Joe Sandbox Cloud Basic

Want to search on specific fields?


Try our:

Advanced Search
Register Login
sloganpng
top title background image
flash

Mozi.m

Status: finished
Submission Time: 2020-10-07 23:40:11 +02:00
Malicious
Spreader
Trojan
Evader
Mirai

Comments

Tags

Details

  • Analysis ID:
    294799
  • API (Web) ID:
    484739
  • Analysis Started:
    2020-10-07 23:40:11 +02:00
  • Analysis Finished:
    2020-10-07 23:48:47 +02:00
  • MD5:
    eec5c6c219535fba3a0492ea8118b397
  • SHA1:
    292559e94f1c04b7d0c65d4a01bbbc5dc1ff6f21
  • SHA256:
    12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
Full Report Management Report IOC Report
malicious
Score: 100
System: Ubuntu Linux 16.04 x64 (Kernel 4.4.0-116, Firefox 88.0, Document Viewer 3.18.2, LibreOffice 5.1.6.2, OpenJDK 1.8.0_171)

Third Party Analysis Engines

Open Full Report
malicious
Score: 42/60
malicious
Score: 18/29
malicious

URLs

Name Detection
http://%s:%d/bin.sh;chmod
http://%s:%d/Mozi.m;$
http://%s:%d/Mozi.m;
Click to see the 25 hidden entries
http://%s:%d/Mozi.m
http://%s:%d/bin.sh
http://%s:%d/Mozi.m;/tmp/Mozi.m
http://schemas.xmlsoap.org/soap/envelope//
http://pastebin.ca)
http://www.pastebin.ca.
http://%s:%d/Mozi.a;sh$
http://HTTP/1.1
http://www.alsa-project.org.
http://www.alsa-project.org/alsa-info.sh
http://purenetworks.com/HNAP1/
http://www.pastebin.ca
http://ipinfo.io/ip
http://pastebin.ca/quiet-paste.php?api=$PASTEBINKEY&encrypt=t&encryptpw=blahblah
http://pastebin.ca/quiet-paste.php?api=$PASTEBINKEY
http://127.0.0.1sendcmd
http://www.alsa-project.org/cardinfo-db/
http://www.pastebin.ca/upload.php
http://www.alsa-project.org
http://ia.51.la/go1?id=17675125&pu=http%3a%2f%2fv.baidu.com/
http://baidu.com/%s/%s/%d/%s/%s/%s/%s)
http://127.0.0.1
http://schemas.xmlsoap.org/soap/envelope/
http://schemas.xmlsoap.org/soap/encoding/
http://%s:%d/Mozi.a;chmod

Dropped files

Name File Type Hashes Detection
/etc/init.d/umountnfs.sh
 ASCII text
 #
/usr/bin/gettext.sh
 ASCII text
 #
/usr/networks
 ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, stripped
 #
Click to see the 97 hidden entries
/usr/sbin/alsa-info.sh
 ASCII text, with very long lines
 #
/etc/rcS.d/S95baby.sh
 POSIX shell script, ASCII text executable
 #
/etc/rc.local
 ASCII text
 #
/etc/profile.d/vte-2.91.sh
 ASCII text
 #
/etc/profile.d/cedilla-portuguese.sh
 ASCII text
 #
/etc/profile.d/bash_completion.sh
 ASCII text
 #
/etc/profile.d/apps-bin-path.sh
 ASCII text
 #
/etc/profile.d/Z97-byobu.sh
 ASCII text
 #
/etc/init.d/mountnfs.sh
 ASCII text
 #
/etc/init.d/mountnfs-bootclean.sh
 ASCII text
 #
/etc/init.d/mountkernfs.sh
 ASCII text
 #
/etc/init.d/mountdevsubfs.sh
 ASCII text
 #
/etc/init.d/mountall.sh
 ASCII text
 #
/etc/init.d/hwclock.sh
 ASCII text
 #
/etc/init.d/S95baby.sh
 POSIX shell script, ASCII text executable
 #
/etc/init.d/bootmisc.sh
 ASCII text
 #
/etc/init.d/checkfs.sh
 ASCII text
 #
/etc/init.d/mountall-bootclean.sh
 ASCII text
 #
/etc/init.d/checkroot-bootclean.sh
 ASCII text
 #
/etc/init.d/checkroot.sh
 ASCII text
 #
/etc/init.d/hostname.sh
 ASCII text
 #
/usr/share/doc/git/contrib/convert-grafts-to-replace-refs.sh
 ASCII text
 #
/usr/share/doc/git/contrib/examples/git-am.sh
 OS/2 REXX batch file, ASCII text
 #
/usr/share/doc/git/contrib/examples/git-checkout.sh
 ASCII text
 #
/usr/share/doc/git/contrib/examples/git-resolve.sh
 ASCII text
 #
/usr/share/doc/git/contrib/examples/git-reset.sh
 ASCII text
 #
/usr/share/doc/git/contrib/examples/git-repack.sh
 ASCII text
 #
/usr/share/doc/git/contrib/examples/git-pull.sh
 ASCII text
 #
/usr/share/doc/git/contrib/examples/git-notes.sh
 ASCII text
 #
/usr/share/doc/git/contrib/examples/git-merge.sh
 ASCII text
 #
/usr/share/doc/git/contrib/examples/git-merge-ours.sh
 ASCII text
 #
/usr/share/doc/git/contrib/examples/git-ls-remote.sh
 ASCII text
 #
/usr/share/doc/git/contrib/examples/git-log.sh
 ASCII text
 #
/usr/share/doc/git/contrib/examples/git-gc.sh
 ASCII text
 #
/usr/share/doc/git/contrib/examples/git-clean.sh
 ASCII text
 #
/usr/share/doc/git/contrib/examples/git-clone.sh
 ASCII text
 #
/usr/share/doc/git/contrib/examples/git-commit.sh
 ASCII text
 #
/usr/share/doc/git/contrib/examples/git-fetch.sh
 ASCII text
 #
/usr/share/doc/git/contrib/thunderbird-patch-inline/appp.sh
 ASCII text
 #
/usr/share/cups/braille/indexv3.sh
 ASCII text
 #
/usr/share/doc/lm-sensors/examples/tellerstats/gather.sh
 ASCII text
 #
/usr/share/doc/lm-sensors/examples/daemon/healthd.sh
 ASCII text
 #
/usr/share/doc/ifupdown/examples/ping-places.sh
 ASCII text
 #
/usr/share/doc/ifupdown/examples/pcmcia-compat.sh
 ASCII text
 #
/usr/share/doc/ifupdown/examples/get-mac-address.sh
 ASCII text
 #
/usr/share/doc/ifupdown/examples/check-mac-address.sh
 ASCII text
 #
/usr/share/doc/hddtemp/contribs/hddtemp-all.sh
 ASCII text
 #
/usr/share/doc/hddtemp/contribs/analyze/hddtemp_monitor.sh
 ASCII text
 #
/usr/share/doc/hddtemp/contribs/analyze/graph-field.sh
 ASCII text
 #
/usr/share/doc/git/contrib/examples/git-revert.sh
 ASCII text
 #
/usr/share/doc/git/contrib/subtree/t/t7900-subtree.sh
 ASCII text
 #
/usr/share/doc/git/contrib/subtree/git-subtree.sh
 ASCII text
 #
/usr/share/doc/git/contrib/rerere-train.sh
 ASCII text
 #
/usr/share/doc/git/contrib/remotes2config.sh
 ASCII text
 #
/usr/share/doc/git/contrib/git-resurrect.sh
 ASCII text
 #
/usr/share/doc/git/contrib/fast-import/git-import.sh
 ASCII text
 #
/usr/share/doc/git/contrib/examples/git-whatchanged.sh
 ASCII text
 #
/usr/share/doc/git/contrib/examples/git-verify-tag.sh
 ASCII text
 #
/usr/share/doc/git/contrib/examples/git-tag.sh
 ASCII text
 #
/etc/wpa_supplicant/functions.sh
 ASCII text
 #
/home/user/.cache/upstart/upstart-event-bridge.log.1.gz
 Mon Jul 27 09:05:22 2020, from Unix
 #
/home/user/.cache/upstart/update-notifier-release.log.1.gz
 Mon Jul 27 09:05:22 2020, from Unix
 #
/home/user/.cache/upstart/startxfce4.log.1.gz
 Wed Oct 7 23:40:40 2020, from Unix
 #
/home/user/.cache/upstart/ssh-agent.log.1.gz
 Mon Jul 27 09:05:22 2020, from Unix
 #
/home/user/.cache/upstart/gpg-agent.log.1.gz
 Mon Jul 27 09:05:26 2020, from Unix
 #
/home/user/.cache/upstart/gnome-keyring-ssh.log.1.gz
 Mon Jul 27 09:05:22 2020, from Unix
 #
/home/user/.cache/upstart/dbus.log.1.gz
 Wed Oct 7 21:40:16 2020, from Unix
 #
/home/user/.cache/logrotate/status.tmp
 ASCII text
 #
/etc/wpa_supplicant/ifupdown.sh
 ASCII text
 #
/tmp/.config
 ASCII text
 #
/etc/wpa_supplicant/action_wpa.sh
 ASCII text
 #
/etc/bash_completion.d/libreoffice.sh
 ASCII text
 #
/etc/acpi/undock.sh
 ASCII text
 #
/etc/acpi/tosh-wireless.sh
 ASCII text
 #
/etc/acpi/powerbtn.sh
 ASCII text
 #
/etc/acpi/ibm-wireless.sh
 ASCII text
 #
/etc/acpi/asus-wireless.sh
 ASCII text
 #
/etc/acpi/asus-keyboard-backlight.sh
 ASCII text
 #
/usr/share/debconf/confmodule.sh
 ASCII text
 #
/usr/share/doc/gdb/contrib/expect-read1.sh
 ASCII text
 #
/usr/share/doc/gdb/contrib/ari/gdb_find.sh
 ASCII text
 #
/usr/share/doc/gdb/contrib/ari/create-web-ari-in-src.sh
 ASCII text
 #
/usr/share/doc/gawk/examples/prog/igawk.sh
 awk or perl script, ASCII text
 #
/usr/share/doc/gawk/examples/network/PostAgent.sh
 ASCII text
 #
/usr/share/doc/cron/examples/cron-tasks-review.sh
 ASCII text
 #
/usr/share/doc/busybox-static/examples/mdev.conf.change_blockdev.sh
 ASCII text
 #
/usr/share/doc/acpid/examples/default.sh
 ASCII text
 #
/usr/share/doc/acpid/examples/ac.sh
 ASCII text
 #
/usr/share/doc/gdb/contrib/gdb-add-index.sh
 ASCII text
 #
/usr/share/cups/braille/indexv4.sh
 ASCII text
 #
/boot/grub/i386-pc/modinfo.sh
 ASCII text
 #
/usr/share/cups/braille/index.sh
 ASCII text
 #
/usr/share/cups/braille/cups-braille.sh
 UTF-8 Unicode text
 #
/usr/share/brltty/initramfs/brltty.sh
 ASCII text
 #
/usr/share/alsa/utils.sh
 ASCII text
 #
/usr/share/alsa-base/alsa-info.sh
 ASCII text, with very long lines
 #
/tmp/tmp.vHWsTctARt
 ASCII text
 #