4d855c687891b1d28c34213ca9447cfcdef20e4f7be567d1f3fef1eb686349c6

General

Target

d546509ab6670f9ff31783ed72875dfc0f37fa2b666bd5870eecaaed2ebea4a8
Size

103KB
Sample

230131-zk3r1scc2s
MD5

972061d63311b0d08d13f944c4536106
SHA1

a27c3f23f0222d182ad32d3dab698bf62eadb2a5
SHA256

4d855c687891b1d28c34213ca9447cfcdef20e4f7be567d1f3fef1eb686349c6
SHA512

832dbaac3c2b620701a10fab903d19af9b9deac5c7d4cef149753b3dbd04e54abafc7b22ca7581e886c91b30a0cc64aa7e7006c6376e409cd36a3f78610d8fc6
SSDEEP

1536:Omxh3aoVOFd4zRmMSFMMSk3jdNiTieuLBBybfqx3sknMv0Hcsi2h2I1j9EL9umSy:93aoC69mNSkx+iBm5v0HHR2I1jKUmr

Score

9^/10

discovery persistence

Malware Config

Targets

- Target
  
  d546509ab6670f9ff31783ed72875dfc0f37fa2b666bd5870eecaaed2ebea4a8
- Size
  
  106KB
- MD5
  
  4dde761681684d7edad4e5e1ffdb940b
- SHA1
  
  2327be693bc11a618c380d7d3abc2382d870d48b
- SHA256
  
  d546509ab6670f9ff31783ed72875dfc0f37fa2b666bd5870eecaaed2ebea4a8
- SHA512
  
  91a61c719128f263f9f95736d55895954cc468c74ff469ee061d35ec382c50b9165e9a5427dc46a835dac6ae0e6e1f9819632475f68b98a907b53196bd4eb02a
- SSDEEP
  
  1536:3aQiZDMyqIlMBZ/R0F4E4kcHiNq98wk9njKZjjLuYo68864sNHFEzv7Ld76divkE:KzDMyqIMBZ/R0ufhBmgZy9yNsNmPtcE
Score

9^/10

discovery persistence
- Modifies the Watchdog daemon
  Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
- Writes file to system bin folder
- Modifies hosts file
  Adds to hosts file used for mapping hosts to IP addresses.
- Writes DNS configuration
  Writes data to DNS resolver config file.
- Enumerates active TCP sockets
  Gets active TCP sockets from /proc virtual filesystem.
- Modifies init.d
  Adds/modifies system service, likely for persistence.
  persistence
- Reads system routing table
  Gets active network interfaces from /proc virtual filesystem.
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Reads system network configuration
  Uses contents of /proc filesystem to enumerate network settings.
- Writes file to tmp directory
  Malware often drops required files in the /tmp directory.
behavioral1