Behavioral Report

max time kernel11953s
max time network178s
platformlinux_mips
resourcedebian9-mipsbe-en-20211208
submitted25-04-2022 22:49

Report
Files
Registry
Network
Processes
Mutex
Misc

Target

mozi.mbymzlvzq

Filesize

106KB

Completed

26-04-2022 01:26

Task

behavioral1

Score

10^/10

MD5

4dde761681684d7edad4e5e1ffdb940b

SHA1

2327be693bc11a618c380d7d3abc2382d870d48b

SHA256

d546509ab6670f9ff31783ed72875dfc0f37fa2b666bd5870eecaaed2ebea4a8

SHA512

91a61c719128f263f9f95736d55895954cc468c74ff469ee061d35ec382c50b9165e9a5427dc46a835dac6ae0e6e1f9819632475f68b98a907b53196bd4eb02a

discovery persistence suricata

Discovery

suricata: ET MALWARE Mirai Variant User-Agent (Outbound)

Description

suricata: ET MALWARE Mirai Variant User-Agent (Outbound)

Tags

suricata
Contacts a large (7762) amount of remote hosts

Description

This may indicate a network scan to discover remotely running services.

Tags

discovery

TTPs

Network Service Scanning
Modifies the Watchdog daemon

Description

Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

TTPs
Writes file to system bin folder

TTPs

Reported IOCs

description ioc

/bin/watchdog /bin/watchdog
/sbin/watchdog /sbin/watchdog
Modifies hosts file

Description

Adds to hosts file used for mapping hosts to IP addresses.

Reported IOCs

description ioc

/etc/hosts /etc/hosts
Writes DNS configuration

Description

Writes data to DNS resolver config file.

TTPs

Reported IOCs

description ioc

/etc/resolv.conf /etc/resolv.conf
Enumerates active TCP sockets

Description

Gets active TCP sockets from /proc virtual filesystem.

TTPs

System Network Connections Discovery

Reported IOCs

description ioc

/proc/net/tcp /proc/net/tcp
Modifies init.d

Description

Adds/modifies system service, likely for persistence.

Tags

persistence

TTPs

Reported IOCs

description ioc

/etc/init.d/S95baby.sh /etc/init.d/S95baby.sh
Reads system routing table

Description

Gets active network interfaces from /proc virtual filesystem.

TTPs

System Network Configuration Discovery

Reported IOCs

description ioc

/proc/net/route /proc/net/route
Creates a large amount of network flows

Description

This may indicate a network scan to discover remotely running services.

Tags

discovery

TTPs

Network Service Scanning
Reads system network configuration

Description

Uses contents of /proc filesystem to enumerate network settings.

TTPs

System Network Configuration Discovery

Reported IOCs

description ioc

/proc/net/raw /proc/net/raw
/proc/net/tcp /proc/net/tcp
/proc/net/route /proc/net/route
Writes file to tmp directory

Description

Malware often drops required files in the /tmp directory.

Reported IOCs

description ioc

/tmp/mozi.mbymzlvzq /tmp/mozi.mbymzlvzq
/tmp/config /tmp/config

description	ioc
/bin/watchdog	/bin/watchdog
/sbin/watchdog	/sbin/watchdog

description	ioc
/etc/hosts	/etc/hosts

description	ioc
/etc/resolv.conf	/etc/resolv.conf

description	ioc
/proc/net/tcp	/proc/net/tcp

description	ioc
/etc/init.d/S95baby.sh	/etc/init.d/S95baby.sh

description	ioc
/proc/net/route	/proc/net/route

description	ioc
/proc/net/raw	/proc/net/raw
/proc/net/tcp	/proc/net/tcp
/proc/net/route	/proc/net/route

description	ioc
/tmp/mozi.mbymzlvzq	/tmp/mozi.mbymzlvzq
/tmp/config	/tmp/config

./mozi.mbymzlvzq

./mozi.mbymzlvzq

PID:320

/bin/sh

sh -c "iptables -I INPUT -p tcp --destination-port 22 -j DROP"

PID:327

/sbin/iptables

iptables -I INPUT -p tcp --destination-port 22 -j DROP

PID:328

/bin/sh

sh -c "iptables -I INPUT -p tcp --destination-port 23 -j DROP"

PID:337

/sbin/iptables

iptables -I INPUT -p tcp --destination-port 23 -j DROP

PID:338

/bin/sh

sh -c "iptables -I INPUT -p tcp --destination-port 2323 -j DROP"

PID:339

/sbin/iptables

iptables -I INPUT -p tcp --destination-port 2323 -j DROP

PID:340

/bin/sh

sh -c "iptables -I OUTPUT -p tcp --source-port 22 -j DROP"

PID:341

/sbin/iptables

iptables -I OUTPUT -p tcp --source-port 22 -j DROP

PID:342

/bin/sh

sh -c "iptables -I OUTPUT -p tcp --source-port 23 -j DROP"

PID:343

/sbin/iptables

iptables -I OUTPUT -p tcp --source-port 23 -j DROP

PID:344

/bin/sh

sh -c "iptables -I OUTPUT -p tcp --source-port 2323 -j DROP"

PID:345

/sbin/iptables

iptables -I OUTPUT -p tcp --source-port 2323 -j DROP

PID:346

/bin/sh

sh -c "iptables -I INPUT -p tcp --destination-port 58000 -j DROP"

PID:347

/sbin/iptables

iptables -I INPUT -p tcp --destination-port 58000 -j DROP

PID:348

/bin/sh

sh -c "iptables -I OUTPUT -p tcp --source-port 58000 -j DROP"

PID:349

/sbin/iptables

iptables -I OUTPUT -p tcp --source-port 58000 -j DROP

PID:350

/bin/sh

sh -c "cfgtool set /mnt/jffs2/hw_ctree.xml InternetGatewayDevice.ManagementServer URL \"http://127.0.0.1\""

PID:351

/bin/sh

sh -c "cfgtool set /mnt/jffs2/hw_ctree.xml InternetGatewayDevice.ManagementServer ConnectionRequestPassword \"acsMozi\""

PID:352

/bin/sh

sh -c "iptables -I INPUT -p tcp --destination-port 35000 -j DROP"

PID:353

/sbin/iptables

iptables -I INPUT -p tcp --destination-port 35000 -j DROP

PID:354

/bin/sh

sh -c "iptables -I INPUT -p tcp --destination-port 50023 -j DROP"

PID:355

/sbin/iptables

iptables -I INPUT -p tcp --destination-port 50023 -j DROP

PID:356

/bin/sh

sh -c "iptables -I OUTPUT -p tcp --source-port 50023 -j DROP"

PID:357

/sbin/iptables

iptables -I OUTPUT -p tcp --source-port 50023 -j DROP

PID:358

/bin/sh

sh -c "iptables -I OUTPUT -p tcp --source-port 35000 -j DROP"

PID:359

/sbin/iptables

iptables -I OUTPUT -p tcp --source-port 35000 -j DROP

PID:360

/bin/sh

sh -c "iptables -I INPUT -p tcp --destination-port 7547 -j DROP"

PID:361

/sbin/iptables

iptables -I INPUT -p tcp --destination-port 7547 -j DROP

PID:362

/bin/sh

sh -c "iptables -I OUTPUT -p tcp --source-port 7547 -j DROP"

PID:363

/sbin/iptables

iptables -I OUTPUT -p tcp --source-port 7547 -j DROP

PID:364

/bin/sh

sh -c "iptables -I INPUT -p tcp --destination-port 48609 -j ACCEPT"

PID:365

/sbin/iptables

iptables -I INPUT -p tcp --destination-port 48609 -j ACCEPT

PID:366

/bin/sh

sh -c "iptables -I OUTPUT -p tcp --source-port 48609 -j ACCEPT"

PID:367

/sbin/iptables

iptables -I OUTPUT -p tcp --source-port 48609 -j ACCEPT

PID:368

/bin/sh

sh -c "iptables -I PREROUTING -t nat -p tcp --destination-port 48609 -j ACCEPT"

PID:369

/sbin/iptables

iptables -I PREROUTING -t nat -p tcp --destination-port 48609 -j ACCEPT

PID:370

/bin/sh

sh -c "iptables -I POSTROUTING -t nat -p tcp --source-port 48609 -j ACCEPT"

PID:378

/sbin/iptables

iptables -I POSTROUTING -t nat -p tcp --source-port 48609 -j ACCEPT

PID:379

/bin/sh

sh -c "iptables -I INPUT -p udp --destination-port 5353 -j ACCEPT"

PID:380

/sbin/iptables

iptables -I INPUT -p udp --destination-port 5353 -j ACCEPT

PID:381

/bin/sh

sh -c "iptables -I OUTPUT -p udp --source-port 5353 -j ACCEPT"

PID:382

/sbin/iptables

iptables -I OUTPUT -p udp --source-port 5353 -j ACCEPT

PID:383

/bin/sh

sh -c "iptables -I PREROUTING -t nat -p udp --destination-port 5353 -j ACCEPT"

PID:384

/sbin/iptables

iptables -I PREROUTING -t nat -p udp --destination-port 5353 -j ACCEPT

PID:385

/bin/sh

sh -c "iptables -I POSTROUTING -t nat -p udp --source-port 5353 -j ACCEPT"

PID:386

/sbin/iptables

iptables -I POSTROUTING -t nat -p udp --source-port 5353 -j ACCEPT

PID:387

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

00:00 00:00

Filter: none

Description

Tags

Description

Tags

TTPs

Description

TTPs

TTPs

Reported IOCs

Description

Reported IOCs

Description

TTPs

Reported IOCs

Description

TTPs

Reported IOCs

Description

Tags

TTPs

Reported IOCs

Description

TTPs

Reported IOCs

Description

Tags

TTPs

Description

TTPs

Reported IOCs

Description

Reported IOCs

Title