General

  • Target

    63124924a7d85e0bc4bb2b009b488483987c7920bbaf321fdb26d5727b22b1e3

  • Size

    32KB

  • Sample

    220521-p6c4dabhfn

  • MD5

    575ea8e951a3dda04a912b5d88c5f363

  • SHA1

    cc57400c97fea9d04a88f46fd9dceefa92d07d73

  • SHA256

    63124924a7d85e0bc4bb2b009b488483987c7920bbaf321fdb26d5727b22b1e3

  • SHA512

    08cb64b9a794d9e0b5421e7728c7b0092b84198f0b07593be6426102257e5bd8d77b720e9a16ec2bd4ffef87ee278a15fdc431fc6dceaad00ec72e59b8b3e174

Score
9/10

Malware Config

Targets

    • Target

      63124924a7d85e0bc4bb2b009b488483987c7920bbaf321fdb26d5727b22b1e3

    • Size

      32KB

    • MD5

      575ea8e951a3dda04a912b5d88c5f363

    • SHA1

      cc57400c97fea9d04a88f46fd9dceefa92d07d73

    • SHA256

      63124924a7d85e0bc4bb2b009b488483987c7920bbaf321fdb26d5727b22b1e3

    • SHA512

      08cb64b9a794d9e0b5421e7728c7b0092b84198f0b07593be6426102257e5bd8d77b720e9a16ec2bd4ffef87ee278a15fdc431fc6dceaad00ec72e59b8b3e174

    Score
    9/10
    • Contacts a large (108910) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Modifies the Watchdog daemon

      Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

    • Writes file to system bin folder

    • Reads runtime system information

      Reads data from /proc virtual filesystem.

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Hijack Execution Flow

1
T1574

Privilege Escalation

Hijack Execution Flow

1
T1574

Defense Evasion

Impair Defenses

1
T1562

Hijack Execution Flow

1
T1574

Discovery

Network Service Scanning

2
T1046

Tasks