Overview

overview

9

Static

static

8

Mozi.m

debian-9-mips

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Mozi.m

  • Size

    129KB

  • Sample

    221118-de23msgd58

  • MD5

    dbc520ea1518748fec9fcfcf29755c30

  • SHA1

    0a427f86b4360fb603c6e3c5878c9be7ced59adc

  • SHA256

    c672798dca67f796972b42ad0c89e25d589d2e70eb41892d26adbb6a79f63887

  • SHA512

    6d42025c8c4b1778de583fb4468da72750e8d6022f24e1e8c5cd6b1ff853eb2cdeb9de75338e37da729be2576a7e8e8aa3cdf184b1a9f6b27b6169e23d724055

  • SSDEEP

    3072:Nc4i0agsmw3Py5CP5HM8EVLUuYtgB5H6oz:Nc/0aNPy54EVAhOae

Score
9/10
discoverypersistence

Malware Config

Targets

    • Target

      Mozi.m

    • Size

      129KB

    • MD5

      dbc520ea1518748fec9fcfcf29755c30

    • SHA1

      0a427f86b4360fb603c6e3c5878c9be7ced59adc

    • SHA256

      c672798dca67f796972b42ad0c89e25d589d2e70eb41892d26adbb6a79f63887

    • SHA512

      6d42025c8c4b1778de583fb4468da72750e8d6022f24e1e8c5cd6b1ff853eb2cdeb9de75338e37da729be2576a7e8e8aa3cdf184b1a9f6b27b6169e23d724055

    • SSDEEP

      3072:Nc4i0agsmw3Py5CP5HM8EVLUuYtgB5H6oz:Nc/0aNPy54EVAhOae

    Score
    9/10
    discoverypersistence

    • Modifies the Watchdog daemon

      Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

    • Writes file to system bin folder

    • Modifies hosts file

      Adds to hosts file used for mapping hosts to IP addresses.

    • Writes DNS configuration

      Writes data to DNS resolver config file.

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

    • Modifies init.d

      Adds/modifies system service, likely for persistence.

      persistence

    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Reads system network configuration

      Uses contents of /proc filesystem to enumerate network settings.

    • Reads runtime system information

      Reads data from /proc virtual filesystem.

    • Writes file to tmp directory

      Malware often drops required files in the /tmp directory.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hijack Execution Flow

1
T1574

Boot or Logon Autostart Execution

1
T1547

Privilege Escalation

Hijack Execution Flow

1
T1574

Boot or Logon Autostart Execution

1
T1547

Defense Evasion

Impair Defenses

1
T1562

Hijack Execution Flow

1
T1574

Credential Access

Discovery

System Network Connections Discovery

1
T1049

System Network Configuration Discovery

2
T1016

Network Service Scanning

1
T1046

Lateral Movement

Collection

Exfiltration

Command and Control

Dynamic Resolution

1
T1568

Impact

Tasks