Overview

overview

10

Static

static

1

4b9cc70454...a04b47

debian-9-armhf

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4b9cc70454bbbb66672c4c322da04b47

  • Size

    37KB

  • Sample

    231219-25wwbaebb2

  • MD5

    4b9cc70454bbbb66672c4c322da04b47

  • SHA1

    7d9692a702ffe7f4b7d6b3f5aac5f39d8d6f560f

  • SHA256

    6db9132bf65b9923c3b14b79edac73d5cea64999af0b5224bd11865e23283885

  • SHA512

    7145b984783a69fa4fec01532d411f5b6007a4e3bc8fca8f3358cc8999fbeac024b8e67865b2ddcdcf5849d2e7fedf31d65fa58029987a8c73d7aabaed6a87c3

  • SSDEEP

    768:Ex81fgq9/GXnMkMUEm0J+opts2sDC0sdGz3A+D3dj9ygo3Uo6:ZdgWY0UEmZDFsdOwSo6

Score
10/10
kaitenbotnetpersistence

Malware Config

Targets

    • Target

      4b9cc70454bbbb66672c4c322da04b47

    • Size

      37KB

    • MD5

      4b9cc70454bbbb66672c4c322da04b47

    • SHA1

      7d9692a702ffe7f4b7d6b3f5aac5f39d8d6f560f

    • SHA256

      6db9132bf65b9923c3b14b79edac73d5cea64999af0b5224bd11865e23283885

    • SHA512

      7145b984783a69fa4fec01532d411f5b6007a4e3bc8fca8f3358cc8999fbeac024b8e67865b2ddcdcf5849d2e7fedf31d65fa58029987a8c73d7aabaed6a87c3

    • SSDEEP

      768:Ex81fgq9/GXnMkMUEm0J+opts2sDC0sdGz3A+D3dj9ygo3Uo6:ZdgWY0UEmZDFsdOwSo6

    Score
    10/10
    kaitenbotnetpersistence

    • Detects Kaiten/Tsunami Payload

    • Kaiten/Tsunami

      Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.

      botnetkaiten

    • Writes DNS configuration

      Writes data to DNS resolver config file.

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

      persistence

    • Enumerates running processes

      Discovers information about currently running processes on the system

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks