General
-
Target
mozi.m
-
Size
134KB
-
Sample
230630-p2agpade7s
-
MD5
3849f30b51a5c49e8d1546960cc206c7
-
SHA1
61c74136534b826059c63221a2373dc0613a47b7
-
SHA256
f6c97b1e2ed02578ca1066c8235ba4f991e645f89012406c639dbccc6582eec8
-
SHA512
43d79293d1fbf716111c27e50df95a0860a0d706079625fa2b8a6b57c5ee06fa7b5b6b8c0acae33714a2181686426728513c990534e44b6f03a05dde0629ab86
-
SSDEEP
3072:biMYFJvw6Yh0b1gKobtCGCmCRlrisfrYm:fYFJvwe1gKCYVl2szN
Malware Config
Targets
-
-
Target
mozi.m
-
Size
134KB
-
MD5
3849f30b51a5c49e8d1546960cc206c7
-
SHA1
61c74136534b826059c63221a2373dc0613a47b7
-
SHA256
f6c97b1e2ed02578ca1066c8235ba4f991e645f89012406c639dbccc6582eec8
-
SHA512
43d79293d1fbf716111c27e50df95a0860a0d706079625fa2b8a6b57c5ee06fa7b5b6b8c0acae33714a2181686426728513c990534e44b6f03a05dde0629ab86
-
SSDEEP
3072:biMYFJvw6Yh0b1gKobtCGCmCRlrisfrYm:fYFJvwe1gKCYVl2szN
Score9/10-
Contacts a large (17996) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
Patched UPX-packed file
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
-
Changes its process name
-
Modifies Watchdog functionality
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates active TCP sockets
Gets active TCP sockets from /proc virtual filesystem.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Modifies init.d
Adds/modifies system service, likely for persistence.
-
Reads system routing table
Gets active network interfaces from /proc virtual filesystem.
-
Writes file to system bin folder
-