Overview

overview

9

Static

static

8

Mozi.mgzrjnsnf

linux_mips

9

Analysis

  • max time kernel
    0s
  • max time network
    57s
  • platform
    linux_mips
  • resource
    debian9-mipsbe-en-20211208
  • submitted
    25-04-2022 23:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Mozi.mgzrjnsnf

  • Size

    106KB

  • MD5

    4dde761681684d7edad4e5e1ffdb940b

  • SHA1

    2327be693bc11a618c380d7d3abc2382d870d48b

  • SHA256

    d546509ab6670f9ff31783ed72875dfc0f37fa2b666bd5870eecaaed2ebea4a8

  • SHA512

    91a61c719128f263f9f95736d55895954cc468c74ff469ee061d35ec382c50b9165e9a5427dc46a835dac6ae0e6e1f9819632475f68b98a907b53196bd4eb02a

Score
9/10

Malware Config

Signatures

  • Modifies the Watchdog daemon 1 TTPs

    Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

  • Writes file to system bin folder 1 TTPs 2 IoCs
  • Modifies hosts file 1 IoCs

    Adds to hosts file used for mapping hosts to IP addresses.

  • Enumerates active TCP sockets 1 TTPs 1 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

  • Reads system network configuration 1 TTPs 2 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

  • Writes file to tmp directory 2 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • ./Mozi.mgzrjnsnf
    ./Mozi.mgzrjnsnf
    1⤵
      PID:331
    • /bin/sh
      sh -c "iptables -I INPUT -p tcp --destination-port 22 -j DROP"
      1⤵
        PID:338
        • /sbin/iptables
          iptables -I INPUT -p tcp --destination-port 22 -j DROP
          2⤵
            PID:339
        • /bin/sh
          sh -c "iptables -I INPUT -p tcp --destination-port 60907 -j ACCEPT"
          1⤵
            PID:340
            • /sbin/iptables
              iptables -I INPUT -p tcp --destination-port 60907 -j ACCEPT
              2⤵
                PID:345
            • /bin/sh
              sh -c "iptables -I INPUT -p tcp --destination-port 23 -j DROP"
              1⤵
                PID:349
                • /sbin/iptables
                  iptables -I INPUT -p tcp --destination-port 23 -j DROP
                  2⤵
                    PID:350
                • /bin/sh
                  sh -c "iptables -I INPUT -p tcp --destination-port 2323 -j DROP"
                  1⤵
                    PID:351
                    • /sbin/iptables
                      iptables -I INPUT -p tcp --destination-port 2323 -j DROP
                      2⤵
                        PID:352
                    • /bin/sh
                      sh -c "iptables -I OUTPUT -p tcp --source-port 22 -j DROP"
                      1⤵
                        PID:353
                        • /sbin/iptables
                          iptables -I OUTPUT -p tcp --source-port 22 -j DROP
                          2⤵
                            PID:354
                        • /bin/sh
                          sh -c "iptables -I OUTPUT -p tcp --source-port 60907 -j ACCEPT"
                          1⤵
                            PID:355
                            • /sbin/iptables
                              iptables -I OUTPUT -p tcp --source-port 60907 -j ACCEPT
                              2⤵
                                PID:356
                            • /bin/sh
                              sh -c "iptables -I OUTPUT -p tcp --source-port 23 -j DROP"
                              1⤵
                                PID:357
                                • /sbin/iptables
                                  iptables -I OUTPUT -p tcp --source-port 23 -j DROP
                                  2⤵
                                    PID:358
                                • /bin/sh
                                  sh -c "iptables -I PREROUTING -t nat -p tcp --destination-port 60907 -j ACCEPT"
                                  1⤵
                                    PID:359
                                    • /sbin/iptables
                                      iptables -I PREROUTING -t nat -p tcp --destination-port 60907 -j ACCEPT
                                      2⤵
                                        PID:361
                                    • /bin/sh
                                      sh -c "iptables -I OUTPUT -p tcp --source-port 2323 -j DROP"
                                      1⤵
                                        PID:360
                                        • /sbin/iptables
                                          iptables -I OUTPUT -p tcp --source-port 2323 -j DROP
                                          2⤵
                                            PID:362

                                        Network

                                        MITRE ATT&CK Matrix ATT&CK v6

                                        Initial Access

                                        Execution

                                        Persistence

                                        Hijack Execution Flow

                                        1
                                        T1574

                                        Privilege Escalation

                                        Hijack Execution Flow

                                        1
                                        T1574

                                        Defense Evasion

                                        Impair Defenses

                                        1
                                        T1562

                                        Hijack Execution Flow

                                        1
                                        T1574

                                        Credential Access

                                        Discovery

                                        System Network Connections Discovery

                                        1
                                        T1049

                                        System Network Configuration Discovery

                                        1
                                        T1016

                                        Lateral Movement

                                        Collection

                                        Exfiltration

                                        Command and Control

                                        Impact

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads