General

  • Target

    6b2173d79577dceb0ac295851728fa8d4dce89bf6dc79661419b2a48385f241c

  • Size

    42KB

  • Sample

    220521-xqhmxsfehn

  • MD5

    17a0a6f8ea5141b5582899e176291bad

  • SHA1

    631ddaa309af3cb31a786dbce767e1ba69f28e14

  • SHA256

    6b2173d79577dceb0ac295851728fa8d4dce89bf6dc79661419b2a48385f241c

  • SHA512

    ad60e03480764315e576835382c42a44f3a53dbc38d72eee4feb6c8a515ea2fc445c2b696c6b8607d9eed0a9d1b2bd3a30d1ebfe734843acdfff338da69fd5ab

Score
9/10

Malware Config

Targets

    • Target

      6b2173d79577dceb0ac295851728fa8d4dce89bf6dc79661419b2a48385f241c

    • Size

      42KB

    • MD5

      17a0a6f8ea5141b5582899e176291bad

    • SHA1

      631ddaa309af3cb31a786dbce767e1ba69f28e14

    • SHA256

      6b2173d79577dceb0ac295851728fa8d4dce89bf6dc79661419b2a48385f241c

    • SHA512

      ad60e03480764315e576835382c42a44f3a53dbc38d72eee4feb6c8a515ea2fc445c2b696c6b8607d9eed0a9d1b2bd3a30d1ebfe734843acdfff338da69fd5ab

    Score
    9/10
    • Contacts a large (60196) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Modifies the Watchdog daemon

      Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

    • Writes file to system bin folder

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

    • Write file to user bin folder

    • Reads system network configuration

      Uses contents of /proc filesystem to enumerate network settings.

    • Reads runtime system information

      Reads data from /proc virtual filesystem.

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Hijack Execution Flow

2
T1574

Privilege Escalation

Hijack Execution Flow

2
T1574

Defense Evasion

Impair Defenses

1
T1562

Hijack Execution Flow

2
T1574

Discovery

Network Service Scanning

2
T1046

System Network Connections Discovery

1
T1049

System Network Configuration Discovery

1
T1016

Tasks