Analysis Overview
score
10/10
SHA256
c15355bd9508d143d326eed5a041c0ff188ac017f3db6390d139591359f50fc2
Threat Level: Known bad
The file c15355bd9508d143d326eed5a041c0ff188ac017f3db6390d139591359f50fc2 was found to be: Known bad.
Malicious Activity Summary
Identified Kaiten Bot
Kaiten family
Modifies hosts file
Writes DNS configuration
Modifies rc script
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2021-10-02 14:24
Signatures
Identified Kaiten Bot
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Kaiten family
Analysis: behavioral1
Detonation Overview
Submitted
2021-10-02 14:24
Reported
2021-10-02 14:33
Platform
ubuntu-amd64
Max time kernel
4414s
Max time network
153s
Command Line
[./c15355bd9508d143d326eed5a041c0ff188ac017f3db6390d139591359f50fc2]
Signatures
Modifies hosts file
| Description | Indicator | Process | Target |
| /etc/hosts | /etc/hosts | N/A | N/A |
Writes DNS configuration
| Description | Indicator | Process | Target |
| /etc/resolv.conf | /etc/resolv.conf | N/A | N/A |
Modifies rc script
| Description | Indicator | Process | Target |
| /etc/rc.d/rc.local | /etc/rc.d/rc.local | ./c15355bd9508d143d326eed5a041c0ff188ac017f3db6390d139591359f50fc2 | N/A |
Processes
./c15355bd9508d143d326eed5a041c0ff188ac017f3db6390d139591359f50fc2
[./c15355bd9508d143d326eed5a041c0ff188ac017f3db6390d139591359f50fc2]
Network
| Country | Destination | Domain | Proto |
| US | 1.1.1.1:53 | changelogs.ubuntu.com | udp |
| US | 1.1.1.1:53 | changelogs.ubuntu.com | udp |
| GB | 91.189.88.185:443 | changelogs.ubuntu.com | tcp |
| US | 1.1.1.1:53 | irc.teamtnt.red | udp |
| DE | 45.9.148.182:6697 | irc.teamtnt.red | tcp |
| DE | 45.9.148.182:6667 | irc.teamtnt.red | tcp |
| DE | 45.9.148.182:6697 | irc.teamtnt.red | tcp |
| DE | 45.9.148.182:6697 | irc.teamtnt.red | tcp |
| DE | 45.9.148.182:6697 | irc.teamtnt.red | tcp |
| CN | 211.158.25.219:6697 | tcp | |
| DE | 45.9.148.182:6697 | irc.teamtnt.red | tcp |
| US | 91.189.91.157:123 | udp | |
| CN | 211.158.25.219:6697 | tcp | |
| CN | 211.158.25.219:6697 | tcp | |
| DE | 45.9.148.182:6697 | irc.teamtnt.red | tcp |
| DE | 45.9.148.182:6697 | irc.teamtnt.red | tcp |
| US | 91.189.91.157:123 | udp | |
| DE | 45.9.148.182:6697 | irc.teamtnt.red | tcp |
| CN | 211.158.25.219:6697 | tcp | |
| CN | 211.158.25.219:6697 | tcp | |
| CN | 211.158.25.219:6697 | tcp | |
| DE | 45.9.148.182:6697 | irc.teamtnt.red | tcp |
| CN | 211.158.25.219:6697 | tcp |
Files
N/A