Analysis
-
max time kernel
27s -
max time network
13s -
platform
debian-9_armhf -
resource
debian9-armhf-20231215-en -
resource tags
-
submitted
19-12-2023 23:10
General
-
Target
4b9cc70454bbbb66672c4c322da04b47
-
Size
37KB
-
MD5
4b9cc70454bbbb66672c4c322da04b47
-
SHA1
7d9692a702ffe7f4b7d6b3f5aac5f39d8d6f560f
-
SHA256
6db9132bf65b9923c3b14b79edac73d5cea64999af0b5224bd11865e23283885
-
SHA512
7145b984783a69fa4fec01532d411f5b6007a4e3bc8fca8f3358cc8999fbeac024b8e67865b2ddcdcf5849d2e7fedf31d65fa58029987a8c73d7aabaed6a87c3
-
SSDEEP
768:Ex81fgq9/GXnMkMUEm0J+opts2sDC0sdGz3A+D3dj9ygo3Uo6:ZdgWY0UEmZDFsdOwSo6
Score
10/10
Malware Config
Signatures
-
Detects Kaiten/Tsunami Payload 1 IoCs
-
Kaiten/Tsunami
Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.
-
Writes DNS configuration 1 TTPs 1 IoCs
Writes data to DNS resolver config file.
-
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Enumerates kernel/hardware configuration 1 TTPs 45 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/4b9cc70454bbbb66672c4c322da04b47/tmp/4b9cc70454bbbb66672c4c322da04b471⤵
-
/bin/shsh -c "rm -rf /var/run/wgsh > /dev/null 2>&1 &"2⤵
-
/bin/shsh -c "rm -rf /var/run/bbsh > /dev/null 2>&1 &"2⤵
-
/bin/shsh -c "rm -rf /var/run/tty0 > /dev/null 2>&1 &"2⤵
-
/bin/shsh -c "rm -rf /var/run/tty1 > /dev/null 2>&1 &"2⤵
-
/bin/shsh -c "rm -rf /var/run/tty2 > /dev/null 2>&1 &"2⤵
-
/bin/shsh -c "rm -rf /var/run/tty3 > /dev/null 2>&1 &"2⤵
-
/bin/shsh -c "rm -rf /var/run/tty5 > /dev/null 2>&1 &"2⤵
-
/bin/shsh -c "rm -rf /var/run/tty6 > /dev/null 2>&1 &"2⤵
-
/bin/shsh -c "rm -rf /tmp/tty0 > /dev/null 2>&1 &"2⤵
-
/bin/shsh -c "rm -rf /tmp/tty1 > /dev/null 2>&1 &"2⤵
-
/bin/shsh -c "rm -rf /tmp/tty2 > /dev/null 2>&1 &"2⤵
-
/bin/shsh -c "rm -rf /tmp/tty3 > /dev/null 2>&1 &"2⤵
-
/bin/shsh -c "rm -rf /tmp/tty5 > /dev/null 2>&1 &"2⤵
-
/bin/shsh -c "rm -rf /tmp/tty6 > /dev/null 2>&1 &"2⤵
-
/bin/shsh -c "rm -rf /var/run/pty > /dev/null 2>&1 &"2⤵
-
/bin/shsh -c "killall -9 arm > /dev/null 2>&1 &"2⤵
-
/bin/shsh -c "killall -9 mips > /dev/null 2>&1 &"2⤵
-
/bin/shsh -c "killall -9 mipsel > /dev/null 2>&1 &"2⤵
-
/bin/shsh -c "killall -9 powerpc > /dev/null 2>&1 &"2⤵
-
/bin/shsh -c "killall -9 ppc > /dev/null 2>&1 &"2⤵
-
/bin/shsh -c "killall -9 daemon.armv4l.mod > /dev/null 2>&1 &"2⤵
-
/bin/shsh -c "killall -9 daemon.i686.mod > /dev/null 2>&1 &"2⤵
-
/bin/shsh -c "killall -9 daemon.mips.mod > /dev/null 2>&1 &"2⤵
-
/bin/shsh -c "killall -9 daemon.mipsel.mod > /dev/null 2>&1 &"2⤵
-
/bin/shsh -c "kill -9 `cat /tmp/.xs/*.pid` > /dev/null 2>&1 &"2⤵
-
/bin/shsh -c "rm -rf /tmp/.xs/* > /dev/null 2>&1 &"2⤵
-
/bin/shsh -c "sleep 432000 && reboot &"2⤵
-
/bin/shsh -c "echo \"nameserver 8.8.8.8\" > /etc/resolv.conf &"2⤵
-
/bin/shsh -c "chmod 700 /tmp/4b9cc70454bbbb66672c4c322da04b47 > /dev/null 2>&1 &"2⤵
-
/bin/shsh -c "touch -acmr /bin/ls /tmp/4b9cc70454bbbb66672c4c322da04b47"2⤵
-
/usr/bin/touchtouch -acmr /bin/ls /tmp/4b9cc70454bbbb66672c4c322da04b473⤵
-
/bin/shsh -c "(crontab -l | grep -v \"/tmp/4b9cc70454bbbb66672c4c322da04b47\" | grep -v \"no cron\" | grep -v \"lesshts/run.sh\" > /var/run/.x001804289383) > /dev/null 2>&1"2⤵
-
/bin/shsh -c "echo \"* * * * * /tmp/4b9cc70454bbbb66672c4c322da04b47 > /dev/null 2>&1 &\" >> /var/run/.x001804289383"2⤵
-
/bin/shsh -c "crontab /var/run/.x001804289383"2⤵
-
/usr/bin/crontabcrontab /var/run/.x0018042893833⤵
- Creates/modifies Cron job
-
/bin/shsh -c "rm -rf /var/run/.x001804289383"2⤵
-
/bin/rmrm -rf /var/run/.x0018042893833⤵
-
/bin/shsh -c "/bin/uname -n"2⤵
-
/bin/uname/bin/uname -n3⤵
-
/bin/shsh -c "/bin/uname -n"2⤵
-
/bin/uname/bin/uname -n3⤵
-
/bin/shsh -c "kill -9 `cat /var/run/httpd.pid` > /dev/null 2>&1 &"2⤵
-
/bin/shsh -c "service httpd stop > /dev/null 2>&1 &"2⤵
-
/bin/shsh -c "killall -9 mini_httpd > /dev/null 2>&1 &"2⤵
-
/bin/shsh -c "killall -9 minihttpd > /dev/null 2>&1 &"2⤵
-
/bin/shsh -c "kill -9 `cat /var/run/thttpd.pid` > /dev/null 2>&1 &"2⤵
-
/bin/shsh -c "nvram set httpd_enable=0 > /dev/null 2>&1"2⤵
-
/bin/shsh -c "nvram set http_enable=0 > /dev/null 2>&1"2⤵
-
/bin/shsh -c "killall -9 httpd > /dev/null 2>&1 &"2⤵
-
/bin/shsh -c "service telnetd stop > /dev/null 2>&1 &"2⤵
-
/bin/shsh -c "service sshd stop > /dev/null 2>&1 &"2⤵
-
/bin/shsh -c "killall -9 telnetd > /dev/null 2>&1 &"2⤵
-
/bin/shsh -c "killall -9 utelnetd > /dev/null 2>&1 &"2⤵
-
/bin/shsh -c "killall -9 dropbear > /dev/null 2>&1 &"2⤵
-
/bin/shsh -c "killall -9 sshd > /dev/null 2>&1 &"2⤵
-
/bin/shsh -c "killall -9 lighttpd > /dev/null 2>&1 &"2⤵
-
/bin/rmrm -rf /var/run/wgsh1⤵
-
/bin/rmrm -rf /var/run/bbsh1⤵
-
/bin/rmrm -rf /var/run/tty01⤵
-
/bin/rmrm -rf /var/run/tty11⤵
-
/bin/rmrm -rf /var/run/tty21⤵
-
/bin/rmrm -rf /var/run/tty31⤵
-
/bin/rmrm -rf /var/run/tty51⤵
-
/bin/rmrm -rf /var/run/tty61⤵
-
/bin/rmrm -rf /tmp/tty01⤵
-
/bin/rmrm -rf /tmp/tty11⤵
-
/bin/rmrm -rf /tmp/tty21⤵
-
/bin/rmrm -rf /tmp/tty31⤵
-
/bin/rmrm -rf /tmp/tty51⤵
-
/bin/rmrm -rf /tmp/tty61⤵
-
/bin/rmrm -rf /var/run/pty1⤵
-
/usr/bin/killallkillall -9 arm1⤵
- Reads runtime system information
-
/usr/bin/killallkillall -9 mips1⤵
- Reads runtime system information
-
/usr/bin/killallkillall -9 mipsel1⤵
- Reads runtime system information
-
/usr/bin/killallkillall -9 powerpc1⤵
- Reads runtime system information
-
/usr/bin/killallkillall -9 ppc1⤵
- Reads runtime system information
-
/usr/bin/killallkillall -9 daemon.armv4l.mod1⤵
- Reads runtime system information
-
/usr/bin/killallkillall -9 daemon.i686.mod1⤵
- Reads runtime system information
-
/usr/bin/killallkillall -9 daemon.mips.mod1⤵
-
/usr/bin/killallkillall -9 daemon.mipsel.mod1⤵
- Reads runtime system information
-
/bin/catcat "/tmp/.xs/*.pid"1⤵
-
/bin/rmrm -rf "/tmp/.xs/*"1⤵
-
/bin/sleepsleep 4320001⤵
-
/bin/chmodchmod 700 /tmp/4b9cc70454bbbb66672c4c322da04b471⤵
-
/usr/bin/crontabcrontab -l1⤵
-
/bin/grepgrep -v /tmp/4b9cc70454bbbb66672c4c322da04b471⤵
-
/bin/grepgrep -v "no cron"1⤵
-
/bin/grepgrep -v lesshts/run.sh1⤵
-
/bin/catcat /var/run/httpd.pid1⤵
-
/usr/sbin/serviceservice httpd stop1⤵
-
/usr/bin/basenamebasename /usr/sbin/service2⤵
-
/usr/bin/basenamebasename /usr/sbin/service2⤵
-
/bin/systemctlsystemctl --quiet is-active multi-user.target2⤵
- Enumerates kernel/hardware configuration
-
/bin/systemctlsystemctl -p Triggers show dbus.socket2⤵
- Enumerates kernel/hardware configuration
-
/bin/systemctlsystemctl -p Triggers show ssh.socket2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/bin/systemctlsystemctl -p Triggers show syslog.socket2⤵
- Enumerates kernel/hardware configuration
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket2⤵
- Enumerates kernel/hardware configuration
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket2⤵
- Enumerates kernel/hardware configuration
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket2⤵
- Enumerates kernel/hardware configuration
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket2⤵
- Enumerates kernel/hardware configuration
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket2⤵
- Enumerates kernel/hardware configuration
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket2⤵
- Enumerates kernel/hardware configuration
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket2⤵
- Enumerates kernel/hardware configuration
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket2⤵
- Enumerates kernel/hardware configuration
-
/usr/bin/killallkillall -9 mini_httpd1⤵
- Reads runtime system information
-
/usr/bin/killallkillall -9 minihttpd1⤵
- Reads runtime system information
-
/bin/catcat /var/run/thttpd.pid1⤵
-
/usr/bin/killallkillall -9 httpd1⤵
- Reads runtime system information
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"1⤵
- Enumerates kernel/hardware configuration
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"1⤵
-
/usr/sbin/serviceservice telnetd stop1⤵
-
/usr/bin/basenamebasename /usr/sbin/service2⤵
-
/usr/bin/basenamebasename /usr/sbin/service2⤵
-
/bin/systemctlsystemctl --quiet is-active multi-user.target2⤵
- Enumerates kernel/hardware configuration
-
/bin/systemctlsystemctl -p Triggers show dbus.socket2⤵
- Enumerates kernel/hardware configuration
-
/bin/systemctlsystemctl -p Triggers show ssh.socket2⤵
- Enumerates kernel/hardware configuration
-
/bin/systemctlsystemctl -p Triggers show syslog.socket2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket2⤵
- Enumerates kernel/hardware configuration
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket2⤵
- Enumerates kernel/hardware configuration
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket2⤵
- Enumerates kernel/hardware configuration
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket2⤵
- Enumerates kernel/hardware configuration
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket2⤵
- Enumerates kernel/hardware configuration
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket2⤵
- Enumerates kernel/hardware configuration
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket2⤵
- Enumerates kernel/hardware configuration
-
/usr/sbin/serviceservice sshd stop1⤵
-
/usr/bin/basenamebasename /usr/sbin/service2⤵
-
/usr/bin/basenamebasename /usr/sbin/service2⤵
-
/bin/systemctlsystemctl --quiet is-active multi-user.target2⤵
- Enumerates kernel/hardware configuration
-
/bin/systemctlsystemctl -p Triggers show dbus.socket2⤵
- Enumerates kernel/hardware configuration
-
/bin/systemctlsystemctl -p Triggers show ssh.socket2⤵
- Enumerates kernel/hardware configuration
-
/bin/systemctlsystemctl -p Triggers show syslog.socket2⤵
- Enumerates kernel/hardware configuration
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket2⤵
- Enumerates kernel/hardware configuration
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket2⤵
- Enumerates kernel/hardware configuration
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket2⤵
- Enumerates kernel/hardware configuration
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket2⤵
- Enumerates kernel/hardware configuration
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket2⤵
- Enumerates kernel/hardware configuration
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket2⤵
- Enumerates kernel/hardware configuration
-
/usr/bin/killallkillall -9 telnetd1⤵
- Reads runtime system information
-
/usr/bin/killallkillall -9 utelnetd1⤵
- Reads runtime system information
-
/usr/bin/killallkillall -9 dropbear1⤵
- Reads runtime system information
-
/usr/bin/killallkillall -9 sshd1⤵
- Reads runtime system information
-
/usr/bin/killallkillall -9 lighttpd1⤵
- Reads runtime system information
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"1⤵
- Enumerates kernel/hardware configuration
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"1⤵
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"1⤵
- Enumerates kernel/hardware configuration
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"1⤵
-
/usr/local/sbin/systemctlsystemctl stop httpd.service1⤵
-
/usr/local/bin/systemctlsystemctl stop httpd.service1⤵
-
/usr/sbin/systemctlsystemctl stop httpd.service1⤵
-
/usr/bin/systemctlsystemctl stop httpd.service1⤵
-
/sbin/systemctlsystemctl stop httpd.service1⤵
-
/bin/systemctlsystemctl stop httpd.service1⤵
- Enumerates kernel/hardware configuration
-
/usr/local/sbin/systemctlsystemctl stop telnetd.service1⤵
-
/usr/local/bin/systemctlsystemctl stop telnetd.service1⤵
-
/usr/sbin/systemctlsystemctl stop telnetd.service1⤵
-
/usr/bin/systemctlsystemctl stop telnetd.service1⤵
-
/sbin/systemctlsystemctl stop telnetd.service1⤵
-
/bin/systemctlsystemctl stop telnetd.service1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/local/sbin/systemctlsystemctl stop sshd.service1⤵
-
/usr/local/bin/systemctlsystemctl stop sshd.service1⤵
-
/usr/sbin/systemctlsystemctl stop sshd.service1⤵
-
/usr/bin/systemctlsystemctl stop sshd.service1⤵
-
/sbin/systemctlsystemctl stop sshd.service1⤵
-
/bin/systemctlsystemctl stop sshd.service1⤵
- Enumerates kernel/hardware configuration
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
/run/.x001804289383Filesize
67B
MD5c0db67973931eca112a7a7cbf892af71
SHA16fcabdc6f2594bdc11e7cb87a07149c82ef8a43d
SHA25667d0196dfd3cca3ec33a09b958debee1fcd36034404b3b0469c0e414e6e0ba74
SHA512f4dd952332d648f79358f34378f7ab0c3a0f8611ac4af3cf2263749dcb3a28cb744a4160168f8c414ea70ca7ecdc06452f723156a16bbca35cc4140f92c33d79
-
/var/spool/cron/crontabs/tmp.t3o6yfFilesize
264B
MD51f72b0aff5871be5ed4763a9a42a2bfa
SHA18302b0570d046eb53fe3d7976a739caf482da6d0
SHA25673899e6647d193c4b715b66be15ba8936df716a5b0219a26fef3cbad0b18bfce
SHA5126701da700808fa41937d40d99e12339c1bafda872008357b5ca52de09f54d418645bb928e913a4bf506686e87421218f83df7682469e1af0aafb2836f29b1231
-
memory/658-1-0x00008000-0x00029e80-memory.dmp