Analysis Overview
score
10/10
SHA256
0cdad862a1a695fe9cbf35592f92111e31ac848881fcd1deaa3c6ecd7c241ad7
Threat Level: Known bad
The file 0cdad862a1a695fe9cbf35592f92111e31ac848881fcd1deaa3c6ecd7c241ad7 was found to be: Known bad.
Malicious Activity Summary
Kaiten family
Identified Kaiten Bot
Modifies hosts file
Writes DNS configuration
Modifies rc script
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2021-10-02 14:23
Signatures
Identified Kaiten Bot
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Kaiten family
Analysis: behavioral1
Detonation Overview
Submitted
2021-10-02 14:23
Reported
2021-10-02 14:31
Platform
ubuntu-amd64
Max time kernel
4414s
Max time network
148s
Command Line
[./0cdad862a1a695fe9cbf35592f92111e31ac848881fcd1deaa3c6ecd7c241ad7]
Signatures
Modifies hosts file
| Description | Indicator | Process | Target |
| /etc/hosts | /etc/hosts | N/A | N/A |
Writes DNS configuration
| Description | Indicator | Process | Target |
| /etc/resolv.conf | /etc/resolv.conf | N/A | N/A |
Modifies rc script
| Description | Indicator | Process | Target |
| /etc/rc.d/rc.local | /etc/rc.d/rc.local | ./0cdad862a1a695fe9cbf35592f92111e31ac848881fcd1deaa3c6ecd7c241ad7 | N/A |
Processes
./0cdad862a1a695fe9cbf35592f92111e31ac848881fcd1deaa3c6ecd7c241ad7
[./0cdad862a1a695fe9cbf35592f92111e31ac848881fcd1deaa3c6ecd7c241ad7]
Network
| Country | Destination | Domain | Proto |
| DE | 45.9.148.182:6667 | tcp | |
| US | 1.1.1.1:53 | changelogs.ubuntu.com | udp |
| US | 1.1.1.1:53 | changelogs.ubuntu.com | udp |
| GB | 185.125.190.18:443 | changelogs.ubuntu.com | tcp |
| US | 1.1.1.1:53 | irc.teamtnt.red | udp |
| US | 91.189.91.157:123 | udp | |
| US | 91.189.91.157:123 | udp |
Files
N/A