Overview

overview

10

Static

static

1

4b9cc70454...a04b47

debian-9-armhf

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    4b9cc70454bbbb66672c4c322da04b47
  • Size 37KB
  • Sample231219-25wwbaebb2
  • SHA256 6db9132bf65b9923c3b14b79edac73d5cea64999af0b5224bd11865e23283885
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
kaitenbotnetpersistence

Malware Config

Targets

    • Target
      4b9cc70454bbbb66672c4c322da04b47
    • Size 37KB
    • SHA256 6db9132bf65b9923c3b14b79edac73d5cea64999af0b5224bd11865e23283885
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    kaitenbotnetpersistence

    • Detects Kaiten/Tsunami Payload

    • Kaiten/Tsunami

      Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.

      botnetkaiten

    • Writes DNS configuration

      Writes data to DNS resolver config file.

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

      persistence

    • Enumerates running processes

      Discovers information about currently running processes on the system

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks