020f1fa6072108c79ed6f553f4f8b08e157bf17f9c260a76353300230fed09f0

General

Target

020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
Size

83KB
MD5

5377e8f2ebdb280216c37a6195da9d6c
SHA1

b54c705193b7963a0d40699a91cdb34fedecbe88
SHA256

020f1fa6072108c79ed6f553f4f8b08e157bf17f9c260a76353300230fed09f0
SHA512

65e5aec56ddde56f245a20f88553d2f76bd7dd8e1940e9d49637d51a868fe73003b8a95fffeb9481110579f6ee4790fc9af1668d435930d4c01b116490908eed
SSDEEP

1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgswnD6Efyq8PxlRkp2K3/J1V+uBNu:yYI0ARqw1qAEv7UIFM8oJorFquyjkRks

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0

pid process

706 020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0

pid	process
706	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

Processes:

020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0

description	ioc	process
File opened for modification	/dev/watchdog	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for modification	/dev/misc/watchdog	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0

Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
discovery

System Network Connections Discovery
T1049

Processes:

020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0

description ioc process

File opened for reading /proc/net/tcp 020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
Enumerates running processes
Discovers information about currently running processes on the system
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
discovery

Internet Connection Discovery
T1016.001

Processes:

020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0

description ioc process

File opened for reading /proc/net/route 020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0

description	ioc	process
File opened for reading	/proc/net/tcp	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0

Changes its process name 1 IoCs

Processes:

020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0

description	ioc	pid	process
Changes the process name, possibly in an attempt to hide itself	telnetd	706	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0

Reads system network configuration 1 TTPs 3 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

Processes:

020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0

description	ioc	process
File opened for reading	/proc/net/route	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/net/tcp	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/net/tcp6	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0

description	ioc	process
File opened for reading	/proc/706/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/494/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/351/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/316/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/69/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/5/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/706/fd	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/701/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/389/fd	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/351/fd	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/321/fd	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/141/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/3/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/494/fd	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/372/fd	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/71/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/18/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/8/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/700/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/113/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/6/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/695/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/682/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/103/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/12/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/36/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/702/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/696/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/539/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/225/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/82/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/24/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/382/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/80/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/17/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/9/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/13/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/538/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/389/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/141/fd	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/114/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/76/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/21/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/15/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/481/fd	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/372/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/164/fd	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/70/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/10/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/698/fd	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/682/fd	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/319/fd	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/147/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/481/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/22/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/20/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/4/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/16/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/695/fd	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/382/fd	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/374/fd	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/349/fd	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/164/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
File opened for reading	/proc/74/cmdline	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0

System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
discovery

System Network Configuration Discovery
T1016

Processes:

sh

pid process

740 sh
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.

Processes:

020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0

description ioc process

File opened for modification /tmp/fifo 020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0

pid	process
740	sh

description	ioc	process
File opened for modification	/tmp/fifo	020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0

/tmp/020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
/tmp/020F1FA6072108C79ED6F553F4F8B08E157BF17F9C260A76353300230FED09F0
1⤵
- Deletes itself
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Reads system routing table
- Changes its process name
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
PID:703
- /bin/sh
  sh -c "iptables -A INPUT -p tcp --destination-port 23 -j DROP"
  2⤵
  PID:708
- - /sbin/iptables
    iptables -A INPUT -p tcp --destination-port 23 -j DROP
    3⤵
    PID:710
- /bin/sh
  sh -c "iptables -A INPUT -p tcp --destination-port 7547 -j DROP"
  2⤵
  PID:722
- - /sbin/iptables
    iptables -A INPUT -p tcp --destination-port 7547 -j DROP
    3⤵
    PID:724
- /bin/sh
  sh -c "iptables -A INPUT -p tcp --destination-port 5555 -j DROP"
  2⤵
  PID:727
- - /sbin/iptables
    iptables -A INPUT -p tcp --destination-port 5555 -j DROP
    3⤵
    PID:729
- /bin/sh
  sh -c "iptables -A INPUT -p tcp --destination-port 5358 -j DROP"
  2⤵
  PID:731
- - /sbin/iptables
    iptables -A INPUT -p tcp --destination-port 5358 -j DROP
    3⤵
    PID:733
- /bin/sh
  sh -c "iptables -D INPUT -j CWMP_CR"
  2⤵
  PID:736
- - /sbin/iptables
    iptables -D INPUT -j CWMP_CR
    3⤵
    PID:737
- /bin/sh
  sh -c "iptables -X CWMP_CR"
  2⤵
  - System Network Configuration Discovery
  PID:740
- - /sbin/iptables
    iptables -X CWMP_CR
    3⤵
    PID:741
- /bin/sh
  sh -c "iptables -I INPUT -p udp --dport 50971 -j ACCEPT"
  2⤵
  PID:743
- - /sbin/iptables
    iptables -I INPUT -p udp --dport 50971 -j ACCEPT
    3⤵
    PID:744