6f3dd659cc023968034fab1c2aa04246590a7ede8ba2490cc75fc5efb96496a7 | Triage

Sharing

General

Target

d546509ab6670f9ff31783ed72875dfc0f37fa2b666bd5870eecaaed2ebea4a8
Size

103KB
Sample

230203-megw5sec27
MD5

a72cf0a1e3f99e2964f71381e50f6971
SHA1

64bd9cae89dc2a2f958cd442c2b16e33bc95e226
SHA256

6f3dd659cc023968034fab1c2aa04246590a7ede8ba2490cc75fc5efb96496a7
SHA512

bba8ac9700abc2c20e6525413e9f65e464593da34a3a82cc0e8d34f2d0363c5ca6e97968fd9ff20193144ef69eb4e4c56f55c89367f020d927d2ae83b05b4c14
SSDEEP

1536:Fmxh3aoVOFd4zRmMSFMMSk3jdNiTieuLBBybfqx3sknMv0Hcsi2h2I1j9EL9umSX:g3aoC69mNSkx+iBm5v0HHR2I1jKUmC

Score

9^/10

discovery persistence

Malware Config

Targets

- Target
  
  d546509ab6670f9ff31783ed72875dfc0f37fa2b666bd5870eecaaed2ebea4a8
- Size
  
  106KB
- MD5
  
  4dde761681684d7edad4e5e1ffdb940b
- SHA1
  
  2327be693bc11a618c380d7d3abc2382d870d48b
- SHA256
  
  d546509ab6670f9ff31783ed72875dfc0f37fa2b666bd5870eecaaed2ebea4a8
- SHA512
  
  91a61c719128f263f9f95736d55895954cc468c74ff469ee061d35ec382c50b9165e9a5427dc46a835dac6ae0e6e1f9819632475f68b98a907b53196bd4eb02a
- SSDEEP
  
  1536:3aQiZDMyqIlMBZ/R0F4E4kcHiNq98wk9njKZjjLuYo68864sNHFEzv7Ld76divkE:KzDMyqIMBZ/R0ufhBmgZy9yNsNmPtcE
Score

9^/10

discovery persistence
- Contacts a large (3698) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Modifies the Watchdog daemon
  Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
- Writes file to system bin folder
- Modifies hosts file
  Adds to hosts file used for mapping hosts to IP addresses.
- Writes DNS configuration
  Writes data to DNS resolver config file.
- Enumerates active TCP sockets
  Gets active TCP sockets from /proc virtual filesystem.
- Modifies init.d
  Adds/modifies system service, likely for persistence.
  persistence
- Reads system network configuration
  Uses contents of /proc filesystem to enumerate network settings.
- Writes file to tmp directory
  Malware often drops required files in the /tmp directory.
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Hijack Execution Flow

Privilege Escalation

Boot or Logon Autostart Execution

Hijack Execution Flow

Defense Evasion

Hijack Execution Flow

Impair Defenses

Credential Access

Discovery

Network Service Scanning

System Network Configuration Discovery

System Network Connections Discovery

Lateral Movement

Collection

Command and Control

Dynamic Resolution

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence