General

  • Target

    2c1ced87bdfe47991f6457e382ca2642f968d71eb5086424a11d41661ad6a551

  • Size

    116KB

  • Sample

    220521-xqxf3scdb9

  • MD5

    576bf85eb2b09c1525482eed251add2d

  • SHA1

    9c403fe42671bb29ea6d970a2e80ea98360b8dc1

  • SHA256

    2c1ced87bdfe47991f6457e382ca2642f968d71eb5086424a11d41661ad6a551

  • SHA512

    bf289aa0a97345be8cbcaed8df0f7a6476b8bcf7a0e65431f440208f4652fc00533cfe6abffd5aaacf91abb3f9938bb3d32a6f96f7bba4c1efad4b67e199f6e1

Score
10/10

Malware Config

Targets

    • Target

      2c1ced87bdfe47991f6457e382ca2642f968d71eb5086424a11d41661ad6a551

    • Size

      116KB

    • MD5

      576bf85eb2b09c1525482eed251add2d

    • SHA1

      9c403fe42671bb29ea6d970a2e80ea98360b8dc1

    • SHA256

      2c1ced87bdfe47991f6457e382ca2642f968d71eb5086424a11d41661ad6a551

    • SHA512

      bf289aa0a97345be8cbcaed8df0f7a6476b8bcf7a0e65431f440208f4652fc00533cfe6abffd5aaacf91abb3f9938bb3d32a6f96f7bba4c1efad4b67e199f6e1

    Score
    9/10
    • Contacts a large (52035) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Modifies the Watchdog daemon

      Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

    • Writes file to system bin folder

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

    • Reads system network configuration

      Uses contents of /proc filesystem to enumerate network settings.

    • Reads runtime system information

      Reads data from /proc virtual filesystem.

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Hijack Execution Flow

1
T1574

Privilege Escalation

Hijack Execution Flow

1
T1574

Defense Evasion

Impair Defenses

1
T1562

Hijack Execution Flow

1
T1574

Discovery

Network Service Scanning

2
T1046

System Network Connections Discovery

1
T1049

System Network Configuration Discovery

1
T1016

Tasks