8ceed6ebb7cb1c37fa78f972953aa8a3a55b8891756c35fead90835cb7c3d1fb | Triage

Sharing

General

Target

6b984a2af1d8a8c46e5dcd9267098863
Size

50KB
Sample

220815-cezrvachgr
MD5

6b984a2af1d8a8c46e5dcd9267098863
SHA1

ccae0d90fc5fdd9d2088235b9fa72f4c033e3959
SHA256

8ceed6ebb7cb1c37fa78f972953aa8a3a55b8891756c35fead90835cb7c3d1fb
SHA512

6c101e9bf0a2f47c574652791ac571cccebc1d7d9ecb1c25980a26c2105625b36cc00e7037bacf47ae6fb30dd5e67f3ee1462098245f974100c8e67e4bae40db

Score

9^/10

discovery

Malware Config

Targets

- Target
  
  6b984a2af1d8a8c46e5dcd9267098863
- Size
  
  50KB
- MD5
  
  6b984a2af1d8a8c46e5dcd9267098863
- SHA1
  
  ccae0d90fc5fdd9d2088235b9fa72f4c033e3959
- SHA256
  
  8ceed6ebb7cb1c37fa78f972953aa8a3a55b8891756c35fead90835cb7c3d1fb
- SHA512
  
  6c101e9bf0a2f47c574652791ac571cccebc1d7d9ecb1c25980a26c2105625b36cc00e7037bacf47ae6fb30dd5e67f3ee1462098245f974100c8e67e4bae40db
Score

9^/10

discovery
- Modifies the Watchdog daemon
  Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
- Writes file to system bin folder
- Contacts a large (575) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Enumerates active TCP sockets
  Gets active TCP sockets from /proc virtual filesystem.
- Reads system network configuration
  Uses contents of /proc filesystem to enumerate network settings.
- Reads runtime system information
  Reads data from /proc virtual filesystem.
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hijack Execution Flow

Privilege Escalation

Hijack Execution Flow

Defense Evasion

Hijack Execution Flow

Impair Defenses

Credential Access

Discovery

Network Service Scanning

System Network Configuration Discovery

System Network Connections Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1