f8cc042317dc129ac5ea4b675139c9d3abf3f4670903b17fe6c5c65b82f1c506

General

Target

f8cc042317dc129ac5ea4b675139c9d3abf3f4670903b17fe6c5c65b82f1c506
Size

603B
MD5

cd00bcf841a3eede649d5a1797a03f5c
SHA1

c35f0a6d69f6bfaa044260ed939eef4a93ff7374
SHA256

f8cc042317dc129ac5ea4b675139c9d3abf3f4670903b17fe6c5c65b82f1c506
SHA512

2a66497bfd183b004f023b46587d930da375147ff5cc6edad3ce26c2584204798d10fa5edc25c0b246978a795c84c8998b0f50ec01d89f8682b400ae7e371706

Score

9^/10

Malware Config

Signatures

Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

Impair Defenses
T1562

Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

Processes:

rm

description	ioc	process
/sys/dev/block/8:1/start/xt_hl.ko	/sys/dev/block/8:1/start/xt_hl.ko	rm
/sys/dev/block/8:1/start/rfcomm	/sys/dev/block/8:1/start/rfcomm	rm
/sys/dev/block/8:1/i2c	/sys/dev/block/8:1/i2c	rm
/sys/dev/block/8:1/xfs	/sys/dev/block/8:1/xfs	rm
/sys/dev/block/8:1/start/fuse.ko	/sys/dev/block/8:1/start/fuse.ko	rm
/sys/dev/block/8:1/start/upstart	/sys/dev/block/8:1/start/upstart	rm
/sys/dev/block/8:1/start/rc-dntv-live-dvb-t.ko	/sys/dev/block/8:1/start/rc-dntv-live-dvb-t.ko	rm
/sys/dev/block/8:1/start/mspro_block.ko	/sys/dev/block/8:1/start/mspro_block.ko	rm
/sys/dev/block/8:1/string.h	/sys/dev/block/8:1/string.h	rm
/sys/dev/block/8:1/isdn_divertif.h	/sys/dev/block/8:1/isdn_divertif.h	rm
/sys/dev/block/8:1/lnstat	/sys/dev/block/8:1/lnstat	rm
/sys/dev/block/8:1/start/ipaq.h	/sys/dev/block/8:1/start/ipaq.h	rm
/sys/dev/block/8:1/start/priority.h	/sys/dev/block/8:1/start/priority.h	rm
/sys/dev/block/8:1/saa7185.ko	/sys/dev/block/8:1/saa7185.ko	rm
/sys/dev/block/8:1/start/xt_helper.ko	/sys/dev/block/8:1/start/xt_helper.ko	rm
/sys/dev/block/8:1/start/hfsplus.ko	/sys/dev/block/8:1/start/hfsplus.ko	rm
/sys/dev/block/8:1/start/fscrypto.ko	/sys/dev/block/8:1/start/fscrypto.ko	rm
/sys/dev/block/8:1/start/des_crypt.h	/sys/dev/block/8:1/start/des_crypt.h	rm
/sys/dev/block/8:1/mips-linux-gnu-gcc	/sys/dev/block/8:1/mips-linux-gnu-gcc	rm
/sys/dev/block/8:1/start/869.h	/sys/dev/block/8:1/start/869.h	rm
/sys/dev/block/8:1/start/mr97310a.h	/sys/dev/block/8:1/start/mr97310a.h	rm
/sys/dev/block/8:1/start/systemd-initctl.service	/sys/dev/block/8:1/start/systemd-initctl.service	rm
/sys/dev/block/8:1/pvrusb2	/sys/dev/block/8:1/pvrusb2	rm
/sys/dev/block/8:1/rndis_wlan.ko	/sys/dev/block/8:1/rndis_wlan.ko	rm
/sys/dev/block/8:1/start/sch_sfq.ko	/sys/dev/block/8:1/start/sch_sfq.ko	rm
/sys/dev/block/8:1/batman-adv	/sys/dev/block/8:1/batman-adv	rm
/sys/dev/block/8:1/start/array	/sys/dev/block/8:1/start/array	rm
/sys/dev/block/netash	/sys/dev/block/netash	rm
/sys/dev/block/8:1/mips-linux-gnu-ld.bfd	/sys/dev/block/8:1/mips-linux-gnu-ld.bfd	rm
/sys/dev/block/8:1/debug	/sys/dev/block/8:1/debug	rm
/sys/dev/block/8:1/upd64083.ko	/sys/dev/block/8:1/upd64083.ko	rm
/sys/dev/block/8:1/dm-bufio.ko	/sys/dev/block/8:1/dm-bufio.ko	rm
/sys/dev/block/8:1/mips32	/sys/dev/block/8:1/mips32	rm
/sys/dev/block/8:1/start/tea575x	/sys/dev/block/8:1/start/tea575x	rm
/sys/dev/block/8:1/defrag	/sys/dev/block/8:1/defrag	rm
/sys/dev/block/8:1/tsc2007.h	/sys/dev/block/8:1/tsc2007.h	rm
/sys/dev/block/pcspkr	/sys/dev/block/pcspkr	rm
/sys/dev/block/8:1/start/cx18-alsa.ko	/sys/dev/block/8:1/start/cx18-alsa.ko	rm
/sys/dev/block/8:1/ir-rc5-decoder.ko	/sys/dev/block/8:1/ir-rc5-decoder.ko	rm
/sys/dev/block/8:1/obstack.h	/sys/dev/block/8:1/obstack.h	rm
/sys/dev/block/8:1/ext.h	/sys/dev/block/8:1/ext.h	rm
/sys/dev/block/8:1/ks0127.ko	/sys/dev/block/8:1/ks0127.ko	rm
/sys/dev/block/8:1/start/atmel_pci.ko	/sys/dev/block/8:1/start/atmel_pci.ko	rm
/sys/dev/block/8:1/start/acct.h	/sys/dev/block/8:1/start/acct.h	rm
/sys/dev/block/8:1/cmode	/sys/dev/block/8:1/cmode	rm
/sys/dev/block/8:1/start/rc-it913x-v2.ko	/sys/dev/block/8:1/start/rc-it913x-v2.ko	rm
/sys/dev/block/8:1/start/ieee754.h	/sys/dev/block/8:1/start/ieee754.h	rm
/sys/dev/block/8:1/start/ipt_REJECT.h	/sys/dev/block/8:1/start/ipt_REJECT.h	rm
/sys/dev/block/8:1/start/852.h	/sys/dev/block/8:1/start/852.h	rm
/sys/dev/block/8:1/bcache	/sys/dev/block/8:1/bcache	rm
/sys/dev/block/8:1/start/nf_conntrack_amanda.ko	/sys/dev/block/8:1/start/nf_conntrack_amanda.ko	rm
/sys/dev/block/8:1/neteconet	/sys/dev/block/8:1/neteconet	rm
/sys/dev/block/8:1/start/usb	/sys/dev/block/8:1/start/usb	rm
/sys/dev/block/8:1/user	/sys/dev/block/8:1/user	rm
/sys/dev/block/8:1/start/ec.h	/sys/dev/block/8:1/start/ec.h	rm
/sys/dev/block/8:1/mroute.h	/sys/dev/block/8:1/mroute.h	rm
/sys/dev/block/8:1/du	/sys/dev/block/8:1/du	rm
/sys/dev/block/8:1/uhci	/sys/dev/block/8:1/uhci	rm
/sys/dev/block/8:1/dp83848.ko	/sys/dev/block/8:1/dp83848.ko	rm
/sys/dev/block/8:1/ubi	/sys/dev/block/8:1/ubi	rm
/sys/dev/block/8:1/if_eql.h	/sys/dev/block/8:1/if_eql.h	rm
/sys/dev/block/8:1/start/systemd-fsckd.service	/sys/dev/block/8:1/start/systemd-fsckd.service	rm
/sys/dev/block/8:1/start/ctgmath	/sys/dev/block/8:1/start/ctgmath	rm
/sys/dev/block/8:1/start/size.h	/sys/dev/block/8:1/start/size.h	rm

Reads runtime system information 5 IoCs

Reads data from /proc virtual filesystem.

Processes:

fdiskmkfs.ext2mkdirmount

description	ioc	process
/proc/partitions	/proc/partitions	fdisk
/proc/swaps	/proc/swaps	mkfs.ext2
/proc/filesystems	/proc/filesystems	mkdir
/proc/mounts	/proc/mounts	mkfs.ext2
/proc/filesystems	/proc/filesystems	mount

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

Processes:

f8cc042317dc129ac5ea4b675139c9d3abf3f4670903b17fe6c5c65b82f1c506

description	ioc	process
/tmp/f8cc042317dc129ac5ea4b675139c9d3abf3f4670903b17fe6c5c65b82f1c506	/tmp/f8cc042317dc129ac5ea4b675139c9d3abf3f4670903b17fe6c5c65b82f1c506	f8cc042317dc129ac5ea4b675139c9d3abf3f4670903b17fe6c5c65b82f1c506

/tmp/f8cc042317dc129ac5ea4b675139c9d3abf3f4670903b17fe6c5c65b82f1c506
/tmp/f8cc042317dc129ac5ea4b675139c9d3abf3f4670903b17fe6c5c65b82f1c506
1⤵
- Writes file to tmp directory
PID:323
- /sbin/fdisk
  fdisk /dev/sda
  2⤵
  PID:333
- /sbin/mkfs.ext2
  mkfs.ext2 /dev/sda1
  2⤵
  - Reads runtime system information
  PID:334
- /bin/rm
  rm -rf hd
  2⤵
  PID:335
- /bin/mkdir
  mkdir hd
  2⤵
  - Reads runtime system information
  PID:336
- /bin/mount
  mount /dev/sda1 hd
  2⤵
  - Reads runtime system information
  PID:337
- /bin/rm
  rm -rf hd/bin hd/boot hd/dev hd/etc hd/home hd/initrd.img hd/initrd.img.old hd/lib hd/lost+found hd/media hd/mnt hd/opt hd/proc hd/root hd/run hd/sbin hd/srv hd/sys hd/tmp hd/usr hd/var hd/vmlinux hd/vmlinux.old
  2⤵
  - Enumerates kernel/hardware configuration
  PID:340

/bin/grep
grep -m 1 Disk
1⤵
PID:330

/sbin/fdisk
fdisk -l
1⤵
- Reads runtime system information
PID:329

/usr/bin/awk
awk -F: "{print \$1}"
1⤵
PID:332

/usr/bin/awk
awk "{print \$2}"
1⤵
PID:331

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

1

T1562

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads