Analysis Overview
score
10/10
SHA256
cbd891075905c30abafe23df3ead5ecabd9a0454a5879ab9f2c820e3af32d381
Threat Level: Known bad
The file cbd891075905c30abafe23df3ead5ecabd9a0454a5879ab9f2c820e3af32d381 was found to be: Known bad.
Malicious Activity Summary
Identified Kaiten Bot
Kaiten family
Modifies rc script
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2022-02-19 05:40
Signatures
Identified Kaiten Bot
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Kaiten family
Analysis: behavioral1
Detonation Overview
Submitted
2022-02-19 05:40
Reported
2022-02-19 05:46
Platform
debian9-armhf-en-20211208
Max time kernel
6267s
Max time network
158s
Command Line
[./cbd891075905c30abafe23df3ead5ecabd9a0454a5879ab9f2c820e3af32d381]
Signatures
Modifies rc script
| Description | Indicator | Process | Target |
| /etc/rc.d/rc.local | /etc/rc.d/rc.local | ./cbd891075905c30abafe23df3ead5ecabd9a0454a5879ab9f2c820e3af32d381 | N/A |
Processes
./cbd891075905c30abafe23df3ead5ecabd9a0454a5879ab9f2c820e3af32d381
[./cbd891075905c30abafe23df3ead5ecabd9a0454a5879ab9f2c820e3af32d381]
Network
| Country | Destination | Domain | Proto |
| TH | 202.28.120.32:404 | tcp | |
| TH | 202.28.120.32:404 | tcp | |
| TH | 202.28.120.32:404 | tcp | |
| TH | 202.28.120.32:404 | tcp | |
| TH | 202.28.120.32:404 | tcp | |
| TH | 202.28.120.32:404 | tcp | |
| TH | 202.28.120.32:404 | tcp | |
| TH | 202.28.120.32:404 | tcp | |
| TH | 202.28.120.32:404 | tcp | |
| TH | 202.28.120.32:404 | tcp | |
| TH | 202.28.120.32:404 | tcp | |
| TH | 202.28.120.32:404 | tcp | |
| TH | 202.28.120.32:404 | tcp | |
| TH | 202.28.120.32:404 | tcp | |
| TH | 202.28.120.32:404 | tcp | |
| TH | 202.28.120.32:404 | tcp |
Files
N/A