Overview

overview

9

Static

static

xd.arm7

debian-9-armhf

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    xd.arm7

  • Size

    77KB

  • Sample

    220915-me273scgb6

  • MD5

    2facd7d4c074714af9f892c35db8d1fb

  • SHA1

    028d493b0c705c6327106093c4755bcc3fbb9e1b

  • SHA256

    32dea23373931847ea476eb0b653a0477b77d8ea1c6398d9a02ff65e6bfd8b2f

  • SHA512

    a4b7b8857d5ea79634b071962ebf57aea9b35ece5592ef9fe29b3026706379e885c7291b42fd104e6fd36d996ba4ef6341f9572caeb90737406ba5a3742aea9c

  • SSDEEP

    1536:0Wgk6x1D359N7DlAZ4tnpuEjKANjL/dBGWtQahcuJbpUBX0:jt6x1Dp9kZWnpPjndwWtQarJbpUBX0

Score
9/10
discovery

Malware Config

Targets

    • Target

      xd.arm7

    • Size

      77KB

    • MD5

      2facd7d4c074714af9f892c35db8d1fb

    • SHA1

      028d493b0c705c6327106093c4755bcc3fbb9e1b

    • SHA256

      32dea23373931847ea476eb0b653a0477b77d8ea1c6398d9a02ff65e6bfd8b2f

    • SHA512

      a4b7b8857d5ea79634b071962ebf57aea9b35ece5592ef9fe29b3026706379e885c7291b42fd104e6fd36d996ba4ef6341f9572caeb90737406ba5a3742aea9c

    • SSDEEP

      1536:0Wgk6x1D359N7DlAZ4tnpuEjKANjL/dBGWtQahcuJbpUBX0:jt6x1Dp9kZWnpPjndwWtQarJbpUBX0

    Score
    9/10
    discovery

    • Contacts a large (405376) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Modifies the Watchdog daemon

      Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

    • Writes file to system bin folder

    • Modifies hosts file

      Adds to hosts file used for mapping hosts to IP addresses.

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

    • Write file to user bin folder

    • Reads system network configuration

      Uses contents of /proc filesystem to enumerate network settings.

    • Reads runtime system information

      Reads data from /proc virtual filesystem.

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks