kaiten | 01ff62737a14a29b9ba2200d58409b9aae5e8e2b439f341fc439a6ea79c335c5

General

Target

4e6d4d8c059b40f731756ff4a548b537
Size

42KB
MD5

4e6d4d8c059b40f731756ff4a548b537
SHA1

a15aafed902c43a3e14d3e571a80a11f19105c47
SHA256

01ff62737a14a29b9ba2200d58409b9aae5e8e2b439f341fc439a6ea79c335c5
SHA512

50bd7ae28792a5e18a417c3ea4a6c8a4a5739d8da1d408856d98fbff5e88d7d155f85a7c08c7047a284762ac4ac106c4fecd77f5248917e52d6ce02c8c8482d4
SSDEEP

768:Asm32ViuMNvQ0CVEWfz+evHo4KSot0Hve0zNqQ1PCGaVThKE+jOWWJK3UEg6:AsmYAvQRMj5sm6NqQ1KGaVThKEoPTg6

Score

10^/10

kaiten botnet persistence

Malware Config

Signatures

Detects Kaiten/Tsunami Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/655-1-0x00008000-0x0002c598-memory.dmp	family_kaiten2

Kaiten/Tsunami
Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.
botnet kaiten
Writes DNS configuration 1 TTPs 1 IoCs
Writes data to DNS resolver config file.

Dynamic Resolution
T1568

Processes:

description ioc

File opened for modification /etc/resolv.conf
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
persistence

Scheduled Task/Job
T1053

Processes:

crontab

description ioc process

File opened for modification /var/spool/cron/crontabs/tmp.O31KgN crontab
Enumerates running processes
Discovers information about currently running processes on the system

description	ioc
File opened for modification	/etc/resolv.conf

description	ioc	process
File opened for modification	/var/spool/cron/crontabs/tmp.O31KgN	crontab

Enumerates kernel/hardware configuration 1 TTPs 45 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

Processes:

systemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctl

description	ioc	process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

killallkillallsystemctlkillallkillallsystemctlkillallkillallsystemctlkillallkillallsystemctlkillallkillallkillallkillallkillallsystemctlkillallkillallkillallsystemctlsystemctlsystemctl

description	ioc	process
File opened for reading	/proc/632/stat	killall
File opened for reading	/proc/139/stat	killall
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1/stat	killall
File opened for reading	/proc/110/stat	killall
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/843/stat	killall
File opened for reading	/proc/723/stat	killall
File opened for reading	/proc/302/stat	killall
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/855/stat	killall
File opened for reading	/proc/281/stat	killall
File opened for reading	/proc/580/stat	killall
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/23/stat	killall
File opened for reading	/proc/43/stat	killall
File opened for reading	/proc/6/stat	killall
File opened for reading	/proc/43/stat	killall
File opened for reading	/proc/637/stat	killall
File opened for reading	/proc/704/stat	killall
File opened for reading	/proc/6/stat	killall
File opened for reading	/proc/14/stat	killall
File opened for reading	/proc/634/stat	killall
File opened for reading	/proc/17/stat	killall
File opened for reading	/proc/23/stat	killall
File opened for reading	/proc/3/stat	killall
File opened for reading	/proc/7/stat	killall
File opened for reading	/proc/284/stat	killall
File opened for reading	/proc/26/stat	killall
File opened for reading	/proc/867/stat	killall
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/19/stat	killall
File opened for reading	/proc/171/stat	killall
File opened for reading	/proc/579/stat	killall
File opened for reading	/proc/150/stat	killall
File opened for reading	/proc/268/stat	killall
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/337/stat	killall
File opened for reading	/proc/29/stat	killall
File opened for reading	/proc/42/stat	killall
File opened for reading	/proc/43/stat	killall
File opened for reading	/proc/24/stat	killall
File opened for reading	/proc/111/stat	killall
File opened for reading	/proc/574/stat	killall
File opened for reading	/proc/576/stat	killall
File opened for reading	/proc/19/stat	killall
File opened for reading	/proc/18/stat	killall
File opened for reading	/proc/7/stat	killall
File opened for reading	/proc/7/stat	killall
File opened for reading	/proc/111/cmdline	killall
File opened for reading	/proc/211/stat	killall
File opened for reading	/proc/5/stat	killall
File opened for reading	/proc/28/stat	killall
File opened for reading	/proc/302/stat	killall
File opened for reading	/proc/2/stat	killall
File opened for reading	/proc/7/stat	killall
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/579/stat	killall
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/281/stat	killall
File opened for reading	/proc/300/stat	killall
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/99/stat	killall

/tmp/4e6d4d8c059b40f731756ff4a548b537
/tmp/4e6d4d8c059b40f731756ff4a548b537
1⤵
PID:655

/bin/sh
sh -c "rm -rf /var/run/wgsh > /dev/null 2>&1 &"
2⤵
PID:656

/bin/sh
sh -c "rm -rf /var/run/bbsh > /dev/null 2>&1 &"
2⤵
PID:660

/bin/sh
sh -c "rm -rf /var/run/tty0 > /dev/null 2>&1 &"
2⤵
PID:664

/bin/sh
sh -c "rm -rf /var/run/tty1 > /dev/null 2>&1 &"
2⤵
PID:667

/bin/sh
sh -c "rm -rf /var/run/tty2 > /dev/null 2>&1 &"
2⤵
PID:669

/bin/sh
sh -c "rm -rf /var/run/tty3 > /dev/null 2>&1 &"
2⤵
PID:671

/bin/sh
sh -c "rm -rf /var/run/tty4 > /dev/null 2>&1 &"
2⤵
PID:673

/bin/sh
sh -c "rm -rf /var/run/tty5 > /dev/null 2>&1 &"
2⤵
PID:676

/bin/sh
sh -c "rm -rf /tmp/tty0 > /dev/null 2>&1 &"
2⤵
PID:678

/bin/sh
sh -c "rm -rf /tmp/tty1 > /dev/null 2>&1 &"
2⤵
PID:681

/bin/sh
sh -c "rm -rf /tmp/tty2 > /dev/null 2>&1 &"
2⤵
PID:684

/bin/sh
sh -c "rm -rf /tmp/tty3 > /dev/null 2>&1 &"
2⤵
PID:686

/bin/sh
sh -c "rm -rf /tmp/tty4 > /dev/null 2>&1 &"
2⤵
PID:688

/bin/sh
sh -c "rm -rf /tmp/tty5 > /dev/null 2>&1 &"
2⤵
PID:690

/bin/sh
sh -c "rm -rf /var/run/pty > /dev/null 2>&1 &"
2⤵
PID:693

/bin/sh
sh -c "killall -9 arm > /dev/null 2>&1 &"
2⤵
PID:695

/bin/sh
sh -c "killall -9 mips > /dev/null 2>&1 &"
2⤵
PID:697

/bin/sh
sh -c "killall -9 mipsel > /dev/null 2>&1 &"
2⤵
PID:699

/bin/sh
sh -c "killall -9 powerpc > /dev/null 2>&1 &"
2⤵
PID:701

/bin/sh
sh -c "killall -9 ppc > /dev/null 2>&1 &"
2⤵
PID:703

/bin/sh
sh -c "killall -9 daemon.armv4l.mod > /dev/null 2>&1 &"
2⤵
PID:705

/bin/sh
sh -c "killall -9 daemon.i686.mod > /dev/null 2>&1 &"
2⤵
PID:708

/bin/sh
sh -c "killall -9 daemon.mips.mod > /dev/null 2>&1 &"
2⤵
PID:710

/bin/sh
sh -c "killall -9 daemon.mipsel.mod > /dev/null 2>&1 &"
2⤵
PID:712

/bin/sh
sh -c "kill -9 `cat /tmp/.xs/*.pid` > /dev/null 2>&1 &"
2⤵
PID:714

/bin/sh
sh -c "rm -rf /tmp/.xs/* > /dev/null 2>&1 &"
2⤵
PID:716

/bin/sh
sh -c "sleep 432000 && reboot &"
2⤵
PID:719

/bin/sh
sh -c "echo \"nameserver 8.8.8.8\" > /etc/resolv.conf &"
2⤵
PID:722

/bin/sh
sh -c "chmod 700 /tmp/4e6d4d8c059b40f731756ff4a548b537 > /dev/null 2>&1 &"
2⤵
PID:726

/bin/sh
sh -c "touch -acmr /bin/ls /tmp/4e6d4d8c059b40f731756ff4a548b537"
2⤵
PID:728

/usr/bin/touch
touch -acmr /bin/ls /tmp/4e6d4d8c059b40f731756ff4a548b537
3⤵
PID:729

/bin/sh
sh -c "(crontab -l | grep -v \"/tmp/4e6d4d8c059b40f731756ff4a548b537\" | grep -v \"no cron\" | grep -v \"lesshts/run.sh\" > /var/run/.x001804289383) > /dev/null 2>&1"
2⤵
PID:730

/bin/sh
sh -c "echo \"* * * * * /tmp/4e6d4d8c059b40f731756ff4a548b537 > /dev/null 2>&1 &\" >> /var/run/.x001804289383"
2⤵
PID:736

/bin/sh
sh -c "crontab /var/run/.x001804289383"
2⤵
PID:737

/usr/bin/crontab
crontab /var/run/.x001804289383
3⤵
- Creates/modifies Cron job
PID:738

/bin/sh
sh -c "rm -rf /var/run/.x001804289383"
2⤵
PID:739

/bin/rm
rm -rf /var/run/.x001804289383
3⤵
PID:740

/bin/sh
sh -c "/bin/uname -n"
2⤵
PID:741

/bin/uname
/bin/uname -n
3⤵
PID:744

/bin/sh
sh -c "/bin/uname -n"
2⤵
PID:745

/bin/uname
/bin/uname -n
3⤵
PID:748

/bin/sh
sh -c "kill -9 `cat /var/run/httpd.pid` > /dev/null 2>&1 &"
2⤵
PID:826

/bin/sh
sh -c "service httpd stop > /dev/null 2>&1 &"
2⤵
PID:828

/bin/sh
sh -c "killall -9 mini_httpd > /dev/null 2>&1 &"
2⤵
PID:831

/bin/sh
sh -c "killall -9 minihttpd > /dev/null 2>&1 &"
2⤵
PID:833

/usr/bin/killall
killall -9 minihttpd
3⤵
PID:834

/bin/sh
sh -c "kill -9 `cat /var/run/thttpd.pid` > /dev/null 2>&1 &"
2⤵
PID:836

/bin/sh
sh -c "nvram set httpd_enable=0 > /dev/null 2>&1"
2⤵
PID:838

/bin/sh
sh -c "nvram set http_enable=0 > /dev/null 2>&1"
2⤵
PID:841

/bin/sh
sh -c "killall -9 httpd > /dev/null 2>&1 &"
2⤵
PID:842

/bin/sh
sh -c "service telnetd stop > /dev/null 2>&1 &"
2⤵
PID:845

/bin/sh
sh -c "service sshd stop > /dev/null 2>&1 &"
2⤵
PID:848

/bin/sh
sh -c "killall -9 telnetd > /dev/null 2>&1 &"
2⤵
PID:851

/bin/sh
sh -c "killall -9 utelnetd > /dev/null 2>&1 &"
2⤵
PID:859

/bin/sh
sh -c "killall -9 dropbear > /dev/null 2>&1 &"
2⤵
PID:863

/bin/sh
sh -c "killall -9 sshd > /dev/null 2>&1 &"
2⤵
PID:866

/bin/sh
sh -c "killall -9 lighttpd > /dev/null 2>&1 &"
2⤵
PID:868

/bin/rm
rm -rf /var/run/wgsh
1⤵
PID:659

/bin/rm
rm -rf /var/run/bbsh
1⤵
PID:663

/bin/rm
rm -rf /var/run/tty0
1⤵
PID:666

/bin/rm
rm -rf /var/run/tty1
1⤵
PID:668

/bin/rm
rm -rf /var/run/tty2
1⤵
PID:670

/bin/rm
rm -rf /var/run/tty3
1⤵
PID:672

/bin/rm
rm -rf /var/run/tty4
1⤵
PID:674

/bin/rm
rm -rf /var/run/tty5
1⤵
PID:677

/bin/rm
rm -rf /tmp/tty0
1⤵
PID:680

/bin/rm
rm -rf /tmp/tty1
1⤵
PID:683

/bin/rm
rm -rf /tmp/tty2
1⤵
PID:685

/bin/rm
rm -rf /tmp/tty3
1⤵
PID:687

/bin/rm
rm -rf /tmp/tty4
1⤵
PID:689

/bin/rm
rm -rf /tmp/tty5
1⤵
PID:692

/bin/rm
rm -rf /var/run/pty
1⤵
PID:694

/usr/bin/killall
killall -9 arm
1⤵
- Reads runtime system information
PID:696

/usr/bin/killall
killall -9 mips
1⤵
- Reads runtime system information
PID:698

/usr/bin/killall
killall -9 mipsel
1⤵
- Reads runtime system information
PID:700

/usr/bin/killall
killall -9 powerpc
1⤵
- Reads runtime system information
PID:702

/usr/bin/killall
killall -9 ppc
1⤵
- Reads runtime system information
PID:704

/usr/bin/killall
killall -9 daemon.armv4l.mod
1⤵
- Reads runtime system information
PID:707

/usr/bin/killall
killall -9 daemon.i686.mod
1⤵
- Reads runtime system information
PID:709

/usr/bin/killall
killall -9 daemon.mips.mod
1⤵
- Reads runtime system information
PID:711

/usr/bin/killall
killall -9 daemon.mipsel.mod
1⤵
- Reads runtime system information
PID:713

/bin/cat
cat "/tmp/.xs/*.pid"
1⤵
PID:717

/bin/rm
rm -rf "/tmp/.xs/*"
1⤵
PID:718

/bin/sleep
sleep 432000
1⤵
PID:723

/bin/chmod
chmod 700 /tmp/4e6d4d8c059b40f731756ff4a548b537
1⤵
PID:727

/usr/bin/crontab
crontab -l
1⤵
PID:732

/bin/grep
grep -v /tmp/4e6d4d8c059b40f731756ff4a548b537
1⤵
PID:733

/bin/grep
grep -v "no cron"
1⤵
PID:734

/bin/grep
grep -v lesshts/run.sh
1⤵
PID:735

/bin/cat
cat /var/run/httpd.pid
1⤵
PID:829

/usr/sbin/service
service httpd stop
1⤵
PID:830

/usr/bin/basename
basename /usr/sbin/service
2⤵
PID:835

/usr/bin/basename
basename /usr/sbin/service
2⤵
PID:840

/bin/systemctl
systemctl --quiet is-active multi-user.target
2⤵
- Enumerates kernel/hardware configuration
PID:843

/bin/systemctl
systemctl -p Triggers show dbus.socket
2⤵
- Enumerates kernel/hardware configuration
PID:877

/bin/systemctl
systemctl -p Triggers show ssh.socket
2⤵
- Enumerates kernel/hardware configuration
PID:883

/bin/systemctl
systemctl -p Triggers show syslog.socket
2⤵
- Enumerates kernel/hardware configuration
PID:886

/bin/systemctl
systemctl -p Triggers show systemd-fsckd.socket
2⤵
- Enumerates kernel/hardware configuration
PID:892

/bin/systemctl
systemctl -p Triggers show systemd-initctl.socket
2⤵
- Enumerates kernel/hardware configuration
PID:895

/bin/systemctl
systemctl -p Triggers show systemd-journald-audit.socket
2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:898

/bin/systemctl
systemctl -p Triggers show systemd-journald-dev-log.socket
2⤵
- Enumerates kernel/hardware configuration
PID:901

/bin/systemctl
systemctl -p Triggers show systemd-journald.socket
2⤵
- Enumerates kernel/hardware configuration
PID:904

/bin/systemctl
systemctl -p Triggers show systemd-networkd.socket
2⤵
- Enumerates kernel/hardware configuration
PID:907

/bin/systemctl
systemctl -p Triggers show systemd-rfkill.socket
2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:912

/bin/systemctl
systemctl -p Triggers show systemd-udevd-control.socket
2⤵
- Enumerates kernel/hardware configuration
PID:915

/bin/systemctl
systemctl -p Triggers show systemd-udevd-kernel.socket
2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:918

/usr/bin/killall
killall -9 mini_httpd
1⤵
- Reads runtime system information
PID:832

/bin/cat
cat /var/run/thttpd.pid
1⤵
PID:839

/usr/bin/killall
killall -9 httpd
1⤵
- Reads runtime system information
PID:844

/usr/sbin/service
service telnetd stop
1⤵
PID:847

/usr/bin/basename
basename /usr/sbin/service
2⤵
PID:849

/usr/bin/basename
basename /usr/sbin/service
2⤵
PID:856

/bin/systemctl
systemctl --quiet is-active multi-user.target
2⤵
- Enumerates kernel/hardware configuration
PID:860

/bin/systemctl
systemctl -p Triggers show dbus.socket
2⤵
- Enumerates kernel/hardware configuration
PID:884

/bin/systemctl
systemctl -p Triggers show ssh.socket
2⤵
- Enumerates kernel/hardware configuration
PID:891

/bin/systemctl
systemctl -p Triggers show syslog.socket
2⤵
- Enumerates kernel/hardware configuration
PID:894

/bin/systemctl
systemctl -p Triggers show systemd-fsckd.socket
2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:897

/bin/systemctl
systemctl -p Triggers show systemd-initctl.socket
2⤵
- Enumerates kernel/hardware configuration
PID:900

/bin/systemctl
systemctl -p Triggers show systemd-journald-audit.socket
2⤵
- Enumerates kernel/hardware configuration
PID:903

/bin/systemctl
systemctl -p Triggers show systemd-journald-dev-log.socket
2⤵
- Enumerates kernel/hardware configuration
PID:906

/bin/systemctl
systemctl -p Triggers show systemd-journald.socket
2⤵
- Enumerates kernel/hardware configuration
PID:911

/bin/systemctl
systemctl -p Triggers show systemd-networkd.socket
2⤵
- Enumerates kernel/hardware configuration
PID:914

/bin/systemctl
systemctl -p Triggers show systemd-rfkill.socket
2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:917

/bin/systemctl
systemctl -p Triggers show systemd-udevd-control.socket
2⤵
- Enumerates kernel/hardware configuration
PID:920

/bin/systemctl
systemctl -p Triggers show systemd-udevd-kernel.socket
2⤵
- Enumerates kernel/hardware configuration
PID:921

/usr/sbin/service
service sshd stop
1⤵
PID:850

/usr/bin/basename
basename /usr/sbin/service
2⤵
PID:854

/usr/bin/basename
basename /usr/sbin/service
2⤵
PID:861

/bin/systemctl
systemctl --quiet is-active multi-user.target
2⤵
- Enumerates kernel/hardware configuration
PID:865

/bin/systemctl
systemctl -p Triggers show dbus.socket
2⤵
- Enumerates kernel/hardware configuration
PID:882

/bin/systemctl
systemctl -p Triggers show ssh.socket
2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:885

/bin/systemctl
systemctl -p Triggers show syslog.socket
2⤵
- Enumerates kernel/hardware configuration
PID:887

/bin/systemctl
systemctl -p Triggers show systemd-fsckd.socket
2⤵
- Enumerates kernel/hardware configuration
PID:893

/bin/systemctl
systemctl -p Triggers show systemd-initctl.socket
2⤵
- Enumerates kernel/hardware configuration
PID:896

/bin/systemctl
systemctl -p Triggers show systemd-journald-audit.socket
2⤵
- Enumerates kernel/hardware configuration
PID:899

/bin/systemctl
systemctl -p Triggers show systemd-journald-dev-log.socket
2⤵
- Enumerates kernel/hardware configuration
PID:902

/bin/systemctl
systemctl -p Triggers show systemd-journald.socket
2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:905

/bin/systemctl
systemctl -p Triggers show systemd-networkd.socket
2⤵
- Enumerates kernel/hardware configuration
PID:910

/bin/systemctl
systemctl -p Triggers show systemd-rfkill.socket
2⤵
- Enumerates kernel/hardware configuration
PID:913

/bin/systemctl
systemctl -p Triggers show systemd-udevd-control.socket
2⤵
- Enumerates kernel/hardware configuration
PID:916

/bin/systemctl
systemctl -p Triggers show systemd-udevd-kernel.socket
2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:919

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Enumerates kernel/hardware configuration
PID:855

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
PID:857

/usr/bin/killall
killall -9 telnetd
1⤵
- Reads runtime system information
PID:858

/usr/bin/killall
killall -9 utelnetd
1⤵
- Reads runtime system information
PID:862

/usr/bin/killall
killall -9 dropbear
1⤵
- Reads runtime system information
PID:864

/usr/bin/killall
killall -9 sshd
1⤵
- Reads runtime system information
PID:867

/usr/bin/killall
killall -9 lighttpd
1⤵
- Reads runtime system information
PID:869

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Enumerates kernel/hardware configuration
PID:872

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Enumerates kernel/hardware configuration
PID:875

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
PID:876

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
PID:878

/usr/local/sbin/systemctl
systemctl stop httpd.service
1⤵
PID:830

/usr/local/bin/systemctl
systemctl stop httpd.service
1⤵
PID:830

/usr/sbin/systemctl
systemctl stop httpd.service
1⤵
PID:830

/usr/bin/systemctl
systemctl stop httpd.service
1⤵
PID:830

/sbin/systemctl
systemctl stop httpd.service
1⤵
PID:830

/bin/systemctl
systemctl stop httpd.service
1⤵
- Enumerates kernel/hardware configuration
PID:830

/usr/local/sbin/systemctl
systemctl stop sshd.service
1⤵
PID:850

/usr/local/bin/systemctl
systemctl stop sshd.service
1⤵
PID:850

/usr/sbin/systemctl
systemctl stop sshd.service
1⤵
PID:850

/usr/bin/systemctl
systemctl stop sshd.service
1⤵
PID:850

/sbin/systemctl
systemctl stop sshd.service
1⤵
PID:850

/bin/systemctl
systemctl stop sshd.service
1⤵
- Enumerates kernel/hardware configuration
PID:850

/usr/local/sbin/systemctl
systemctl stop telnetd.service
1⤵
PID:847

/usr/local/bin/systemctl
systemctl stop telnetd.service
1⤵
PID:847

/usr/sbin/systemctl
systemctl stop telnetd.service
1⤵
PID:847

/usr/bin/systemctl
systemctl stop telnetd.service
1⤵
PID:847

/sbin/systemctl
systemctl stop telnetd.service
1⤵
PID:847

/bin/systemctl
systemctl stop telnetd.service
1⤵
- Enumerates kernel/hardware configuration
PID:847

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Dynamic Resolution

1

T1568

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

/run/.x001804289383
Filesize
67B

MD5
18eccaa676fbba8b431036d402bb3082

SHA1
ccb127e34b1cb53a63072b820a036b2b7144f4fd

SHA256
5da96a4447f39dfbf3178a96a24df33ffc0ae76404de6411fb8333fd55bb5cdb

SHA512
23c9c570415c94a0a2a00dc35195379c4d2e8167792c9d81478297e9abd63018c420887853aa6be629942113728f8ff0a8242637b43166cf8ca731a2119015ea

Download Submit
/var/spool/cron/crontabs/tmp.O31KgN
Filesize
264B

MD5
a97783c11520677e71240afc8bd4629c

SHA1
c657e9670571b900d1566c2384b319c496dfdf97

SHA256
e08b7852c664eafddcb19b4686e08859325953ebe7891011a53b371b745a2acc

SHA512
1ef67e19b744046c6048c4c90597ba51d93098012066b2b691c9e629eaff5af49bb9f69a24a1e36f1a4be1c96b67db2892f06a29ba9715f683f696265a360edf

Download Submit
memory/655-1-0x00008000-0x0002c598-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads