kaiten | 3d35218401b01e771a30996e03fee170c5406bdb564c87064917d451a744ed9d

Analysis

max time kernel
81s
max time network
92s
platform
debian-9_mipsel
resource
debian9-mipsel-20231215-en
resource tags

arch:mipselimage:debian9-mipsel-20231215-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
20-12-2023 13:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb1e1bb42b9e27aa9af6220cff900fec
Size

33KB
MD5

bb1e1bb42b9e27aa9af6220cff900fec
SHA1

40aa62f24b5cba9cb679934b45db7a47abc0ab4d
SHA256

3d35218401b01e771a30996e03fee170c5406bdb564c87064917d451a744ed9d
SHA512

0fbd259b4dfc96930cab0ddf6102b79a5b593f025e63126efba8229efbccbcddaef82a0d44e4e0734adb3bfc2668a6630956ca2dee8d6346241027d875bf2a55
SSDEEP

768:kW/A2V9LY1p8PrtyELAm8YANwZBif4Lb3XROD0E/gVD1hWn:f/A2VJPjd0mGQcf4cDhIVD1+

Score

10^/10

kaiten botnet persistence

Malware Config

Signatures

Detects Kaiten/Tsunami Payload 1 IoCs

resource	yara_rule
behavioral1/memory/704-1-0x00400000-0x100015bc-memory.dmp	family_kaiten2

Kaiten/Tsunami
Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.
botnet kaiten

Writes DNS configuration 1 TTPs 1 IoCs

Writes data to DNS resolver config file.

Dynamic Resolution

T1568

description	ioc
File opened for modification	/etc/resolv.conf

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

persistence

Scheduled Task/Job

T1053

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.orYj2x	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Enumerates kernel/hardware configuration 1 TTPs 45 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/77/stat	killall
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/77/stat	killall
File opened for reading	/proc/145/cmdline	killall
File opened for reading	/proc/36/stat	killall
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/771/stat	killall
File opened for reading	/proc/895/stat	killall
File opened for reading	/proc/6/stat	killall
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/24/stat	killall
File opened for reading	/proc/37/stat	killall
File opened for reading	/proc/145/cmdline	killall
File opened for reading	/proc/393/stat	killall
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/76/stat	killall
File opened for reading	/proc/694/stat	killall
File opened for reading	/proc/145/stat	killall
File opened for reading	/proc/114/stat	killall
File opened for reading	/proc/75/stat	killall
File opened for reading	/proc/13/stat	killall
File opened for reading	/proc/37/stat	killall
File opened for reading	/proc/689/stat	killall
File opened for reading	/proc/67/stat	killall
File opened for reading	/proc/75/stat	killall
File opened for reading	/proc/74/stat	killall
File opened for reading	/proc/21/stat	killall
File opened for reading	/proc/12/stat	killall
File opened for reading	/proc/5/stat	killall
File opened for reading	/proc/704/cmdline	killall
File opened for reading	/proc/21/stat	killall
File opened for reading	/proc/14/stat	killall
File opened for reading	/proc/233/stat	killall
File opened for reading	/proc/19/stat	killall
File opened for reading	/proc/920/stat	killall
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/485/stat	killall
File opened for reading	/proc/709/stat	killall
File opened for reading	/proc/filesystems	killall
File opened for reading	/proc/323/stat	killall
File opened for reading	/proc/103/stat	killall
File opened for reading	/proc/9/stat	killall
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/16/stat	killall
File opened for reading	/proc/689/stat	killall
File opened for reading	/proc/16/stat	killall
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/746/stat	killall
File opened for reading	/proc/749/stat	killall
File opened for reading	/proc/76/stat	killall
File opened for reading	/proc/321/stat	killall
File opened for reading	/proc/22/stat	killall
File opened for reading	/proc/329/stat	killall
File opened for reading	/proc/691/stat	killall
File opened for reading	/proc/13/stat	killall
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/2/stat	killall
File opened for reading	/proc/149/stat	killall
File opened for reading	/proc/329/stat	killall

/tmp/bb1e1bb42b9e27aa9af6220cff900fec
/tmp/bb1e1bb42b9e27aa9af6220cff900fec
1⤵
PID:704
- /bin/sh
  sh -c "rm -rf /var/run/wgsh > /dev/null 2>&1 &"
  2⤵
  PID:706
- /bin/sh
  sh -c "rm -rf /var/run/bbsh > /dev/null 2>&1 &"
  2⤵
  PID:710
- /bin/sh
  sh -c "rm -rf /var/run/tty1 > /dev/null 2>&1 &"
  2⤵
  PID:716
- /bin/sh
  sh -c "rm -rf /var/run/tty2 > /dev/null 2>&1 &"
  2⤵
  PID:719
- /bin/sh
  sh -c "rm -rf /var/run/tty3 > /dev/null 2>&1 &"
  2⤵
  PID:722
- /bin/sh
  sh -c "rm -rf /var/run/tty4 > /dev/null 2>&1 &"
  2⤵
  PID:724
- /bin/sh
  sh -c "rm -rf /var/run/tty5 > /dev/null 2>&1 &"
  2⤵
  PID:727
- /bin/sh
  sh -c "rm -rf /var/run/tty6 > /dev/null 2>&1 &"
  2⤵
  PID:730
- /bin/sh
  sh -c "rm -rf /tmp/tty1 > /dev/null 2>&1 &"
  2⤵
  PID:732
- /bin/sh
  sh -c "rm -rf /tmp/tty2 > /dev/null 2>&1 &"
  2⤵
  PID:734
- /bin/sh
  sh -c "rm -rf /tmp/tty3 > /dev/null 2>&1 &"
  2⤵
  PID:736
- /bin/sh
  sh -c "rm -rf /tmp/tty4 > /dev/null 2>&1 &"
  2⤵
  PID:738
- /bin/sh
  sh -c "rm -rf /tmp/tty5 > /dev/null 2>&1 &"
  2⤵
  PID:740
- /bin/sh
  sh -c "rm -rf /tmp/tty6 > /dev/null 2>&1 &"
  2⤵
  PID:743
- /bin/sh
  sh -c "rm -rf /var/run/pty > /dev/null 2>&1 &"
  2⤵
  PID:745
- /bin/sh
  sh -c "killall -9 arm > /dev/null 2>&1 &"
  2⤵
  PID:748
- /bin/sh
  sh -c "killall -9 mips > /dev/null 2>&1 &"
  2⤵
  PID:750
- /bin/sh
  sh -c "killall -9 mipsel > /dev/null 2>&1 &"
  2⤵
  PID:752
- /bin/sh
  sh -c "killall -9 powerpc > /dev/null 2>&1 &"
  2⤵
  PID:754
- /bin/sh
  sh -c "killall -9 ppc > /dev/null 2>&1 &"
  2⤵
  PID:756
- /bin/sh
  sh -c "killall -9 daemon.armv4l.mod > /dev/null 2>&1 &"
  2⤵
  PID:758
- /bin/sh
  sh -c "killall -9 daemon.i686.mod > /dev/null 2>&1 &"
  2⤵
  PID:761
- /bin/sh
  sh -c "killall -9 daemon.mips.mod > /dev/null 2>&1 &"
  2⤵
  PID:763
- /bin/sh
  sh -c "killall -9 daemon.mipsel.mod > /dev/null 2>&1 &"
  2⤵
  PID:766
- /bin/sh
  sh -c "kill -9 `cat /tmp/.xs/*.pid` > /dev/null 2>&1 &"
  2⤵
  PID:768
- /bin/sh
  sh -c "rm -rf /tmp/.xs/* > /dev/null 2>&1 &"
  2⤵
  PID:772
- /bin/sh
  sh -c "sleep 432000 && reboot &"
  2⤵
  PID:774
- /bin/sh
  sh -c "echo \"nameserver 8.8.8.8\" > /etc/resolv.conf &"
  2⤵
  PID:776
- /bin/sh
  sh -c "chmod 700 /tmp/bb1e1bb42b9e27aa9af6220cff900fec > /dev/null 2>&1 &"
  2⤵
  PID:779
- /bin/sh
  sh -c "touch -acmr /bin/ls /tmp/bb1e1bb42b9e27aa9af6220cff900fec"
  2⤵
  PID:781
- - /usr/bin/touch
    touch -acmr /bin/ls /tmp/bb1e1bb42b9e27aa9af6220cff900fec
    3⤵
    PID:782
- /bin/sh
  sh -c "(crontab -l | grep -v \"/tmp/bb1e1bb42b9e27aa9af6220cff900fec\" | grep -v \"no cron\" | grep -v \"lesshts/run.sh\" > /var/run/.x001804289383) > /dev/null 2>&1"
  2⤵
  PID:784
- /bin/sh
  sh -c "echo \"* * * * * /tmp/bb1e1bb42b9e27aa9af6220cff900fec > /dev/null 2>&1 &\" >> /var/run/.x001804289383"
  2⤵
  PID:790
- /bin/sh
  sh -c "crontab /var/run/.x001804289383"
  2⤵
  PID:791
- - /usr/bin/crontab
    crontab /var/run/.x001804289383
    3⤵
    - Creates/modifies Cron job
    PID:792
- /bin/sh
  sh -c "rm -rf /var/run/.x001804289383"
  2⤵
  PID:793
- - /bin/rm
    rm -rf /var/run/.x001804289383
    3⤵
    PID:795
- /bin/sh
  sh -c "/bin/uname -n"
  2⤵
  PID:796
- - /bin/uname
    /bin/uname -n
    3⤵
    PID:797
- /bin/sh
  sh -c "/bin/uname -n"
  2⤵
  PID:798
- - /bin/uname
    /bin/uname -n
    3⤵
    PID:799
- /bin/sh
  sh -c "kill -9 `cat /var/run/httpd.pid` > /dev/null 2>&1 &"
  2⤵
  PID:884
- /bin/sh
  sh -c "service httpd stop > /dev/null 2>&1 &"
  2⤵
  PID:886
- /bin/sh
  sh -c "killall -9 mini_httpd > /dev/null 2>&1 &"
  2⤵
  PID:889
- /bin/sh
  sh -c "killall -9 minihttpd > /dev/null 2>&1 &"
  2⤵
  PID:891
- /bin/sh
  sh -c "kill -9 `cat /var/run/thttpd.pid` > /dev/null 2>&1 &"
  2⤵
  PID:894
- /bin/sh
  sh -c "nvram set httpd_enable=0 > /dev/null 2>&1"
  2⤵
  PID:897
- /bin/sh
  sh -c "nvram set http_enable=0 > /dev/null 2>&1"
  2⤵
  PID:899
- /bin/sh
  sh -c "killall -9 httpd > /dev/null 2>&1 &"
  2⤵
  PID:901
- /bin/sh
  sh -c "service telnetd stop > /dev/null 2>&1 &"
  2⤵
  PID:903
- /bin/sh
  sh -c "service sshd stop > /dev/null 2>&1 &"
  2⤵
  PID:908
- /bin/sh
  sh -c "killall -9 telnetd > /dev/null 2>&1 &"
  2⤵
  PID:910
- /bin/sh
  sh -c "killall -9 utelnetd > /dev/null 2>&1 &"
  2⤵
  PID:913
- /bin/sh
  sh -c "killall -9 dropbear > /dev/null 2>&1 &"
  2⤵
  PID:917
- /bin/sh
  sh -c "killall -9 sshd > /dev/null 2>&1 &"
  2⤵
  PID:921
- /bin/sh
  sh -c "killall -9 lighttpd > /dev/null 2>&1 &"
  2⤵
  PID:923

/bin/rm
rm -rf /var/run/wgsh
1⤵
PID:708

/bin/rm
rm -rf /var/run/bbsh
1⤵
PID:715

/bin/rm
rm -rf /var/run/tty1
1⤵
PID:718

/bin/rm
rm -rf /var/run/tty2
1⤵
PID:721

/bin/rm
rm -rf /var/run/tty3
1⤵
PID:723

/bin/rm
rm -rf /var/run/tty4
1⤵
PID:726

/bin/rm
rm -rf /var/run/tty5
1⤵
PID:729

/bin/rm
rm -rf /var/run/tty6
1⤵
PID:731

/bin/rm
rm -rf /tmp/tty1
1⤵
PID:733

/bin/rm
rm -rf /tmp/tty2
1⤵
PID:735

/bin/rm
rm -rf /tmp/tty3
1⤵
PID:737

/bin/rm
rm -rf /tmp/tty4
1⤵
PID:739

/bin/rm
rm -rf /tmp/tty5
1⤵
PID:742

/bin/rm
rm -rf /tmp/tty6
1⤵
PID:744

/bin/rm
rm -rf /var/run/pty
1⤵
PID:747

/usr/bin/killall
killall -9 arm
1⤵
- Reads runtime system information
PID:749

/usr/bin/killall
killall -9 mips
1⤵
- Reads runtime system information
PID:751

/usr/bin/killall
killall -9 mipsel
1⤵
- Reads runtime system information
PID:753

/usr/bin/killall
killall -9 powerpc
1⤵
- Reads runtime system information
PID:755

/usr/bin/killall
killall -9 ppc
1⤵
- Reads runtime system information
PID:757

/usr/bin/killall
killall -9 daemon.armv4l.mod
1⤵
- Reads runtime system information
PID:760

/usr/bin/killall
killall -9 daemon.i686.mod
1⤵
- Reads runtime system information
PID:762

/usr/bin/killall
killall -9 daemon.mips.mod
1⤵
- Reads runtime system information
PID:765

/usr/bin/killall
killall -9 daemon.mipsel.mod
1⤵
- Reads runtime system information
PID:767

/bin/cat
cat "/tmp/.xs/*.pid"
1⤵
PID:771

/bin/rm
rm -rf "/tmp/.xs/*"
1⤵
PID:773

/bin/sleep
sleep 432000
1⤵
PID:777

/bin/chmod
chmod 700 /tmp/bb1e1bb42b9e27aa9af6220cff900fec
1⤵
PID:780

/bin/grep
grep -v "no cron"
1⤵
PID:788

/bin/grep
grep -v /tmp/bb1e1bb42b9e27aa9af6220cff900fec
1⤵
PID:787

/usr/bin/crontab
crontab -l
1⤵
PID:786

/bin/grep
grep -v lesshts/run.sh
1⤵
PID:789

/bin/cat
cat /var/run/httpd.pid
1⤵
PID:887

/usr/sbin/service
service httpd stop
1⤵
PID:888
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:892
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:895
- /bin/systemctl
  systemctl --quiet is-active multi-user.target
  2⤵
  - Enumerates kernel/hardware configuration
  PID:900
- /bin/systemctl
  systemctl -p Triggers show dbus.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:925
- /bin/systemctl
  systemctl -p Triggers show ssh.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:939
- /bin/systemctl
  systemctl -p Triggers show syslog.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:942
- /bin/systemctl
  systemctl -p Triggers show systemd-fsckd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:945
- /bin/systemctl
  systemctl -p Triggers show systemd-initctl.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:948
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-audit.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:951
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-dev-log.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:954
- /bin/systemctl
  systemctl -p Triggers show systemd-journald.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:957
- /bin/systemctl
  systemctl -p Triggers show systemd-networkd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:960
- /bin/systemctl
  systemctl -p Triggers show systemd-rfkill.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:963
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-control.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:966
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-kernel.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:969

/usr/bin/killall
killall -9 mini_httpd
1⤵
- Reads runtime system information
PID:890

/usr/bin/killall
killall -9 minihttpd
1⤵
- Reads runtime system information
PID:893

/bin/cat
cat /var/run/thttpd.pid
1⤵
PID:898

/usr/bin/killall
killall -9 httpd
1⤵
- Reads runtime system information
PID:902

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Enumerates kernel/hardware configuration
PID:905

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
PID:906

/usr/sbin/service
service telnetd stop
1⤵
PID:907
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:911
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:915
- /bin/systemctl
  systemctl --quiet is-active multi-user.target
  2⤵
  - Enumerates kernel/hardware configuration
  PID:920
- /bin/systemctl
  systemctl -p Triggers show dbus.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:938
- /bin/systemctl
  systemctl -p Triggers show ssh.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:941
- /bin/systemctl
  systemctl -p Triggers show syslog.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:944
- /bin/systemctl
  systemctl -p Triggers show systemd-fsckd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:947
- /bin/systemctl
  systemctl -p Triggers show systemd-initctl.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:950
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-audit.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:953
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-dev-log.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:956
- /bin/systemctl
  systemctl -p Triggers show systemd-journald.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:959
- /bin/systemctl
  systemctl -p Triggers show systemd-networkd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:962
- /bin/systemctl
  systemctl -p Triggers show systemd-rfkill.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:965
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-control.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:968
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-kernel.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:971

/usr/sbin/service
service sshd stop
1⤵
PID:909
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:914
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:918
- /bin/systemctl
  systemctl --quiet is-active multi-user.target
  2⤵
  - Enumerates kernel/hardware configuration
  PID:924
- /bin/systemctl
  systemctl -p Triggers show dbus.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:940
- /bin/systemctl
  systemctl -p Triggers show ssh.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:943
- /bin/systemctl
  systemctl -p Triggers show syslog.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:946
- /bin/systemctl
  systemctl -p Triggers show systemd-fsckd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:949
- /bin/systemctl
  systemctl -p Triggers show systemd-initctl.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:952
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-audit.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:955
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-dev-log.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:958
- /bin/systemctl
  systemctl -p Triggers show systemd-journald.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:961
- /bin/systemctl
  systemctl -p Triggers show systemd-networkd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:964
- /bin/systemctl
  systemctl -p Triggers show systemd-rfkill.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:967
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-control.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:970
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-kernel.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:972

/usr/bin/killall
killall -9 telnetd
1⤵
- Reads runtime system information
PID:912

/usr/bin/killall
killall -9 utelnetd
1⤵
- Reads runtime system information
PID:916

/usr/bin/killall
killall -9 dropbear
1⤵
- Reads runtime system information
PID:919

/usr/bin/killall
killall -9 sshd
1⤵
- Reads runtime system information
PID:922

/usr/bin/killall
killall -9 lighttpd
1⤵
- Reads runtime system information
PID:926

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:929

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
PID:931

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
PID:934

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:933

/usr/local/sbin/systemctl
systemctl stop httpd.service
1⤵
PID:888

/usr/local/bin/systemctl
systemctl stop httpd.service
1⤵
PID:888

/usr/sbin/systemctl
systemctl stop httpd.service
1⤵
PID:888

/usr/bin/systemctl
systemctl stop httpd.service
1⤵
PID:888

/sbin/systemctl
systemctl stop httpd.service
1⤵
PID:888

/bin/systemctl
systemctl stop httpd.service
1⤵
- Enumerates kernel/hardware configuration
PID:888

/usr/local/sbin/systemctl
systemctl stop sshd.service
1⤵
PID:909

/usr/local/bin/systemctl
systemctl stop sshd.service
1⤵
PID:909

/usr/sbin/systemctl
systemctl stop sshd.service
1⤵
PID:909

/usr/bin/systemctl
systemctl stop sshd.service
1⤵
PID:909

/sbin/systemctl
systemctl stop sshd.service
1⤵
PID:909

/bin/systemctl
systemctl stop sshd.service
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:909

/usr/local/sbin/systemctl
systemctl stop telnetd.service
1⤵
PID:907

/usr/local/bin/systemctl
systemctl stop telnetd.service
1⤵
PID:907

/usr/sbin/systemctl
systemctl stop telnetd.service
1⤵
PID:907

/usr/bin/systemctl
systemctl stop telnetd.service
1⤵
PID:907

/sbin/systemctl
systemctl stop telnetd.service
1⤵
PID:907

/bin/systemctl
systemctl stop telnetd.service
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:907

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Dynamic Resolution

T1568

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/run/.x001804289383

Filesize
67B

MD5
dc5aa368b54ba07eda880878fa15b6d2

SHA1
9670a3ae6af449cf46722657866d4542c23f221d

SHA256
b42d3598e5f9fb8675f0f32b7924d9a3867dabc8bd4db396bb2cdb5da36b0da4

SHA512
822fe386ae357a2b9e1588a2129bd17e1cf9a286f074e6d9f2dffac526c90f0ba2db8b9a7c91b398421413cb3f91992b6a221ef22b1d2e17ae37d01304f8cd90

Download Submit
/var/spool/cron/crontabs/tmp.orYj2x

Filesize
264B

MD5
900d43c4421ddd909e1aa015b0da7298

SHA1
87c168f84b2150f55c1f5ce7cf8d8a0dfa9b20f5

SHA256
51324017e2daaaef01e6e3842187523778844ba787a1ae98c79faa07e9de5049

SHA512
24345a513d1402cf7dd03282a7e98b9c49c3327b73c7471525a89b146021a4f2e366c4fe4f49831747dc66663b9ad2f806284dbde6d054e2ab76b62658e3a832

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads