64a1e15aac8d795285e01b74b73f7e25c79041efb8159c029ea93fcdccc8456b

General

Target
mao.mips.elf
Size 96KB
Sample260406-m87dwsbv2x
SHA256 64a1e15aac8d795285e01b74b73f7e25c79041efb8159c029ea93fcdccc8456b
MD5 07edcabdb6729e42a8e98189788ff122
SHA1 0d1475c88f7906f3492dfcf7109469bf27e0c812
SHA512 b05b3df27332d45551d08cb3a4213cd48603c264401ad3843ef011179333c3b5c4fdb333a5c6804ce7c11f852f89d0940d84bab5f08b749f0b1cddcddf75342f
SSDEEP 1536:jJQxUAaXuMn3v2NDaTmiI2B73KiwwWfz94Q1OKZeDrBXZSClwG7qg8naFvBX3TZU:CxUAarKiqfz6QoZSClwG7pqaFvBHTFE
TLSH
T1C8A3520D7E328F7CFAAD863493B74F259248379532D2C589D2ACE6112D6010E746FBB9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
792	sh
793	chmod

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	mao.mips.elf
File opened for modification	/dev/misc/watchdog	mao.mips.elf

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/cron.d/.sys_update	mao.mips.elf

Modifies init.d 2 TTPs 1 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/init.d/.sys_daemon	mao.mips.elf

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/.networkd.service	mao.mips.elf

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	a	714	mao.mips.elf

Enumerates kernel/hardware configuration 1 TTPs 4 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 16 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
714	mao.mips.elf

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.sys_recovery.sh	mao.mips.elf

/tmp/mao.mips.elf
/tmp/mao.mips.elf
1⤵
- Modifies Watchdog functionality
- Creates/modifies Cron job
- Modifies init.d
- Modifies systemd
- Changes its process name
- System Network Configuration Discovery
- Writes file to tmp directory
PID:714
- /bin/sh
  sh -c "update-rc.d .sys_daemon defaults 2>/dev/null"
  2⤵
  PID:720
- - /usr/sbin/update-rc.d
    update-rc.d .sys_daemon defaults
    3⤵
    PID:723
  - - /usr/local/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:738
  - - /usr/local/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:738
  - - /usr/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:738
  - - /usr/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:738
  - - /sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:738
  - - /bin/systemctl
      systemctl daemon-reload
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:738
- /bin/sh
  sh -c "chkconfig --add .sys_daemon 2>/dev/null"
  2⤵
  PID:759
- /bin/sh
  sh -c "systemctl daemon-reload 2>/dev/null"
  2⤵
  PID:760
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:761
- /bin/sh
  sh -c "systemctl enable .networkd.service 2>/dev/null"
  2⤵
  PID:774
- - /bin/systemctl
    systemctl enable .networkd.service
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:775
- /bin/sh
  sh -c "systemctl start .networkd.service 2>/dev/null"
  2⤵
  PID:789
- - /bin/systemctl
    systemctl start .networkd.service
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:790
- /bin/sh
  sh -c "chmod +x /tmp/.sys_recovery.sh"
  2⤵
  - File and Directory Permissions Modification
  PID:792
- - /bin/chmod
    chmod +x /tmp/.sys_recovery.sh
    3⤵
    - File and Directory Permissions Modification
    PID:793

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Cron

1

T1053.003

Persistence

Boot or Logon Autostart Execution

2

T1547

XDG Autostart Entries

1

T1547.013

Boot or Logon Initialization Scripts

1

T1037

RC Scripts

1

T1037.004

Create or Modify System Process

1

T1543

Systemd Service

1

T1543.002

Scheduled Task/Job

1

T1053

Cron

1

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

XDG Autostart Entries

1

T1547.013

Boot or Logon Initialization Scripts

1

T1037

RC Scripts

1

T1037.004

Create or Modify System Process

1

T1543

Systemd Service

1

T1543.002

Scheduled Task/Job

1

T1053

Cron

1

T1053.003

Defense Evasion

File and Directory Permissions Modification

1

T1222

Linux and Mac File and Directory Permissions Modification

Impair Defenses

Credential Access

Discovery

System Information Discovery

1

T1082

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.sys_update

Path /etc/cron.d/.sys_update
Size 33B
SHA256 e20edbfceb2e5424d6b510100caa28f7e36f822d1b18acf3c4521b284d8870bc
MD5 c0e704d1ea25e0aefb31527cac29abaf
SHA1 359bfbc51fbcf9a088aabe8ca8494251c8b01de0
SHA512 006a7de6b53b486c136265557b833da495bd9e1b14dbd72717aad0739e1a265e19027774a127bbeb8d548bdb3b8d8072ce0476dd06994bd2dba15df34def40c0
MD5 SHA1 SHA512

Submit Download

.sys_daemon

Path /etc/init.d/.sys_daemon
Size 470B
SHA256 6b888eacc210bc0f8eab2611590163e382f0f371c2843b1cb01e555b9e243c04
MD5 6e8bb43f71d232db587de2a9fbce085b
SHA1 bd27b0b78a2d2a6b7c9f5fc8043d805e3d7f6dea
SHA512 6363418bd164287178d3ecc53b5aec021688b21002b859a30a4b0c545deea52f0c5cf29d173bffefb2e31278a2a74947d5385fe21e22900ca258daa03310993c
TLSH
T1A2F0EC42255AAA1F9E3601E10B40F3424523410B60239479B1AE37E9EFDD3D7E0BA178
MD5 SHA1 SHA512 TLSH

Submit Download

.networkd.service

Path /etc/systemd/system/.networkd.service
Size 225B
SHA256 9903cc8bf8e4d7352e16f2591a9b5d0974b34740cf798e0498ddd47dedac5f1f
MD5 8442cc483709e8358c9853469de9292c
SHA1 3775919ac17e0837971419203da779f9f8df3262
SHA512 4f8484693537b69ad4266da6d7581c168ddcdfb3883583fa969dc5e5414ff4874c1803ae31137cd2c4293e27a6b493bed2730d9cf4e038722127d91b3442ab6e
TLSH
T1F3D0A722367924D9D98B21B18F756F808F051041458F627447F19A4A46E148741558AF
MD5 SHA1 SHA512 TLSH

Submit Download

.sys_recovery.sh

Path /tmp/.sys_recovery.sh
Size 109B
SHA256 b981d3bf772f0a637d49997d89db4c2e85803d2587327330183caf34ac47ffb6
MD5 e8305097b3cfa3b8ef9708b9f7c39aeb
SHA1 9e984c04f1c54737cd664dd8b0a83a90b19748e6
SHA512 2b67e28811e2c9d8d883cdc8d1749262a9cc7c65dae6b752aa68933871b774df6d33eac37a32d78c6593d023325e9acafc63b1dc94bf87a000bbd52c88a4af8c
TLSH
T19CB01241D8E958159DB81139C528AD60920B408FD817B13434134179EF1C39B25571EA
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads