i

First submission 2022-11-01 15:40:06 Last sumbission 2024-10-17 10:52:04

File details

File type:	ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, no section header
File size:	300.74 KB (307960 bytes)
MD5:	ff3ffa9a1b317e1398de4f0d592c079f
SHA1:	3cb81e59e1521ca6b353d4276bdfb28cfcc52b29
SHA256:	e9e7fb2c799593e74e45fe3321c8ce0306821bd1e7b56cc01e643e790b11af9f

File features detected

Is DLL

Packers

Anti Debug

Anti VM

Signed

XOR

OSINT Enrichments

Virus Total:	37/59 VT report date: 2022-03-06 20:12:42

URLs, FQDN and IP indicators 2

URL	Host (FQDN/IP)	Date Added
hXXp://117.253.98.246:54248/i	117.253.98.246	2024-10-17 10:52:06
hXXp://117.253.98.246:54248/bin.sh	117.253.98.246	2024-10-17 10:30:10

Strings analysis - File found

XML
M7c.xml

Strings analysis - Possible IPs found 5

192.168.0.100
192.168.1.1
239.255.255.250
192.168.3.1
127.0.0.1

Strings analysis - Possible URLs found 17

http://schemas.xmlsoap.org/soap/envelope/
http://purenetworks.com/HNAP1/
http://%s:%d/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1
http://%s:%d/Mozi.m+-O+-
http://%s:%d
http://schemas.xmlsoap.org/soap/encoding/
http://www.w3.org/2001/XMLSchema-instance
http://www.w3.org/2001/XMLSchema
http://upx.sf.net
http://%s:%d/Mozi.m;
http://schemas.xmlsoap.org/soap/envelope//
http://%s:%d/Mozi.m;/tmp/Mozi.m
http://%s:%d/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+varcron
http://%s:%d/Mozi.m
http://%s:%d/Mozi.a;sh$
http://%s:%d/Mozi.m;$
http://%s:%d/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws