General
- Target jaffacakes118_61a4ca5971530c9224b1d0f3305c9946ced939c727b4e544cb24af88a1d2f134.bin
- Size 281KB
- Sample260910-nagw1ssbrh
- SHA256 61a4ca5971530c9224b1d0f3305c9946ced939c727b4e544cb24af88a1d2f134
Malware Config
Targets
-
- Target jaffacakes118_61a4ca5971530c9224b1d0f3305c9946ced939c727b4e544cb24af88a1d2f134.bin
- Size 281KB
- SHA256 61a4ca5971530c9224b1d0f3305c9946ced939c727b4e544cb24af88a1d2f134
Score10/10-
Detects Mozi Payload
-
Family: Mozi, Mozi Botnet
Mozi aka MoziBotnet is a multi-platform linux botnet targeting IoT devices.
-
Contacts a large (13110) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Patched UPX-packed file
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
-
Modifies Watchdog functionality
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
Enumerates active TCP sockets
Gets active TCP sockets from /proc virtual filesystem.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Modifies init.d
Adds/modifies system service, likely for persistence.
-
Reads system routing table
Gets active network interfaces from /proc virtual filesystem.
-
Writes file to system bin folder
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Privilege Escalation
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1