12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef

Sharing

Copy URL

Twitter E-mail

General

Target

bin.sh
Size

300KB
Sample

240814-apg9faxcmp
MD5

eec5c6c219535fba3a0492ea8118b397
SHA1

292559e94f1c04b7d0c65d4a01bbbc5dc1ff6f21
SHA256

12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef
SHA512

3482c8324a18302f0f37b6e23ed85f24fff9f50bb568d8fd7461bf57f077a7c592f7a88bb2e1c398699958946d87bb93ab744d13a0003f9b879c15e6471f7400
SSDEEP

6144:T2s/gAWuboqsJ9xcJxspJBqQgTuaJZRhVabE5wKSDP99zBa77oNsKqqfPqOJ:T2s/bW+UmJqBxAuaPRhVabEDSDP99zBT

Score

9^/10

Malware Config

Targets

- Target
  
  bin.sh
- Size
  
  300KB
- MD5
  
  eec5c6c219535fba3a0492ea8118b397
- SHA1
  
  292559e94f1c04b7d0c65d4a01bbbc5dc1ff6f21
- SHA256
  
  12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef
- SHA512
  
  3482c8324a18302f0f37b6e23ed85f24fff9f50bb568d8fd7461bf57f077a7c592f7a88bb2e1c398699958946d87bb93ab744d13a0003f9b879c15e6471f7400
- SSDEEP
  
  6144:T2s/gAWuboqsJ9xcJxspJBqQgTuaJZRhVabE5wKSDP99zBa77oNsKqqfPqOJ:T2s/bW+UmJqBxAuaPRhVabEDSDP99zBT
Score

9^/10

discovery persistence
- Contacts a large (3111) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Modifies Watchdog functionality
  Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
- Enumerates active TCP sockets
  Gets active TCP sockets from /proc virtual filesystem.
- Enumerates running processes
  Discovers information about currently running processes on the system
- Modifies init.d
  Adds/modifies system service, likely for persistence.
  persistence
- Reads system routing table
  Gets active network interfaces from /proc virtual filesystem.
- Write file to user bin folder
- Writes file to system bin folder
behavioral1 behavioral2 behavioral3 behavioral4 behavioral5 behavioral6 behavioral7 behavioral8 behavioral9

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Defense Evasion

Hijack Execution Flow

T1574

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Contacts a large (3111) amount of remote hosts

Modifies Watchdog functionality

Enumerates active TCP sockets

Enumerates running processes

Modifies init.d

Reads system routing table

Write file to user bin folder

Writes file to system bin folder

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9