mozi | 1186de20cdf38eb67632e3acac383c8fd125b0b36f9c0124af449f2e18e820ea

General

Target
eec5c6c219535fba3a0492ea8118b397
Size 138KB
Sample260910-3vbytsxdrb
SHA256 1186de20cdf38eb67632e3acac383c8fd125b0b36f9c0124af449f2e18e820ea
MD5 e7ed47614dbd8378fa6750aa6a57bd83
SHA1 5698df154814f352c3a067c8cf0992147f14661d
SHA512 b191f60938e8cb748d7fccf61bbf5c915d57cd33006edc54d3a6d1cf43fbb998adb91da14139e2df28bdb5b4e9171999f03b990e59a2be2f8016a264bb6096b4
SSDEEP 3072:vsGHBg7pBcQx4JjCRFh0oF5pOnLECFVDBqVCNC7V92kYV6A7fXfJhVQfau:vxgPcQWpGFh085UL1VDBubM6aPJhVQyu
TLSH
T1A8D3132F85BB8F011D18AD8CD021C069DD2D75C1EF96E4DAA9C9480E75B0DCEF2E5686
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef
- Size 300KB
- SHA256 12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef
- MD5 eec5c6c219535fba3a0492ea8118b397
- SHA1 292559e94f1c04b7d0c65d4a01bbbc5dc1ff6f21
- SHA512 3482c8324a18302f0f37b6e23ed85f24fff9f50bb568d8fd7461bf57f077a7c592f7a88bb2e1c398699958946d87bb93ab744d13a0003f9b879c15e6471f7400
- SSDEEP 6144:T2s/gAWuboqsJ9xcJxspJBqQgTuaJZRhVabE5wKSDP99zBa77oNsKqqfPqOJ:T2s/bW+UmJqBxAuaPRhVabEDSDP99zBT
- TLSH
  T113643A8AFD81AE25D5C126BBFE2F4289331317B8D2EB71029D145F2876CA94F0F7A541
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

botnet defense_evasion discovery execution mozi persistence privilege_escalation
- Detects Mozi Payload
- Family: Mozi, Mozi Botnet
  Mozi aka MoziBotnet is a multi-platform linux botnet targeting IoT devices.
  botnet mozi
- Contacts a large (4274) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Modifies Watchdog functionality
  Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
  defense_evasion
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates/modifies environment variables
  Creating/modifying environment variables is a common persistence mechanism.
  persistence privilege_escalation defense_evasion
- Enumerates active TCP sockets
  Gets active TCP sockets from /proc virtual filesystem.
  discovery
- Enumerates running processes
  Discovers information about currently running processes on the system
- Modifies init.d
  Adds/modifies system service, likely for persistence.
  persistence
- Reads system routing table
  Gets active network interfaces from /proc virtual filesystem.
  discovery
- Write file to user bin folder
  persistence
- Writes file to system bin folder
- Modifies Bash startup script
  persistence
behavioral1