General
- Target bin.sh
- Size 129KB
- Sample260623-w1jgjaft8v
- SHA256 2e4506802aedea2e6d53910dfb296323be6620ac08c4b799a879eace5923a7b6
Malware Config
Targets
-
- Target bin.sh
- Size 129KB
- SHA256 2e4506802aedea2e6d53910dfb296323be6620ac08c4b799a879eace5923a7b6
Score10/10Detects Mozi Payload
Family: Mozi, Mozi Botnet
Mozi aka MoziBotnet is a multi-platform linux botnet targeting IoT devices.
Contacts a large (9447) amount of remote hosts
This may indicate a network scan to discover remotely running services.
Patched UPX-packed file
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
Modifies Watchdog functionality
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
Enumerates active TCP sockets
Gets active TCP sockets from /proc virtual filesystem.
Enumerates running processes
Discovers information about currently running processes on the system
Modifies init.d
Adds/modifies system service, likely for persistence.
Reads system routing table
Gets active network interfaces from /proc virtual filesystem.
Writes file to system bin folder
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Privilege Escalation
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1