General
- Target bin.sh
- Size 134KB
- Sample261030-gzfa6aa16m
- SHA256 f6c97b1e2ed02578ca1066c8235ba4f991e645f89012406c639dbccc6582eec8
Malware Config
Targets
-
- Target bin.sh
- Size 134KB
- SHA256 f6c97b1e2ed02578ca1066c8235ba4f991e645f89012406c639dbccc6582eec8
Score10/10Detects Mozi Payload
Family: Mozi, Mozi Botnet
Mozi aka MoziBotnet is a multi-platform linux botnet targeting IoT devices.
Contacts a large (12982) amount of remote hosts
This may indicate a network scan to discover remotely running services.
Patched UPX-packed file
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
Modifies Watchdog functionality
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
Enumerates active TCP sockets
Gets active TCP sockets from /proc virtual filesystem.
Enumerates running processes
Discovers information about currently running processes on the system
Modifies init.d
Adds/modifies system service, likely for persistence.
Reads system routing table
Gets active network interfaces from /proc virtual filesystem.
Writes file to system bin folder
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Privilege Escalation
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1