General
- Target i
- Size 132KB
- Sample260818-ph16asar2v
- SHA256 4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7
Malware Config
Targets
-
- Target i
- Size 132KB
- SHA256 4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7
Score10/10Detects Mozi Payload
Family: Mozi, Mozi Botnet
Mozi aka MoziBotnet is a multi-platform linux botnet targeting IoT devices.
Contacts a large (6066) amount of remote hosts
This may indicate a network scan to discover remotely running services.
Patched UPX-packed file
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
Modifies Watchdog functionality
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
Enumerates active TCP sockets
Gets active TCP sockets from /proc virtual filesystem.
Enumerates running processes
Discovers information about currently running processes on the system
Modifies init.d
Adds/modifies system service, likely for persistence.
Reads system routing table
Gets active network interfaces from /proc virtual filesystem.
Writes file to system bin folder
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Privilege Escalation
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1