kaiten | 3b2045efa4d24677089ffe5c74bfd774d6e9e4c0d31fe1e96ddd978348213881

Analysis

max time kernel
43s
max time network
23s
platform
debian-9_mipsel
resource
debian9-mipsel-20231215-en
resource tags

arch:mipselimage:debian9-mipsel-20231215-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
06-02-2024 22:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

959850cdd738ca33d4731d275e4237f2
Size

33KB
MD5

959850cdd738ca33d4731d275e4237f2
SHA1

4994e10487a0cb771bfd51fdd0387d2924ba5854
SHA256

3b2045efa4d24677089ffe5c74bfd774d6e9e4c0d31fe1e96ddd978348213881
SHA512

24ad5e6d15314c4d10603d445b06619e112c7ca836d74e21f4211cf97b5175566ffbca6984efe043c173842a9659242c1fb245d50923c9fb4405d9cc981f80b0
SSDEEP

768:/dQM727s0rdd9vM2aivyoFVWrifbpRhOrj2/KWn:/dQ227Nd7vMMlfbpfOrE

Score

10^/10

kaiten botnet persistence

Malware Config

Signatures

Detects Kaiten/Tsunami Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/698-1-0x00400000-0x100015bc-memory.dmp	family_kaiten2

Kaiten/Tsunami
Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.
botnet kaiten
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
persistence

Scheduled Task/Job
T1053

Processes:

crontab

description ioc process

File opened for modification /var/spool/cron/crontabs/tmp.IVATlQ crontab
Enumerates running processes
Discovers information about currently running processes on the system

description	ioc	process
File opened for modification	/var/spool/cron/crontabs/tmp.IVATlQ	crontab

Enumerates kernel/hardware configuration 1 TTPs 45 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

Processes:

systemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctl

description	ioc	process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

killallkillallkillallkillallkillallkillallkillallkillallsystemctlkillallkillallkillallsystemctlkillallkillallkillallsystemctlkillallkillallkillallsystemctlcrontabsystemctlsystemctl

description	ioc	process
File opened for reading	/proc/868/stat	killall
File opened for reading	/proc/18/stat	killall
File opened for reading	/proc/317/stat	killall
File opened for reading	/proc/708/stat	killall
File opened for reading	/proc/378/stat	killall
File opened for reading	/proc/70/stat	killall
File opened for reading	/proc/687/stat	killall
File opened for reading	/proc/116/stat	killall
File opened for reading	/proc/16/stat	killall
File opened for reading	/proc/681/cmdline	killall
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/11/stat	killall
File opened for reading	/proc/685/stat	killall
File opened for reading	/proc/79/stat	killall
File opened for reading	/proc/708/stat	killall
File opened for reading	/proc/17/stat	killall
File opened for reading	/proc/758/stat	killall
File opened for reading	/proc/18/stat	killall
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/682/stat	killall
File opened for reading	/proc/687/stat	killall
File opened for reading	/proc/116/cmdline	killall
File opened for reading	/proc/323/stat	killall
File opened for reading	/proc/2/stat	killall
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/77/stat	killall
File opened for reading	/proc/106/stat	killall
File opened for reading	/proc/317/stat	killall
File opened for reading	/proc/742/stat	killall
File opened for reading	/proc/388/stat	killall
File opened for reading	/proc/759/stat	killall
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/19/stat	killall
File opened for reading	/proc/854/stat	killall
File opened for reading	/proc/17/stat	killall
File opened for reading	/proc/168/stat	killall
File opened for reading	/proc/15/stat	killall
File opened for reading	/proc/116/cmdline	killall
File opened for reading	/proc/84/stat	killall
File opened for reading	/proc/71/stat	killall
File opened for reading	/proc/80/stat	killall
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/13/stat	killall
File opened for reading	/proc/708/stat	killall
File opened for reading	/proc/11/stat	killall
File opened for reading	/proc/12/stat	killall
File opened for reading	/proc/377/stat	killall
File opened for reading	/proc/323/stat	killall
File opened for reading	/proc/682/stat	killall
File opened for reading	/proc/14/stat	killall
File opened for reading	/proc/681/stat	killall
File opened for reading	/proc/639/stat	killall
File opened for reading	/proc/852/stat	killall
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/758/stat	killall
File opened for reading	/proc/115/stat	killall
File opened for reading	/proc/688/stat	killall
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/230/stat	killall
File opened for reading	/proc/388/stat	killall
File opened for reading	/proc/820/stat	killall
File opened for reading	/proc/cmdline	systemctl

/tmp/959850cdd738ca33d4731d275e4237f2
/tmp/959850cdd738ca33d4731d275e4237f2
1⤵
PID:698
- /bin/sh
  sh -c "rm -rf /var/run/wgsh > /dev/null 2>&1 &"
  2⤵
  PID:700
- /bin/sh
  sh -c "rm -rf /var/run/bbsh > /dev/null 2>&1 &"
  2⤵
  PID:703
- /bin/sh
  sh -c "rm -rf /var/run/tty1 > /dev/null 2>&1 &"
  2⤵
  PID:706
- /bin/sh
  sh -c "rm -rf /var/run/tty2 > /dev/null 2>&1 &"
  2⤵
  PID:712
- /bin/sh
  sh -c "rm -rf /var/run/tty3 > /dev/null 2>&1 &"
  2⤵
  PID:715
- /bin/sh
  sh -c "rm -rf /var/run/tty4 > /dev/null 2>&1 &"
  2⤵
  PID:718
- /bin/sh
  sh -c "rm -rf /var/run/tty5 > /dev/null 2>&1 &"
  2⤵
  PID:720
- /bin/sh
  sh -c "rm -rf /var/run/tty6 > /dev/null 2>&1 &"
  2⤵
  PID:723
- /bin/sh
  sh -c "rm -rf /tmp/tty1 > /dev/null 2>&1 &"
  2⤵
  PID:725
- /bin/sh
  sh -c "rm -rf /tmp/tty2 > /dev/null 2>&1 &"
  2⤵
  PID:727
- /bin/sh
  sh -c "rm -rf /tmp/tty3 > /dev/null 2>&1 &"
  2⤵
  PID:729
- /bin/sh
  sh -c "rm -rf /tmp/tty4 > /dev/null 2>&1 &"
  2⤵
  PID:731
- /bin/sh
  sh -c "rm -rf /tmp/tty5 > /dev/null 2>&1 &"
  2⤵
  PID:734
- /bin/sh
  sh -c "rm -rf /tmp/tty6 > /dev/null 2>&1 &"
  2⤵
  PID:736
- /bin/sh
  sh -c "rm -rf /var/run/pty > /dev/null 2>&1 &"
  2⤵
  PID:739
- /bin/sh
  sh -c "killall -9 arm > /dev/null 2>&1 &"
  2⤵
  PID:741
- /bin/sh
  sh -c "killall -9 mips > /dev/null 2>&1 &"
  2⤵
  PID:743
- /bin/sh
  sh -c "killall -9 mipsel > /dev/null 2>&1 &"
  2⤵
  PID:745
- /bin/sh
  sh -c "killall -9 powerpc > /dev/null 2>&1 &"
  2⤵
  PID:747
- /bin/sh
  sh -c "killall -9 ppc > /dev/null 2>&1 &"
  2⤵
  PID:750
- /bin/sh
  sh -c "killall -9 daemon.armv4l.mod > /dev/null 2>&1 &"
  2⤵
  PID:752
- /bin/sh
  sh -c "killall -9 daemon.i686.mod > /dev/null 2>&1 &"
  2⤵
  PID:755
- /bin/sh
  sh -c "killall -9 daemon.mips.mod > /dev/null 2>&1 &"
  2⤵
  PID:757
- /bin/sh
  sh -c "killall -9 daemon.mipsel.mod > /dev/null 2>&1 &"
  2⤵
  PID:760
- /bin/sh
  sh -c "kill -9 `cat /tmp/.xs/*.pid` > /dev/null 2>&1 &"
  2⤵
  PID:762
- /bin/sh
  sh -c "rm -rf /tmp/.xs/* > /dev/null 2>&1 &"
  2⤵
  PID:764
- /bin/sh
  sh -c "touch -acmr /bin/ls /tmp/959850cdd738ca33d4731d275e4237f2"
  2⤵
  PID:767
- - /usr/bin/touch
    touch -acmr /bin/ls /tmp/959850cdd738ca33d4731d275e4237f2
    3⤵
    PID:768
- /bin/sh
  sh -c "(crontab -l | grep -v \"/tmp/959850cdd738ca33d4731d275e4237f2\" | grep -v \"no cron\" | grep -v \"lesshts/run.sh\" > /var/run/.x001804289383) > /dev/null 2>&1"
  2⤵
  PID:769
- /bin/sh
  sh -c "echo \"* * * * * /tmp/959850cdd738ca33d4731d275e4237f2 > /dev/null 2>&1 &\" >> /var/run/.x001804289383"
  2⤵
  PID:776
- /bin/sh
  sh -c "crontab /var/run/.x001804289383"
  2⤵
  PID:777
- - /usr/bin/crontab
    crontab /var/run/.x001804289383
    3⤵
    - Creates/modifies Cron job
    PID:778
- /bin/sh
  sh -c "rm -rf /var/run/.x001804289383"
  2⤵
  PID:780
- - /bin/rm
    rm -rf /var/run/.x001804289383
    3⤵
    PID:781
- /bin/sh
  sh -c "/bin/uname -n"
  2⤵
  PID:782
- - /bin/uname
    /bin/uname -n
    3⤵
    PID:783
- /bin/sh
  sh -c "/bin/uname -n"
  2⤵
  PID:784
- - /bin/uname
    /bin/uname -n
    3⤵
    PID:785
- /bin/sh
  sh -c "kill -9 `cat /var/run/httpd.pid` > /dev/null 2>&1 &"
  2⤵
  PID:831
- /bin/sh
  sh -c "service httpd stop > /dev/null 2>&1 &"
  2⤵
  PID:833
- /bin/sh
  sh -c "killall -9 mini_httpd > /dev/null 2>&1 &"
  2⤵
  PID:836
- /bin/sh
  sh -c "killall -9 minihttpd > /dev/null 2>&1 &"
  2⤵
  PID:838
- /bin/sh
  sh -c "kill -9 `cat /var/run/thttpd.pid` > /dev/null 2>&1 &"
  2⤵
  PID:841
- /bin/sh
  sh -c "nvram set httpd_enable=0 > /dev/null 2>&1"
  2⤵
  PID:844
- /bin/sh
  sh -c "nvram set http_enable=0 > /dev/null 2>&1"
  2⤵
  PID:847
- /bin/sh
  sh -c "killall -9 httpd > /dev/null 2>&1 &"
  2⤵
  PID:848
- /bin/sh
  sh -c "service telnetd stop > /dev/null 2>&1 &"
  2⤵
  PID:850
- /bin/sh
  sh -c "service sshd stop > /dev/null 2>&1 &"
  2⤵
  PID:853
- /bin/sh
  sh -c "killall -9 telnetd > /dev/null 2>&1 &"
  2⤵
  PID:857
- /bin/sh
  sh -c "killall -9 utelnetd > /dev/null 2>&1 &"
  2⤵
  PID:860
- /bin/sh
  sh -c "killall -9 dropbear > /dev/null 2>&1 &"
  2⤵
  PID:864
- /bin/sh
  sh -c "killall -9 sshd > /dev/null 2>&1 &"
  2⤵
  PID:868
- /bin/sh
  sh -c "killall -9 lighttpd > /dev/null 2>&1 &"
  2⤵
  PID:870

/bin/rm
rm -rf /var/run/wgsh
1⤵
PID:702

/bin/rm
rm -rf /var/run/bbsh
1⤵
PID:705

/bin/rm
rm -rf /var/run/tty1
1⤵
PID:710

/bin/rm
rm -rf /var/run/tty2
1⤵
PID:714

/bin/rm
rm -rf /var/run/tty3
1⤵
PID:717

/bin/rm
rm -rf /var/run/tty4
1⤵
PID:719

/bin/rm
rm -rf /var/run/tty5
1⤵
PID:722

/bin/rm
rm -rf /var/run/tty6
1⤵
PID:724

/bin/rm
rm -rf /tmp/tty1
1⤵
PID:726

/bin/rm
rm -rf /tmp/tty2
1⤵
PID:728

/bin/rm
rm -rf /tmp/tty3
1⤵
PID:730

/bin/rm
rm -rf /tmp/tty4
1⤵
PID:733

/bin/rm
rm -rf /tmp/tty5
1⤵
PID:735

/bin/rm
rm -rf /tmp/tty6
1⤵
PID:738

/bin/rm
rm -rf /var/run/pty
1⤵
PID:740

/usr/bin/killall
killall -9 arm
1⤵
- Reads runtime system information
PID:742

/usr/bin/killall
killall -9 mips
1⤵
- Reads runtime system information
PID:744

/usr/bin/killall
killall -9 mipsel
1⤵
- Reads runtime system information
PID:746

/usr/bin/killall
killall -9 powerpc
1⤵
- Reads runtime system information
PID:749

/usr/bin/killall
killall -9 ppc
1⤵
- Reads runtime system information
PID:751

/usr/bin/killall
killall -9 daemon.armv4l.mod
1⤵
- Reads runtime system information
PID:754

/usr/bin/killall
killall -9 daemon.i686.mod
1⤵
- Reads runtime system information
PID:756

/usr/bin/killall
killall -9 daemon.mips.mod
1⤵
- Reads runtime system information
PID:759

/usr/bin/killall
killall -9 daemon.mipsel.mod
1⤵
- Reads runtime system information
PID:761

/bin/cat
cat "/tmp/.xs/*.pid"
1⤵
PID:765

/bin/rm
rm -rf "/tmp/.xs/*"
1⤵
PID:766

/usr/bin/crontab
crontab -l
1⤵
- Reads runtime system information
PID:772

/bin/grep
grep -v /tmp/959850cdd738ca33d4731d275e4237f2
1⤵
PID:773

/bin/grep
grep -v "no cron"
1⤵
PID:774

/bin/grep
grep -v lesshts/run.sh
1⤵
PID:775

/bin/cat
cat /var/run/httpd.pid
1⤵
PID:834

/usr/sbin/service
service httpd stop
1⤵
PID:835
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:839
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:842
- /bin/systemctl
  systemctl --quiet is-active multi-user.target
  2⤵
  - Enumerates kernel/hardware configuration
  PID:846
- /bin/systemctl
  systemctl -p Triggers show dbus.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:873
- /bin/systemctl
  systemctl -p Triggers show ssh.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:882
- /bin/systemctl
  systemctl -p Triggers show syslog.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:892
- /bin/systemctl
  systemctl -p Triggers show systemd-fsckd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:895
- /bin/systemctl
  systemctl -p Triggers show systemd-initctl.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:898
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-audit.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:901
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-dev-log.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:904
- /bin/systemctl
  systemctl -p Triggers show systemd-journald.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:907
- /bin/systemctl
  systemctl -p Triggers show systemd-networkd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:910
- /bin/systemctl
  systemctl -p Triggers show systemd-rfkill.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:913
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-control.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:916
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-kernel.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:920

/usr/bin/killall
killall -9 mini_httpd
1⤵
- Reads runtime system information
PID:837

/usr/bin/killall
killall -9 minihttpd
1⤵
- Reads runtime system information
PID:840

/bin/cat
cat /var/run/thttpd.pid
1⤵
PID:845

/usr/bin/killall
killall -9 httpd
1⤵
- Reads runtime system information
PID:849

/usr/sbin/service
service telnetd stop
1⤵
PID:851
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:858
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:862
- /bin/systemctl
  systemctl --quiet is-active multi-user.target
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:867
- /bin/systemctl
  systemctl -p Triggers show dbus.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:886
- /bin/systemctl
  systemctl -p Triggers show ssh.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:891
- /bin/systemctl
  systemctl -p Triggers show syslog.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:894
- /bin/systemctl
  systemctl -p Triggers show systemd-fsckd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:896
- /bin/systemctl
  systemctl -p Triggers show systemd-initctl.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:900
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-audit.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:903
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-dev-log.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:906
- /bin/systemctl
  systemctl -p Triggers show systemd-journald.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:909
- /bin/systemctl
  systemctl -p Triggers show systemd-networkd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:912
- /bin/systemctl
  systemctl -p Triggers show systemd-rfkill.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:915
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-control.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:918
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-kernel.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:921

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Enumerates kernel/hardware configuration
PID:854

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
PID:855

/usr/sbin/service
service sshd stop
1⤵
PID:856
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:861
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:865
- /bin/systemctl
  systemctl --quiet is-active multi-user.target
  2⤵
  - Enumerates kernel/hardware configuration
  PID:871
- /bin/systemctl
  systemctl -p Triggers show dbus.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:890
- /bin/systemctl
  systemctl -p Triggers show ssh.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:893
- /bin/systemctl
  systemctl -p Triggers show syslog.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:897
- /bin/systemctl
  systemctl -p Triggers show systemd-fsckd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:899
- /bin/systemctl
  systemctl -p Triggers show systemd-initctl.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:902
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-audit.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:905
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-dev-log.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:908
- /bin/systemctl
  systemctl -p Triggers show systemd-journald.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:911
- /bin/systemctl
  systemctl -p Triggers show systemd-networkd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:914
- /bin/systemctl
  systemctl -p Triggers show systemd-rfkill.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:917
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-control.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:919
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-kernel.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:923

/usr/bin/killall
killall -9 telnetd
1⤵
- Reads runtime system information
PID:859

/usr/bin/killall
killall -9 utelnetd
1⤵
- Reads runtime system information
PID:863

/usr/bin/killall
killall -9 dropbear
1⤵
- Reads runtime system information
PID:866

/usr/bin/killall
killall -9 sshd
1⤵
- Reads runtime system information
PID:869

/usr/bin/killall
killall -9 lighttpd
1⤵
- Reads runtime system information
PID:872

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:877

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
PID:878

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Enumerates kernel/hardware configuration
PID:880

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
PID:881

/usr/local/sbin/systemctl
systemctl stop telnetd.service
1⤵
PID:851

/usr/local/bin/systemctl
systemctl stop telnetd.service
1⤵
PID:851

/usr/sbin/systemctl
systemctl stop telnetd.service
1⤵
PID:851

/usr/bin/systemctl
systemctl stop telnetd.service
1⤵
PID:851

/sbin/systemctl
systemctl stop telnetd.service
1⤵
PID:851

/bin/systemctl
systemctl stop telnetd.service
1⤵
- Enumerates kernel/hardware configuration
PID:851

/usr/local/sbin/systemctl
systemctl stop httpd.service
1⤵
PID:835

/usr/local/bin/systemctl
systemctl stop httpd.service
1⤵
PID:835

/usr/sbin/systemctl
systemctl stop httpd.service
1⤵
PID:835

/usr/bin/systemctl
systemctl stop httpd.service
1⤵
PID:835

/sbin/systemctl
systemctl stop httpd.service
1⤵
PID:835

/bin/systemctl
systemctl stop httpd.service
1⤵
- Enumerates kernel/hardware configuration
PID:835

/usr/local/sbin/systemctl
systemctl stop sshd.service
1⤵
PID:856

/usr/local/bin/systemctl
systemctl stop sshd.service
1⤵
PID:856

/usr/sbin/systemctl
systemctl stop sshd.service
1⤵
PID:856

/usr/bin/systemctl
systemctl stop sshd.service
1⤵
PID:856

/sbin/systemctl
systemctl stop sshd.service
1⤵
PID:856

/bin/systemctl
systemctl stop sshd.service
1⤵
- Enumerates kernel/hardware configuration
PID:856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/run/.x001804289383

Filesize
67B

MD5
c373a905ee99a642e4dbc3e5dd949905

SHA1
e16fd82f66a75bd4cfeb893c94f87285a82af0a4

SHA256
854ea99713fcdbd5ab60ca167dc3653a6bfb1709195ea562fb3e555487128979

SHA512
bbd8ddc447f20d598be90947bcd6d6f2ae3e8667a47db55a780e93302142f65c089d8db3d04b55d843864a75a8730eda001b66e6ea91a91ae2359569a9b9f21a

Download Submit
/var/spool/cron/crontabs/tmp.IVATlQ

Filesize
264B

MD5
20f59d74d7851007482922be6c0e2dc4

SHA1
39c20318a543b5a415dcad2369d0fa6c0278cded

SHA256
21ea8e8e22445127784b95a7ed9d73c67468bc92725209cf456518e60566edf3

SHA512
9274efca9597461d536e4b5afd3889dcc45863f066bbb279b79b3205599cba8d1d7652b6336c87a0b0d1060645091ab0c77390917655348f008af919bf710eb2

Download Submit
memory/698-1-0x00400000-0x100015bc-memory.dmp

Download