Resubmissions
13/09/2026, 19:08
260913-xtnncavwbz1012/09/2026, 12:13
260912-pd7saabd74812/09/2026, 12:09
260912-pbr9tagq2w1012/09/2026, 12:08
260912-pax4nsbc851012/09/2026, 12:07
260912-pan6rswere812/09/2026, 12:07
260912-paembsyxfs810/09/2026, 22:49
260910-2rnmsafa251010/09/2026, 22:44
260910-2nsgkahn6s1010/09/2026, 22:43
260910-2nhx5ahn5x1010/09/2026, 00:10
260910-af6wfasdka10Analysis
- user interaction
yes - max time kernel
13s - max time network
14s - platform
debian-9_mips - resource
debian9-mipsbe-20260513-en - resource tags
arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem - submitted
10/09/2026, 00:10
Behavioral task
behavioral1
Sample
bin.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
11 signatures
150 seconds
General
- Target bin.sh
- Size 132KB
- Sample260910-af6wfasdka
- SHA256 4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7
- MD5 59ce0baba11893f90527fc951ac69912
- SHA1 5857a7dd621c4c3ebb0b5a3bec915d409f70d39f
- SHA512 c5b12797b477e5e5964a78766bb40b1c0d9fdfb8eef1f9aee3df451e3441a40c61d325bf400ba51048811b68e1c70a95f15e4166b7a65a4eca0c624864328647
- SSDEEP 3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xioP:p3lOYoaja8xzx/0wsxzSi2
- TLSH T1E5D3128BEF36DC1ECF001EB226DA5B9E9C6D756B41CBF0A4B9C1818F13A01C97D52215
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Mozi Payload 1 IoCs
resource yara_rule behavioral1/memory/706-1-0x00400000-0x004c2fd8-memory.dmp family_mozi - Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog bin.sh File opened for modification /dev/misc/watchdog bin.sh - Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp bin.sh - Enumerates running processes
Discovers information about currently running processes on the system
- Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/route bin.sh - Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog bin.sh File opened for modification /bin/watchdog bin.sh - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself sshd 709 bin.sh - Reads system network configuration 1 TTPs 3 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp bin.sh File opened for reading /proc/net/raw bin.sh File opened for reading /proc/net/route bin.sh -
description ioc Process File opened for reading /proc/72/stat killall File opened for reading /proc/74/stat killall File opened for reading /proc/78/stat killall File opened for reading /proc/667/stat killall File opened for reading /proc/695/cmdline killall File opened for reading /proc/80/stat killall File opened for reading /proc/118/stat killall File opened for reading /proc/150/stat killall File opened for reading /proc/697/cmdline killall File opened for reading /proc/1/stat killall File opened for reading /proc/5/stat killall File opened for reading /proc/16/stat killall File opened for reading /proc/4/stat killall File opened for reading /proc/672/stat killall File opened for reading /proc/12/stat killall File opened for reading /proc/17/stat killall File opened for reading /proc/20/stat killall File opened for reading /proc/75/stat killall File opened for reading /proc/7/stat killall File opened for reading /proc/333/stat killall File opened for reading /proc/695/stat killall File opened for reading /proc/704/stat killall File opened for reading /proc/24/stat killall File opened for reading /proc/filesystems killall File opened for reading /proc/18/stat killall File opened for reading /proc/71/stat killall File opened for reading /proc/77/stat killall File opened for reading /proc/671/stat killall File opened for reading /proc/703/stat killall File opened for reading /proc/37/stat killall File opened for reading /proc/166/stat killall File opened for reading /proc/374/stat killall File opened for reading /proc/70/stat killall File opened for reading /proc/76/stat killall File opened for reading /proc/226/stat killall File opened for reading /proc/328/stat killall File opened for reading /proc/702/stat killall File opened for reading /proc/3/stat killall File opened for reading /proc/13/stat killall File opened for reading /proc/14/stat killall File opened for reading /proc/19/stat killall File opened for reading /proc/22/stat killall File opened for reading /proc/117/stat killall File opened for reading /proc/380/stat killall File opened for reading /proc/715/stat killall File opened for reading /proc/23/stat killall File opened for reading /proc/36/stat killall File opened for reading /proc/self/exe bin.sh File opened for reading /proc/2/stat killall File opened for reading /proc/118/cmdline killall File opened for reading /proc/147/stat killall File opened for reading /proc/325/stat killall File opened for reading /proc/653/stat killall File opened for reading /proc/11/stat killall File opened for reading /proc/73/stat killall File opened for reading /proc/669/stat killall File opened for reading /proc/697/stat killall File opened for reading /proc/710/stat killall File opened for reading /proc/714/stat killall File opened for reading /proc/6/stat killall File opened for reading /proc/8/stat killall File opened for reading /proc/424/stat killall File opened for reading /proc/709/stat killall File opened for reading /proc/711/cmdline killall - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.ips bin.sh
Processes
-
/tmp/bin.sh/tmp/bin.sh1⤵
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Reads system routing table
- Writes file to system bin folder
- Changes its process name
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
PID:706 -
/bin/shsh -c "killall -9 telnetd utelnetd scfgmgr"2⤵PID:710
-
/usr/bin/killallkillall -9 telnetd utelnetd scfgmgr3⤵
- Reads runtime system information
PID:713
-
-