mozi | f6c97b1e2ed02578ca1066c8235ba4f991e645f89012406c639dbccc6582eec8

General

Target
bin.sh
Size 134KB
Sample260815-phay4swbre
SHA256 f6c97b1e2ed02578ca1066c8235ba4f991e645f89012406c639dbccc6582eec8
MD5 3849f30b51a5c49e8d1546960cc206c7
SHA1 61c74136534b826059c63221a2373dc0613a47b7
SHA512 43d79293d1fbf716111c27e50df95a0860a0d706079625fa2b8a6b57c5ee06fa7b5b6b8c0acae33714a2181686426728513c990534e44b6f03a05dde0629ab86
SSDEEP 3072:biMYFJvw6Yh0b1gKobtCGCmCRlrisfrYm:fYFJvwe1gKCYVl2szN
TLSH
T159D31322D3130C4FC02579FA7A2BE62A39873E6A24CE449C45F5D66A2FB7084ED71753
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  bin.sh
- Size 134KB
- SHA256 f6c97b1e2ed02578ca1066c8235ba4f991e645f89012406c639dbccc6582eec8
- MD5 3849f30b51a5c49e8d1546960cc206c7
- SHA1 61c74136534b826059c63221a2373dc0613a47b7
- SHA512 43d79293d1fbf716111c27e50df95a0860a0d706079625fa2b8a6b57c5ee06fa7b5b6b8c0acae33714a2181686426728513c990534e44b6f03a05dde0629ab86
- SSDEEP 3072:biMYFJvw6Yh0b1gKobtCGCmCRlrisfrYm:fYFJvwe1gKCYVl2szN
- TLSH
  T159D31322D3130C4FC02579FA7A2BE62A39873E6A24CE449C45F5D66A2FB7084ED71753
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

botnet defense_evasion discovery mozi persistence privilege_escalation upx
- Detects Mozi Payload
- Family: Mozi, Mozi Botnet
  Mozi aka MoziBotnet is a multi-platform linux botnet targeting IoT devices.
  botnet mozi
- Contacts a large (7980) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Patched UPX-packed file
  Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
- Modifies Watchdog functionality
  Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
  defense_evasion
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates/modifies environment variables
  Creating/modifying environment variables is a common persistence mechanism.
  persistence privilege_escalation defense_evasion
- Enumerates active TCP sockets
  Gets active TCP sockets from /proc virtual filesystem.
  discovery
- Enumerates running processes
  Discovers information about currently running processes on the system
- Modifies init.d
  Adds/modifies system service, likely for persistence.
  persistence
- Reads system routing table
  Gets active network interfaces from /proc virtual filesystem.
  discovery
- Write file to user bin folder
  persistence
- Writes file to system bin folder
- Modifies Bash startup script
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1