftpupdate.sh /tmp/ftpupload.sh /tmp/ftpupload.sh
Processes
-
./iyajkhazz./iyajkhazz1⤵
- Reads system routing table
- Reads system network configuration
-
/bin/sh/bin/sh -c "iptables -A INPUT -p tcp --destination-port 23 -j DROP"1⤵
-
/sbin/iptablesiptables -A INPUT -p tcp --destination-port 23 -j DROP2⤵
-
/bin/sh/bin/sh -c "iptables -A INPUT -p tcp --destination-port 7547 -j DROP"1⤵
-
/sbin/iptablesiptables -A INPUT -p tcp --destination-port 7547 -j DROP2⤵
-
/bin/sh/bin/sh -c "iptables -A INPUT -p tcp --destination-port 5555 -j DROP"1⤵
-
/sbin/iptablesiptables -A INPUT -p tcp --destination-port 5555 -j DROP2⤵
-
/bin/sh/bin/sh -c "iptables -A INPUT -p tcp --destination-port 5358 -j DROP"1⤵
-
/sbin/iptablesiptables -A INPUT -p tcp --destination-port 5358 -j DROP2⤵
-
/bin/sh/bin/sh -c "iptables -D INPUT -j CWMP_CR"1⤵
-
/sbin/iptablesiptables -D INPUT -j CWMP_CR2⤵
-
/bin/sh/bin/sh -c "iptables -X CWMP_CR"1⤵
-
/sbin/iptablesiptables -X CWMP_CR2⤵
-
/bin/sh/bin/sh -c "iptables -I INPUT -p udp --dport 36918 -j ACCEPT"1⤵
-
/sbin/iptablesiptables -I INPUT -p udp --dport 36918 -j ACCEPT2⤵
-
./atk./atk1⤵
-
/bin/sh/bin/sh -c "iptables -I INPUT -p tcp --dport 27635 -j ACCEPT"2⤵
-
/sbin/iptablesiptables -I INPUT -p tcp --dport 27635 -j ACCEPT3⤵
-
/bin/sh/bin/sh -c "iptables -I INPUT -p udp --dport 27635 -j ACCEPT"2⤵
-
/sbin/iptablesiptables -I INPUT -p udp --dport 27635 -j ACCEPT3⤵