General

  • Target

    9aba71c01fc9a521144fa37885f5c5ec

  • Size

    94KB

  • Sample

    220521-x53awagagm

  • MD5

    9aba71c01fc9a521144fa37885f5c5ec

  • SHA1

    9b8833eef5c9120a87a4c800754fce73b963bd80

  • SHA256

    ce11875111e5f015148e4df06d696c655276226f0bea8191a578978e0eaa52ba

  • SHA512

    d7928a56b0a21a1bdac5d37ce7dcfb92043360aaad4725c3a762b15cd3ccf1312454c199dc06ef3f04ed64b6869c98745163aa2c9184332271f471e10294a7a8

Score
9/10

Malware Config

Targets

    • Target

      9aba71c01fc9a521144fa37885f5c5ec

    • Size

      94KB

    • MD5

      9aba71c01fc9a521144fa37885f5c5ec

    • SHA1

      9b8833eef5c9120a87a4c800754fce73b963bd80

    • SHA256

      ce11875111e5f015148e4df06d696c655276226f0bea8191a578978e0eaa52ba

    • SHA512

      d7928a56b0a21a1bdac5d37ce7dcfb92043360aaad4725c3a762b15cd3ccf1312454c199dc06ef3f04ed64b6869c98745163aa2c9184332271f471e10294a7a8

    Score
    9/10
    • Contacts a large (113042) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Modifies the Watchdog daemon

      Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

    • Writes file to system bin folder

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

    • Reads system network configuration

      Uses contents of /proc filesystem to enumerate network settings.

    • Reads runtime system information

      Reads data from /proc virtual filesystem.

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Hijack Execution Flow

1
T1574

Privilege Escalation

Hijack Execution Flow

1
T1574

Defense Evasion

Impair Defenses

1
T1562

Hijack Execution Flow

1
T1574

Discovery

Network Service Scanning

2
T1046

System Network Connections Discovery

1
T1049

System Network Configuration Discovery

1
T1016

Tasks