020f1fa6072108c79ed6f553f4f8b08e157bf17f9c260a76353300230fed09f0

General

Target

Hajime
Size

83KB
MD5

5377e8f2ebdb280216c37a6195da9d6c
SHA1

b54c705193b7963a0d40699a91cdb34fedecbe88
SHA256

020f1fa6072108c79ed6f553f4f8b08e157bf17f9c260a76353300230fed09f0
SHA512

65e5aec56ddde56f245a20f88553d2f76bd7dd8e1940e9d49637d51a868fe73003b8a95fffeb9481110579f6ee4790fc9af1668d435930d4c01b116490908eed

Score

9^/10

discovery

Malware Config

Signatures

Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

Impair Defenses
T1562
Contacts a large (1735) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Modifies hosts file 1 IoCs
Adds to hosts file used for mapping hosts to IP addresses.

Processes:

description ioc

/etc/hosts /etc/hosts
Writes DNS configuration 1 TTPs 1 IoCs
Writes data to DNS resolver config file.

Dynamic Resolution
T1568

Processes:

description ioc

/etc/resolv.conf /etc/resolv.conf
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.

System Network Connections Discovery
T1049

Processes:

description ioc

/proc/net/tcp /proc/net/tcp
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.

System Network Configuration Discovery
T1016

Processes:

description ioc

/proc/net/route /proc/net/route
Reads system network configuration 1 TTPs 3 IoCs
Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery
T1016

Processes:

description ioc

/proc/net/route /proc/net/route
/proc/net/tcp /proc/net/tcp
/proc/net/tcp6 /proc/net/tcp6

description	ioc
/etc/hosts	/etc/hosts

description	ioc
/etc/resolv.conf	/etc/resolv.conf

description	ioc
/proc/net/tcp	/proc/net/tcp

description	ioc
/proc/net/route	/proc/net/route

description	ioc
/proc/net/route	/proc/net/route
/proc/net/tcp	/proc/net/tcp
/proc/net/tcp6	/proc/net/tcp6

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

description	ioc
/proc/1/fd	/proc/1/fd
/proc/294/cmdline	/proc/294/cmdline
/proc/286/cmdline	/proc/286/cmdline
/proc/235/fd	/proc/235/fd
/proc/155/cmdline	/proc/155/cmdline
/proc/155/fd	/proc/155/fd
/proc/14/cmdline	/proc/14/cmdline
/proc/5/cmdline	/proc/5/cmdline
/proc/318/cmdline	/proc/318/cmdline
/proc/236/fd	/proc/236/fd
/proc/17/cmdline	/proc/17/cmdline
/proc/8/cmdline	/proc/8/cmdline
/proc/81/cmdline	/proc/81/cmdline
/proc/37/cmdline	/proc/37/cmdline
/proc/18/cmdline	/proc/18/cmdline
/proc/11/cmdline	/proc/11/cmdline
/proc/293/fd	/proc/293/fd
/proc/248/cmdline	/proc/248/cmdline
/proc/219/cmdline	/proc/219/cmdline
/proc/71/cmdline	/proc/71/cmdline
/proc/7/cmdline	/proc/7/cmdline
/proc/294/fd	/proc/294/fd
/proc/24/cmdline	/proc/24/cmdline
/proc/23/cmdline	/proc/23/cmdline
/proc/143/cmdline	/proc/143/cmdline
/proc/113/cmdline	/proc/113/cmdline
/proc/36/cmdline	/proc/36/cmdline
/proc/13/cmdline	/proc/13/cmdline
/proc/10/cmdline	/proc/10/cmdline
/proc/272/fd	/proc/272/fd
/proc/247/fd	/proc/247/fd
/proc/76/cmdline	/proc/76/cmdline
/proc/19/cmdline	/proc/19/cmdline
/proc/135/fd	/proc/135/fd
/proc/102/cmdline	/proc/102/cmdline
/proc/73/cmdline	/proc/73/cmdline
/proc/20/cmdline	/proc/20/cmdline
/proc/15/cmdline	/proc/15/cmdline
/proc/4/cmdline	/proc/4/cmdline
/proc/293/cmdline	/proc/293/cmdline
/proc/272/cmdline	/proc/272/cmdline
/proc/235/cmdline	/proc/235/cmdline
/proc/72/cmdline	/proc/72/cmdline
/proc/3/cmdline	/proc/3/cmdline
/proc/247/cmdline	/proc/247/cmdline
/proc/217/fd	/proc/217/fd
/proc/135/cmdline	/proc/135/cmdline
/proc/77/cmdline	/proc/77/cmdline
/proc/75/cmdline	/proc/75/cmdline
/proc/21/cmdline	/proc/21/cmdline
/proc/6/cmdline	/proc/6/cmdline
/proc/157/cmdline	/proc/157/cmdline
/proc/114/cmdline	/proc/114/cmdline
/proc/22/cmdline	/proc/22/cmdline
/proc/253/fd	/proc/253/fd
/proc/215/cmdline	/proc/215/cmdline
/proc/206/fd	/proc/206/fd
/proc/74/cmdline	/proc/74/cmdline
/proc/12/cmdline	/proc/12/cmdline
/proc/9/cmdline	/proc/9/cmdline
/proc/286/fd	/proc/286/fd
/proc/282/cmdline	/proc/282/cmdline
/proc/248/fd	/proc/248/fd
/proc/16/cmdline	/proc/16/cmdline

Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.

Processes:

description ioc

/tmp/ftpupdate.sh /tmp/ftpupdate.sh
/tmp/ftpupload.sh /tmp/ftpupload.sh

description	ioc
/tmp/ftpupdate.sh	/tmp/ftpupdate.sh
/tmp/ftpupload.sh	/tmp/ftpupload.sh

./Hajime
./Hajime
1⤵
PID:320

/bin/sh
sh -c "iptables -A INPUT -p tcp --destination-port 23 -j DROP"
1⤵
PID:323
- /sbin/iptables
  iptables -A INPUT -p tcp --destination-port 23 -j DROP
  2⤵
  PID:324

/bin/sh
sh -c "iptables -A INPUT -p tcp --destination-port 7547 -j DROP"
1⤵
PID:333
- /sbin/iptables
  iptables -A INPUT -p tcp --destination-port 7547 -j DROP
  2⤵
  PID:334

/bin/sh
sh -c "iptables -A INPUT -p tcp --destination-port 5555 -j DROP"
1⤵
PID:335
- /sbin/iptables
  iptables -A INPUT -p tcp --destination-port 5555 -j DROP
  2⤵
  PID:336

/bin/sh
sh -c "iptables -A INPUT -p tcp --destination-port 5358 -j DROP"
1⤵
PID:337
- /sbin/iptables
  iptables -A INPUT -p tcp --destination-port 5358 -j DROP
  2⤵
  PID:338

/bin/sh
sh -c "iptables -D INPUT -j CWMP_CR"
1⤵
PID:339
- /sbin/iptables
  iptables -D INPUT -j CWMP_CR
  2⤵
  PID:340

/bin/sh
sh -c "iptables -X CWMP_CR"
1⤵
PID:341
- /sbin/iptables
  iptables -X CWMP_CR
  2⤵
  PID:342

/bin/sh
sh -c "iptables -I INPUT -p udp --dport 60481 -j ACCEPT"
1⤵
PID:343
- /sbin/iptables
  iptables -I INPUT -p udp --dport 60481 -j ACCEPT
  2⤵
  PID:344

./atk
./atk
1⤵
PID:406

/bin/sh
sh -c "iptables -I INPUT -p tcp --dport 22816 -j ACCEPT"
1⤵
PID:410
- /sbin/iptables
  iptables -I INPUT -p tcp --dport 22816 -j ACCEPT
  2⤵
  PID:411

/bin/sh
sh -c "iptables -I INPUT -p udp --dport 22816 -j ACCEPT"
1⤵
PID:412
- /sbin/iptables
  iptables -I INPUT -p udp --dport 22816 -j ACCEPT
  2⤵
  PID:413