Analysis Overview
score
10/10
SHA256
8136fb15409989929cf54a4136b60cd16cadbb78c6bc2e31c44aab0a5c87e986
Threat Level: Known bad
The file 8136fb15409989929cf54a4136b60cd16cadbb78c6bc2e31c44aab0a5c87e986 was found to be: Known bad.
Malicious Activity Summary
Kaiten family
Identified Kaiten Bot
Modifies hosts file
Writes DNS configuration
Modifies rc script
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2022-01-21 23:36
Signatures
Identified Kaiten Bot
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Kaiten family
Analysis: behavioral1
Detonation Overview
Submitted
2022-01-21 23:36
Reported
2022-01-22 01:19
Platform
debian9-armhf-en-20211208
Max time kernel
3831s
Max time network
161s
Command Line
[./8136fb15409989929cf54a4136b60cd16cadbb78c6bc2e31c44aab0a5c87e986]
Signatures
Modifies hosts file
| Description | Indicator | Process | Target |
| /etc/hosts | /etc/hosts | N/A | N/A |
Writes DNS configuration
| Description | Indicator | Process | Target |
| /etc/resolv.conf | /etc/resolv.conf | N/A | N/A |
Modifies rc script
| Description | Indicator | Process | Target |
| /etc/rc.d/rc.local | /etc/rc.d/rc.local | ./8136fb15409989929cf54a4136b60cd16cadbb78c6bc2e31c44aab0a5c87e986 | N/A |
Processes
./8136fb15409989929cf54a4136b60cd16cadbb78c6bc2e31c44aab0a5c87e986
[./8136fb15409989929cf54a4136b60cd16cadbb78c6bc2e31c44aab0a5c87e986]
Network
| Country | Destination | Domain | Proto |
| US | 1.1.1.1:53 | irc02.teamtnt.red | udp |
| DE | 45.9.148.182:6697 | irc02.teamtnt.red | tcp |
| US | 1.1.1.1:53 | irc02.teamtnt.red | udp |
| DE | 45.9.148.182:6697 | irc02.teamtnt.red | tcp |
| US | 1.1.1.1:53 | irc02.teamtnt.red | udp |
| DE | 45.9.148.182:6697 | irc02.teamtnt.red | tcp |
| US | 1.1.1.1:53 | irc02.teamtnt.red | udp |
| DE | 45.9.148.182:6697 | irc02.teamtnt.red | tcp |
| US | 1.1.1.1:53 | irc02.teamtnt.red | udp |
| DE | 45.9.148.182:6697 | irc02.teamtnt.red | tcp |
| US | 1.1.1.1:53 | irc02.teamtnt.red | udp |
| DE | 45.9.148.182:6697 | irc02.teamtnt.red | tcp |
| US | 1.1.1.1:53 | irc02.teamtnt.red | udp |
| DE | 45.9.148.182:6697 | irc02.teamtnt.red | tcp |
| US | 1.1.1.1:53 | irc02.teamtnt.red | udp |
| DE | 45.9.148.182:6697 | irc02.teamtnt.red | tcp |
| US | 1.1.1.1:53 | irc02.teamtnt.red | udp |
| DE | 45.9.148.182:6697 | irc02.teamtnt.red | tcp |
| US | 1.1.1.1:53 | irc02.teamtnt.red | udp |
| DE | 45.9.148.182:6697 | irc02.teamtnt.red | tcp |
| US | 1.1.1.1:53 | irc02.teamtnt.red | udp |
| DE | 45.9.148.182:6697 | irc02.teamtnt.red | tcp |
| US | 1.1.1.1:53 | irc02.teamtnt.red | udp |
| DE | 45.9.148.182:6697 | irc02.teamtnt.red | tcp |
| US | 1.1.1.1:53 | irc02.teamtnt.red | udp |
| DE | 45.9.148.182:6697 | irc02.teamtnt.red | tcp |
| US | 1.1.1.1:53 | irc02.teamtnt.red | udp |
| DE | 45.9.148.182:6697 | irc02.teamtnt.red | tcp |
| US | 1.1.1.1:53 | irc02.teamtnt.red | udp |
| DE | 45.9.148.182:6697 | irc02.teamtnt.red | tcp |
| US | 1.1.1.1:53 | irc02.teamtnt.red | udp |
| DE | 45.9.148.182:6697 | irc02.teamtnt.red | tcp |
Files
N/A