kaiten | f199d3f16a1475ef2395898c8b102db6756c8f2a3ab7eda2b613430ea003acb1

General

Target

d547d86ce86849f33031d8a3643148aa
Size

62KB
MD5

d547d86ce86849f33031d8a3643148aa
SHA1

5b8054686bc9f986af7b145388aa9bf2f07420f5
SHA256

f199d3f16a1475ef2395898c8b102db6756c8f2a3ab7eda2b613430ea003acb1
SHA512

da20d1cdc82cec1ef87ecfb5e67e62f1ec31f2fbfe78341842557bb4131991c83b2e3d1a697ac382990162b24ea58dccc3041676e3fc54d7adb08590682fb4bb
SSDEEP

768:vYPjLmGo1TW7QXgdRv4r5J8+/DBW1DR/WhUiDH1kWsLnJgGlzDpYuR1JQHRkAg3:AvmG8i7Qwn4lJTC9YUaVkWqlVGu2RW

Score

10^/10

kaiten botnet persistence

Malware Config

Signatures

Detects Kaiten/Tsunami Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/717-1-0x00400000-0x0045fbf4-memory.dmp	family_kaiten2

Kaiten/Tsunami
Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.
botnet kaiten
Writes DNS configuration 1 TTPs 1 IoCs
Writes data to DNS resolver config file.

Dynamic Resolution
T1568

Processes:

description ioc

File opened for modification /etc/resolv.conf
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
persistence

Scheduled Task/Job
T1053

Processes:

crontab

description ioc process

File opened for modification /var/spool/cron/crontabs/tmp.dgZd5a crontab
Enumerates running processes
Discovers information about currently running processes on the system

description	ioc
File opened for modification	/etc/resolv.conf

description	ioc	process
File opened for modification	/var/spool/cron/crontabs/tmp.dgZd5a	crontab

Enumerates kernel/hardware configuration 1 TTPs 45 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

Processes:

systemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctl

description	ioc	process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

killallkillallkillallkillallkillallkillallkillallkillallkillallsystemctlkillallsystemctlsystemctlkillallkillallsystemctlsystemctlsystemctlsystemctlkillallkillallkillallkillallsystemctlsystemctl

description	ioc	process
File opened for reading	/proc/74/stat	killall
File opened for reading	/proc/13/stat	killall
File opened for reading	/proc/11/stat	killall
File opened for reading	/proc/37/stat	killall
File opened for reading	/proc/710/stat	killall
File opened for reading	/proc/332/stat	killall
File opened for reading	/proc/325/stat	killall
File opened for reading	/proc/112/stat	killall
File opened for reading	/proc/710/stat	killall
File opened for reading	/proc/717/cmdline	killall
File opened for reading	/proc/24/stat	killall
File opened for reading	/proc/122/stat	killall
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/156/stat	killall
File opened for reading	/proc/389/stat	killall
File opened for reading	/proc/15/stat	killall
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/332/stat	killall
File opened for reading	/proc/704/stat	killall
File opened for reading	/proc/17/stat	killall
File opened for reading	/proc/10/stat	killall
File opened for reading	/proc/704/stat	killall
File opened for reading	/proc/559/stat	killall
File opened for reading	/proc/74/stat	killall
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/687/stat	killall
File opened for reading	/proc/706/stat	killall
File opened for reading	/proc/77/stat	killall
File opened for reading	/proc/13/stat	killall
File opened for reading	/proc/706/stat	killall
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/70/stat	killall
File opened for reading	/proc/7/stat	killall
File opened for reading	/proc/112/stat	killall
File opened for reading	/proc/559/stat	killall
File opened for reading	/proc/787/stat	killall
File opened for reading	/proc/701/cmdline	killall
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/6/stat	killall
File opened for reading	/proc/406/stat	killall
File opened for reading	/proc/832/stat	killall
File opened for reading	/proc/406/stat	killall
File opened for reading	/proc/561/stat	killall
File opened for reading	/proc/361/stat	killall
File opened for reading	/proc/235/stat	killall
File opened for reading	/proc/2/stat	killall
File opened for reading	/proc/24/stat	killall
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/332/stat	killall
File opened for reading	/proc/511/stat	killall
File opened for reading	/proc/781/stat	killall
File opened for reading	/proc/21/stat	killall
File opened for reading	/proc/72/stat	killall
File opened for reading	/proc/702/cmdline	killall
File opened for reading	/proc/1/stat	killall
File opened for reading	/proc/122/stat	killall
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/5/stat	killall
File opened for reading	/proc/525/stat	killall
File opened for reading	/proc/1/stat	killall
File opened for reading	/proc/14/stat	killall
File opened for reading	/proc/380/stat	killall

/tmp/d547d86ce86849f33031d8a3643148aa
/tmp/d547d86ce86849f33031d8a3643148aa
1⤵
PID:717

/bin/sh
sh -c "rm -rf /var/run/wgsh > /dev/null 2>&1 &"
2⤵
PID:718

/bin/sh
sh -c "rm -rf /var/run/bbsh > /dev/null 2>&1 &"
2⤵
PID:721

/bin/sh
sh -c "rm -rf /var/run/tty0 > /dev/null 2>&1 &"
2⤵
PID:725

/bin/sh
sh -c "rm -rf /var/run/tty2 > /dev/null 2>&1 &"
2⤵
PID:730

/bin/sh
sh -c "rm -rf /var/run/tty3 > /dev/null 2>&1 &"
2⤵
PID:733

/bin/sh
sh -c "rm -rf /var/run/tty4 > /dev/null 2>&1 &"
2⤵
PID:735

/bin/sh
sh -c "rm -rf /var/run/tty5 > /dev/null 2>&1 &"
2⤵
PID:738

/bin/sh
sh -c "rm -rf /var/run/tty6 > /dev/null 2>&1 &"
2⤵
PID:741

/bin/sh
sh -c "rm -rf /tmp/tty0 > /dev/null 2>&1 &"
2⤵
PID:743

/bin/sh
sh -c "rm -rf /tmp/tty2 > /dev/null 2>&1 &"
2⤵
PID:746

/bin/sh
sh -c "rm -rf /tmp/tty3 > /dev/null 2>&1 &"
2⤵
PID:748

/bin/sh
sh -c "rm -rf /tmp/tty4 > /dev/null 2>&1 &"
2⤵
PID:750

/bin/sh
sh -c "rm -rf /tmp/tty5 > /dev/null 2>&1 &"
2⤵
PID:752

/bin/sh
sh -c "rm -rf /tmp/tty6 > /dev/null 2>&1 &"
2⤵
PID:754

/bin/sh
sh -c "rm -rf /var/run/pty > /dev/null 2>&1 &"
2⤵
PID:757

/bin/sh
sh -c "killall -9 arm > /dev/null 2>&1 &"
2⤵
PID:759

/bin/sh
sh -c "killall -9 mips > /dev/null 2>&1 &"
2⤵
PID:762

/bin/sh
sh -c "killall -9 mipsel > /dev/null 2>&1 &"
2⤵
PID:764

/bin/sh
sh -c "killall -9 powerpc > /dev/null 2>&1 &"
2⤵
PID:766

/bin/sh
sh -c "killall -9 ppc > /dev/null 2>&1 &"
2⤵
PID:768

/bin/sh
sh -c "killall -9 daemon.armv4l.mod > /dev/null 2>&1 &"
2⤵
PID:770

/bin/sh
sh -c "killall -9 daemon.i686.mod > /dev/null 2>&1 &"
2⤵
PID:773

/bin/sh
sh -c "killall -9 daemon.mips.mod > /dev/null 2>&1 &"
2⤵
PID:775

/bin/sh
sh -c "killall -9 daemon.mipsel.mod > /dev/null 2>&1 &"
2⤵
PID:778

/bin/sh
sh -c "kill -9 `cat /tmp/.xs/*.pid` > /dev/null 2>&1 &"
2⤵
PID:780

/bin/sh
sh -c "rm -rf /tmp/.xs/* > /dev/null 2>&1 &"
2⤵
PID:784

/bin/sh
sh -c "sleep 432000 && reboot &"
2⤵
PID:786

/bin/sh
sh -c "echo \"nameserver 8.8.8.8\" > /etc/resolv.conf &"
2⤵
PID:788

/bin/sh
sh -c "chmod 700 /tmp/d547d86ce86849f33031d8a3643148aa > /dev/null 2>&1 &"
2⤵
PID:791

/bin/sh
sh -c "touch -acmr /bin/ls /tmp/d547d86ce86849f33031d8a3643148aa"
2⤵
PID:793

/usr/bin/touch
touch -acmr /bin/ls /tmp/d547d86ce86849f33031d8a3643148aa
3⤵
PID:795

/bin/sh
sh -c "(crontab -l | grep -v \"/tmp/d547d86ce86849f33031d8a3643148aa\" | grep -v \"no cron\" | grep -v \"lesshts/run.sh\" > /var/run/.x001804289383) > /dev/null 2>&1"
2⤵
PID:796

/bin/sh
sh -c "echo \"* * * * * /tmp/d547d86ce86849f33031d8a3643148aa > /dev/null 2>&1 &\" >> /var/run/.x001804289383"
2⤵
PID:802

/bin/sh
sh -c "crontab /var/run/.x001804289383"
2⤵
PID:803

/usr/bin/crontab
crontab /var/run/.x001804289383
3⤵
- Creates/modifies Cron job
PID:804

/bin/sh
sh -c "rm -rf /var/run/.x001804289383"
2⤵
PID:806

/bin/rm
rm -rf /var/run/.x001804289383
3⤵
PID:807

/bin/sh
sh -c "/bin/uname -n"
2⤵
PID:808

/bin/uname
/bin/uname -n
3⤵
PID:809

/bin/sh
sh -c "/bin/uname -n"
2⤵
PID:810

/bin/uname
/bin/uname -n
3⤵
PID:811

/bin/sh
sh -c "kill -9 `cat /var/run/httpd.pid` > /dev/null 2>&1 &"
2⤵
PID:812

/bin/sh
sh -c "service httpd stop > /dev/null 2>&1 &"
2⤵
PID:814

/bin/sh
sh -c "killall -9 mini_httpd > /dev/null 2>&1 &"
2⤵
PID:817

/bin/sh
sh -c "killall -9 minihttpd > /dev/null 2>&1 &"
2⤵
PID:819

/bin/sh
sh -c "kill -9 `cat /var/run/thttpd.pid` > /dev/null 2>&1 &"
2⤵
PID:822

/bin/sh
sh -c "nvram set httpd_enable=0 > /dev/null 2>&1"
2⤵
PID:826

/bin/sh
sh -c "nvram set http_enable=0 > /dev/null 2>&1"
2⤵
PID:828

/bin/sh
sh -c "killall -9 httpd > /dev/null 2>&1 &"
2⤵
PID:829

/bin/sh
sh -c "service telnetd stop > /dev/null 2>&1 &"
2⤵
PID:831

/bin/sh
sh -c "service sshd stop > /dev/null 2>&1 &"
2⤵
PID:833

/bin/sh
sh -c "killall -9 telnetd > /dev/null 2>&1 &"
2⤵
PID:838

/bin/sh
sh -c "killall -9 utelnetd > /dev/null 2>&1 &"
2⤵
PID:841

/bin/sh
sh -c "killall -9 dropbear > /dev/null 2>&1 &"
2⤵
PID:845

/bin/sh
sh -c "killall -9 sshd > /dev/null 2>&1 &"
2⤵
PID:849

/bin/sh
sh -c "killall -9 lighttpd > /dev/null 2>&1 &"
2⤵
PID:851

/bin/rm
rm -rf /var/run/wgsh
1⤵
PID:720

/bin/rm
rm -rf /var/run/bbsh
1⤵
PID:724

/bin/rm
rm -rf /var/run/tty0
1⤵
PID:729

/bin/rm
rm -rf /var/run/tty2
1⤵
PID:732

/bin/rm
rm -rf /var/run/tty3
1⤵
PID:734

/bin/rm
rm -rf /var/run/tty4
1⤵
PID:737

/bin/rm
rm -rf /var/run/tty5
1⤵
PID:740

/bin/rm
rm -rf /var/run/tty6
1⤵
PID:742

/bin/rm
rm -rf /tmp/tty0
1⤵
PID:745

/bin/rm
rm -rf /tmp/tty2
1⤵
PID:747

/bin/rm
rm -rf /tmp/tty3
1⤵
PID:749

/bin/rm
rm -rf /tmp/tty4
1⤵
PID:751

/bin/rm
rm -rf /tmp/tty5
1⤵
PID:753

/bin/rm
rm -rf /tmp/tty6
1⤵
PID:756

/bin/rm
rm -rf /var/run/pty
1⤵
PID:758

/usr/bin/killall
killall -9 arm
1⤵
- Reads runtime system information
PID:761

/usr/bin/killall
killall -9 mips
1⤵
- Reads runtime system information
PID:763

/usr/bin/killall
killall -9 mipsel
1⤵
- Reads runtime system information
PID:765

/usr/bin/killall
killall -9 powerpc
1⤵
- Reads runtime system information
PID:767

/usr/bin/killall
killall -9 ppc
1⤵
- Reads runtime system information
PID:769

/usr/bin/killall
killall -9 daemon.armv4l.mod
1⤵
- Reads runtime system information
PID:772

/usr/bin/killall
killall -9 daemon.i686.mod
1⤵
- Reads runtime system information
PID:774

/usr/bin/killall
killall -9 daemon.mips.mod
1⤵
- Reads runtime system information
PID:776

/usr/bin/killall
killall -9 daemon.mipsel.mod
1⤵
- Reads runtime system information
PID:779

/bin/cat
cat "/tmp/.xs/*.pid"
1⤵
PID:783

/bin/rm
rm -rf "/tmp/.xs/*"
1⤵
PID:785

/bin/sleep
sleep 432000
1⤵
PID:789

/bin/chmod
chmod 700 /tmp/d547d86ce86849f33031d8a3643148aa
1⤵
PID:792

/usr/bin/crontab
crontab -l
1⤵
PID:798

/bin/grep
grep -v /tmp/d547d86ce86849f33031d8a3643148aa
1⤵
PID:799

/bin/grep
grep -v "no cron"
1⤵
PID:800

/bin/grep
grep -v lesshts/run.sh
1⤵
PID:801

/bin/cat
cat /var/run/httpd.pid
1⤵
PID:815

/usr/sbin/service
service httpd stop
1⤵
PID:816

/usr/bin/basename
basename /usr/sbin/service
2⤵
PID:820

/usr/bin/basename
basename /usr/sbin/service
2⤵
PID:823

/bin/systemctl
systemctl --quiet is-active multi-user.target
2⤵
- Enumerates kernel/hardware configuration
PID:827

/bin/systemctl
systemctl -p Triggers show dbus.socket
2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:854

/bin/systemctl
systemctl -p Triggers show ssh.socket
2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:863

/bin/systemctl
systemctl -p Triggers show syslog.socket
2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:870

/bin/systemctl
systemctl -p Triggers show systemd-fsckd.socket
2⤵
- Enumerates kernel/hardware configuration
PID:874

/bin/systemctl
systemctl -p Triggers show systemd-initctl.socket
2⤵
- Enumerates kernel/hardware configuration
PID:878

/bin/systemctl
systemctl -p Triggers show systemd-journald-audit.socket
2⤵
- Enumerates kernel/hardware configuration
PID:881

/bin/systemctl
systemctl -p Triggers show systemd-journald-dev-log.socket
2⤵
- Enumerates kernel/hardware configuration
PID:885

/bin/systemctl
systemctl -p Triggers show systemd-journald.socket
2⤵
- Enumerates kernel/hardware configuration
PID:889

/bin/systemctl
systemctl -p Triggers show systemd-networkd.socket
2⤵
- Enumerates kernel/hardware configuration
PID:897

/bin/systemctl
systemctl -p Triggers show systemd-rfkill.socket
2⤵
- Enumerates kernel/hardware configuration
PID:901

/bin/systemctl
systemctl -p Triggers show systemd-udevd-control.socket
2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:905

/bin/systemctl
systemctl -p Triggers show systemd-udevd-kernel.socket
2⤵
- Enumerates kernel/hardware configuration
PID:910

/usr/bin/killall
killall -9 mini_httpd
1⤵
PID:818

/usr/bin/killall
killall -9 minihttpd
1⤵
- Reads runtime system information
PID:821

/bin/cat
cat /var/run/thttpd.pid
1⤵
PID:825

/usr/bin/killall
killall -9 httpd
1⤵
- Reads runtime system information
PID:830

/usr/sbin/service
service telnetd stop
1⤵
PID:832

/usr/bin/basename
basename /usr/sbin/service
2⤵
PID:839

/usr/bin/basename
basename /usr/sbin/service
2⤵
PID:843

/bin/systemctl
systemctl --quiet is-active multi-user.target
2⤵
- Enumerates kernel/hardware configuration
PID:848

/bin/systemctl
systemctl -p Triggers show dbus.socket
2⤵
- Enumerates kernel/hardware configuration
PID:864

/bin/systemctl
systemctl -p Triggers show ssh.socket
2⤵
- Enumerates kernel/hardware configuration
PID:869

/bin/systemctl
systemctl -p Triggers show syslog.socket
2⤵
- Enumerates kernel/hardware configuration
PID:875

/bin/systemctl
systemctl -p Triggers show systemd-fsckd.socket
2⤵
- Enumerates kernel/hardware configuration
PID:877

/bin/systemctl
systemctl -p Triggers show systemd-initctl.socket
2⤵
- Enumerates kernel/hardware configuration
PID:882

/bin/systemctl
systemctl -p Triggers show systemd-journald-audit.socket
2⤵
- Enumerates kernel/hardware configuration
PID:886

/bin/systemctl
systemctl -p Triggers show systemd-journald-dev-log.socket
2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:890

/bin/systemctl
systemctl -p Triggers show systemd-journald.socket
2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:895

/bin/systemctl
systemctl -p Triggers show systemd-networkd.socket
2⤵
- Enumerates kernel/hardware configuration
PID:899

/bin/systemctl
systemctl -p Triggers show systemd-rfkill.socket
2⤵
- Enumerates kernel/hardware configuration
PID:903

/bin/systemctl
systemctl -p Triggers show systemd-udevd-control.socket
2⤵
- Enumerates kernel/hardware configuration
PID:908

/bin/systemctl
systemctl -p Triggers show systemd-udevd-kernel.socket
2⤵
- Enumerates kernel/hardware configuration
PID:911

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Enumerates kernel/hardware configuration
PID:835

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
PID:836

/usr/sbin/service
service sshd stop
1⤵
PID:837

/usr/bin/basename
basename /usr/sbin/service
2⤵
PID:842

/usr/bin/basename
basename /usr/sbin/service
2⤵
PID:846

/bin/systemctl
systemctl --quiet is-active multi-user.target
2⤵
- Enumerates kernel/hardware configuration
PID:852

/bin/systemctl
systemctl -p Triggers show dbus.socket
2⤵
- Enumerates kernel/hardware configuration
PID:868

/bin/systemctl
systemctl -p Triggers show ssh.socket
2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:873

/bin/systemctl
systemctl -p Triggers show syslog.socket
2⤵
- Enumerates kernel/hardware configuration
PID:879

/bin/systemctl
systemctl -p Triggers show systemd-fsckd.socket
2⤵
- Enumerates kernel/hardware configuration
PID:883

/bin/systemctl
systemctl -p Triggers show systemd-initctl.socket
2⤵
- Enumerates kernel/hardware configuration
PID:887

/bin/systemctl
systemctl -p Triggers show systemd-journald-audit.socket
2⤵
- Enumerates kernel/hardware configuration
PID:891

/bin/systemctl
systemctl -p Triggers show systemd-journald-dev-log.socket
2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:898

/bin/systemctl
systemctl -p Triggers show systemd-journald.socket
2⤵
- Enumerates kernel/hardware configuration
PID:902

/bin/systemctl
systemctl -p Triggers show systemd-networkd.socket
2⤵
- Enumerates kernel/hardware configuration
PID:906

/bin/systemctl
systemctl -p Triggers show systemd-rfkill.socket
2⤵
- Enumerates kernel/hardware configuration
PID:909

/bin/systemctl
systemctl -p Triggers show systemd-udevd-control.socket
2⤵
- Enumerates kernel/hardware configuration
PID:913

/bin/systemctl
systemctl -p Triggers show systemd-udevd-kernel.socket
2⤵
- Enumerates kernel/hardware configuration
PID:915

/usr/bin/killall
killall -9 telnetd
1⤵
- Reads runtime system information
PID:840

/usr/bin/killall
killall -9 utelnetd
1⤵
- Reads runtime system information
PID:844

/usr/bin/killall
killall -9 dropbear
1⤵
- Reads runtime system information
PID:847

/usr/bin/killall
killall -9 sshd
1⤵
- Reads runtime system information
PID:850

/usr/bin/killall
killall -9 lighttpd
1⤵
- Reads runtime system information
PID:853

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Enumerates kernel/hardware configuration
PID:857

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
PID:858

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Enumerates kernel/hardware configuration
PID:861

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
PID:862

/usr/local/sbin/systemctl
systemctl stop httpd.service
1⤵
PID:816

/usr/local/bin/systemctl
systemctl stop httpd.service
1⤵
PID:816

/usr/sbin/systemctl
systemctl stop httpd.service
1⤵
PID:816

/usr/bin/systemctl
systemctl stop httpd.service
1⤵
PID:816

/sbin/systemctl
systemctl stop httpd.service
1⤵
PID:816

/bin/systemctl
systemctl stop httpd.service
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:816

/usr/local/sbin/systemctl
systemctl stop telnetd.service
1⤵
PID:832

/usr/local/bin/systemctl
systemctl stop telnetd.service
1⤵
PID:832

/usr/sbin/systemctl
systemctl stop telnetd.service
1⤵
PID:832

/usr/bin/systemctl
systemctl stop telnetd.service
1⤵
PID:832

/sbin/systemctl
systemctl stop telnetd.service
1⤵
PID:832

/bin/systemctl
systemctl stop telnetd.service
1⤵
- Enumerates kernel/hardware configuration
PID:832

/usr/local/sbin/systemctl
systemctl stop sshd.service
1⤵
PID:837

/usr/local/bin/systemctl
systemctl stop sshd.service
1⤵
PID:837

/usr/sbin/systemctl
systemctl stop sshd.service
1⤵
PID:837

/usr/bin/systemctl
systemctl stop sshd.service
1⤵
PID:837

/sbin/systemctl
systemctl stop sshd.service
1⤵
PID:837

/bin/systemctl
systemctl stop sshd.service
1⤵
- Enumerates kernel/hardware configuration
PID:837

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Dynamic Resolution

1

T1568

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

/run/.x001804289383
Filesize
67B

MD5
e8bd99a54103ed1b59e754f2bf75845f

SHA1
96dab37a27a53b25b7009c31c99e0baf66cca08e

SHA256
8a7065b9dba1bd78e6b99eb7eb9b88f486dda18a12a7e1c03d85c25efb59c423

SHA512
2cf90c914a3baf9ef8e3f0db0b8c8c9e95389d6e6b7187f27b14de8c2127d19373af4818955c959bc00ebc7a78384a862c6a4d10b4fc10b5b600eaf20d0e65b7

Download Submit
memory/717-1-0x00400000-0x0045fbf4-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads