Overview

overview

10

Static

static

1

e1a799b85b...b54bc1

debian-9-armhf

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e1a799b85b84be2db2aac47157b54bc1

  • Size

    42KB

  • Sample

    240327-pjc5vsbh54

  • MD5

    e1a799b85b84be2db2aac47157b54bc1

  • SHA1

    e5a305ff039a3791bac898c837bcaca1104a981e

  • SHA256

    c261f8d5089f4040eba3dc4c35afd1d42281d18710f118ae406b7eb4110ea0f7

  • SHA512

    aa2739fc8bd3d72445036030a3837a2bb5731914114e958dae2dec3e37928cb5d6a2d604ef49d2202a5f8a812852b19a28ff6aeba1d9836a8c166f627f0f553f

  • SSDEEP

    768:QAaf+RtxGTvWPCtsjLbwn11q1H3pY+s5OwBkZ+7rhCJQOeB8JK3UEg6:ofctsTvC6m/w11q13pYdUtE/Zg6

Score
10/10
kaitenbotnetpersistence

Malware Config

Targets

    • Target

      e1a799b85b84be2db2aac47157b54bc1

    • Size

      42KB

    • MD5

      e1a799b85b84be2db2aac47157b54bc1

    • SHA1

      e5a305ff039a3791bac898c837bcaca1104a981e

    • SHA256

      c261f8d5089f4040eba3dc4c35afd1d42281d18710f118ae406b7eb4110ea0f7

    • SHA512

      aa2739fc8bd3d72445036030a3837a2bb5731914114e958dae2dec3e37928cb5d6a2d604ef49d2202a5f8a812852b19a28ff6aeba1d9836a8c166f627f0f553f

    • SSDEEP

      768:QAaf+RtxGTvWPCtsjLbwn11q1H3pY+s5OwBkZ+7rhCJQOeB8JK3UEg6:ofctsTvC6m/w11q13pYdUtE/Zg6

    Score
    10/10
    kaitenbotnetpersistence

    • Detects Kaiten/Tsunami Payload

    • Kaiten/Tsunami

      Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.

      botnetkaiten

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

      persistence

    • Enumerates running processes

      Discovers information about currently running processes on the system

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks