Malware Analysis Report

2024-11-15 09:41

Sample ID 220219-gdc9nshdbj
Target cbd891075905c30abafe23df3ead5ecabd9a0454a5879ab9f2c820e3af32d381
SHA256 cbd891075905c30abafe23df3ead5ecabd9a0454a5879ab9f2c820e3af32d381
Tags
kaiten persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

cbd891075905c30abafe23df3ead5ecabd9a0454a5879ab9f2c820e3af32d381

Threat Level: Known bad

The file cbd891075905c30abafe23df3ead5ecabd9a0454a5879ab9f2c820e3af32d381 was found to be: Known bad.

Malicious Activity Summary

kaiten persistence

Identified Kaiten Bot

Kaiten family

Modifies rc script

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-02-19 05:40

Signatures

Identified Kaiten Bot

Description Indicator Process Target
N/A N/A N/A N/A

Kaiten family

kaiten

Analysis: behavioral1

Detonation Overview

Submitted

2022-02-19 05:40

Reported

2022-02-19 05:46

Platform

debian9-armhf-en-20211208

Max time kernel

6267s

Max time network

158s

Command Line

[./cbd891075905c30abafe23df3ead5ecabd9a0454a5879ab9f2c820e3af32d381]

Signatures

Modifies rc script

persistence
Description Indicator Process Target
/etc/rc.d/rc.local /etc/rc.d/rc.local ./cbd891075905c30abafe23df3ead5ecabd9a0454a5879ab9f2c820e3af32d381 N/A

Processes

./cbd891075905c30abafe23df3ead5ecabd9a0454a5879ab9f2c820e3af32d381

[./cbd891075905c30abafe23df3ead5ecabd9a0454a5879ab9f2c820e3af32d381]

Network

Country Destination Domain Proto
TH 202.28.120.32:404 tcp
TH 202.28.120.32:404 tcp
TH 202.28.120.32:404 tcp
TH 202.28.120.32:404 tcp
TH 202.28.120.32:404 tcp
TH 202.28.120.32:404 tcp
TH 202.28.120.32:404 tcp
TH 202.28.120.32:404 tcp
TH 202.28.120.32:404 tcp
TH 202.28.120.32:404 tcp
TH 202.28.120.32:404 tcp
TH 202.28.120.32:404 tcp
TH 202.28.120.32:404 tcp
TH 202.28.120.32:404 tcp
TH 202.28.120.32:404 tcp
TH 202.28.120.32:404 tcp

Files

N/A