Overview

overview

10

Static

static

1

97c58795cc...48e1a2

debian-9-mipsel

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    97c58795cc03edfed788af94d848e1a2

  • Size

    38KB

  • Sample

    231222-qbx1qsdfdr

  • MD5

    97c58795cc03edfed788af94d848e1a2

  • SHA1

    55a86ceac7cd6aa61d39b00205d97498242d21d5

  • SHA256

    cf7f09319e46bf38232f1887e0d9aab18170ece148141f538a94b871fa25aa7c

  • SHA512

    1ab1ca965803cf1587f77f671da8fe02024680e52f73ae16c63ed8bdaef04932ebbffdeb816b390efbf1d150de25827b3f57e2b3ed42f357724f0d5c7d2cbb0e

  • SSDEEP

    768:BaQPk7tOmLWoFOJADhA6gLdQAvi+EKuvG+urhWPdSOAf2zjQDq:uV3FOmFCQ3ZKuW6SgzjQO

Score
10/10
kaitenbotnetpersistence

Malware Config

Targets

    • Target

      97c58795cc03edfed788af94d848e1a2

    • Size

      38KB

    • MD5

      97c58795cc03edfed788af94d848e1a2

    • SHA1

      55a86ceac7cd6aa61d39b00205d97498242d21d5

    • SHA256

      cf7f09319e46bf38232f1887e0d9aab18170ece148141f538a94b871fa25aa7c

    • SHA512

      1ab1ca965803cf1587f77f671da8fe02024680e52f73ae16c63ed8bdaef04932ebbffdeb816b390efbf1d150de25827b3f57e2b3ed42f357724f0d5c7d2cbb0e

    • SSDEEP

      768:BaQPk7tOmLWoFOJADhA6gLdQAvi+EKuvG+urhWPdSOAf2zjQDq:uV3FOmFCQ3ZKuW6SgzjQO

    Score
    10/10
    kaitenbotnetpersistence

    • Detects Kaiten/Tsunami Payload

    • Kaiten/Tsunami

      Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.

      botnetkaiten

    • Writes DNS configuration

      Writes data to DNS resolver config file.

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

      persistence

    • Enumerates running processes

      Discovers information about currently running processes on the system

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks