5063b629c039f293adc7c0d153d1dafb227b18f94e3e73f294f1f6f9abafd1b8

General

Target

Mozi.maxesgwbc
Size

300KB
Sample

220425-2qnamafgg4
MD5

04a77bca121eb725baf1f1556f192938
SHA1

5c9110611a4f024be1e1bb9cfe3061c32ecc52f1
SHA256

5063b629c039f293adc7c0d153d1dafb227b18f94e3e73f294f1f6f9abafd1b8
SHA512

992f1f0dd6584cec4334101d93a32e81bf778f2b0c93b2aebb9be9fd90e15b384434a5cdbdd776b8b42c2c9a6c056ed66ba15bb032429dda7eed613206ad423a

Score

9^/10

Malware Config

Targets

- Target
  
  Mozi.maxesgwbc
- Size
  
  300KB
- MD5
  
  04a77bca121eb725baf1f1556f192938
- SHA1
  
  5c9110611a4f024be1e1bb9cfe3061c32ecc52f1
- SHA256
  
  5063b629c039f293adc7c0d153d1dafb227b18f94e3e73f294f1f6f9abafd1b8
- SHA512
  
  992f1f0dd6584cec4334101d93a32e81bf778f2b0c93b2aebb9be9fd90e15b384434a5cdbdd776b8b42c2c9a6c056ed66ba15bb032429dda7eed613206ad423a
Score

9^/10

discovery persistence
- Contacts a large (16830) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Modifies the Watchdog daemon
  Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
- Writes file to system bin folder
- Modifies hosts file
  Adds to hosts file used for mapping hosts to IP addresses.
- Writes DNS configuration
  Writes data to DNS resolver config file.
- Enumerates active TCP sockets
  Gets active TCP sockets from /proc virtual filesystem.
- Modifies init.d
  Adds/modifies system service, likely for persistence.
  persistence
- Reads system routing table
  Gets active network interfaces from /proc virtual filesystem.
- Reads system network configuration
  Uses contents of /proc filesystem to enumerate network settings.
- Reads runtime system information
  Reads data from /proc virtual filesystem.
- Writes file to tmp directory
  Malware often drops required files in the /tmp directory.
behavioral1