Analysis Overview
score
10/10
SHA256
305901aa920493695729132cfd20cbddc9db2cf861071450a646c6a07b4a50f3
Threat Level: Known bad
The file SamPwn was found to be: Known bad.
Malicious Activity Summary
Identified Kaiten Bot
Kaiten family
Modifies hosts file
Writes DNS configuration
Modifies rc script
JavaScript code in executable
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2021-01-18 18:34
Signatures
Identified Kaiten Bot
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Kaiten family
JavaScript code in executable
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2021-01-18 18:34
Reported
2021-01-18 18:36
Platform
ubuntu-amd64
Max time kernel
5194s
Max time network
152s
Command Line
[./SamPwn]
Signatures
Modifies hosts file
| Description | Indicator | Process | Target |
| /etc/hosts | /etc/hosts | N/A | N/A |
Writes DNS configuration
| Description | Indicator | Process | Target |
| /etc/resolv.conf | /etc/resolv.conf | N/A | N/A |
Modifies rc script
| Description | Indicator | Process | Target |
| /etc/rc.d/rc.local | /etc/rc.d/rc.local | ./SamPwn | N/A |
Processes
./SamPwn
[./SamPwn]
Network
| Country | Destination | Domain | Proto |
| N/A | 1.1.1.1:53 | sampwn.anondns.net | udp |
| N/A | 13.245.9.147:6697 | sampwn.anondns.net | tcp |
| N/A | 13.245.9.147:6697 | sampwn.anondns.net | tcp |
| N/A | 13.245.9.147:6697 | sampwn.anondns.net | tcp |
| N/A | 1.1.1.1:53 | ntp.ubuntu.com | udp |
| N/A | 1.1.1.1:53 | ntp.ubuntu.com | udp |
| N/A | 91.189.91.157:123 | ntp.ubuntu.com | udp |
| N/A | 13.245.9.147:6697 | sampwn.anondns.net | tcp |
| N/A | 13.245.9.147:6697 | sampwn.anondns.net | tcp |
| N/A | 13.245.9.147:6697 | sampwn.anondns.net | tcp |
| N/A | 13.245.9.147:6697 | sampwn.anondns.net | tcp |
| N/A | 91.189.91.157:123 | ntp.ubuntu.com | udp |
| N/A | 1.1.1.1:53 | sampwn.anondns.net | udp |
| N/A | 13.245.9.147:6697 | sampwn.anondns.net | tcp |
| N/A | 13.245.9.147:6697 | sampwn.anondns.net | tcp |
| N/A | 13.245.9.147:6697 | sampwn.anondns.net | tcp |
| N/A | 13.245.9.147:6697 | sampwn.anondns.net | tcp |
| N/A | 13.245.9.147:6697 | sampwn.anondns.net | tcp |
| N/A | 13.245.9.147:6697 | sampwn.anondns.net | tcp |
| N/A | 91.189.91.157:123 | ntp.ubuntu.com | udp |
| N/A | 1.1.1.1:53 | sampwn.anondns.net | udp |
| N/A | 13.245.9.147:6697 | sampwn.anondns.net | tcp |
| N/A | 13.245.9.147:6697 | sampwn.anondns.net | tcp |
| N/A | 13.245.9.147:6697 | sampwn.anondns.net | tcp |
Files
N/A