General
- Target i
- Size 300KB
- Sample261113-pdrfasvt4k
- SHA256 21714f89a31bc7265ab0b0efef9aad6aa8409257978c43d28524c72e9bfe9772
Malware Config
Targets
-
- Target i
- Size 300KB
- SHA256 21714f89a31bc7265ab0b0efef9aad6aa8409257978c43d28524c72e9bfe9772
Score10/10Detects Mozi Payload
Family: Mozi, Mozi Botnet
Mozi aka MoziBotnet is a multi-platform linux botnet targeting IoT devices.
Contacts a large (5925) amount of remote hosts
This may indicate a network scan to discover remotely running services.
Patched UPX-packed file
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
Modifies Watchdog functionality
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
Enumerates active TCP sockets
Gets active TCP sockets from /proc virtual filesystem.
Enumerates running processes
Discovers information about currently running processes on the system
Modifies init.d
Adds/modifies system service, likely for persistence.
Reads system routing table
Gets active network interfaces from /proc virtual filesystem.
Writes file to system bin folder
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Privilege Escalation
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1