General
- Target i
- Size 132KB
- Sample260629-wvs4sac12m
- SHA256 b5cf68c7cb5bb2d21d60bf6654926f61566d95bfd7c9f9e182d032f1da5b4605
Malware Config
Targets
-
- Target i
- Size 132KB
- SHA256 b5cf68c7cb5bb2d21d60bf6654926f61566d95bfd7c9f9e182d032f1da5b4605
Score10/10Detects Mozi Payload
Family: Mozi, Mozi Botnet
Mozi aka MoziBotnet is a multi-platform linux botnet targeting IoT devices.
Contacts a large (2671) amount of remote hosts
This may indicate a network scan to discover remotely running services.
Patched UPX-packed file
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
Modifies Watchdog functionality
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Enumerates active TCP sockets
Gets active TCP sockets from /proc virtual filesystem.
Enumerates running processes
Discovers information about currently running processes on the system
Modifies init.d
Adds/modifies system service, likely for persistence.
Reads system routing table
Gets active network interfaces from /proc virtual filesystem.
Writes file to system bin folder
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Privilege Escalation
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1