afb83827f6b02cc9f8af865df1872e17d9af1d8d0a19d5a414fa5d670805beb7

Analysis

max time kernel
150s
max time network
150s
platform
debian-9_mipsel
resource
debian9-mipsel-20240226-en
resource tags

arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
18/04/2024, 01:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

afb83827f6b02cc9f8af865df1872e17d9af1d8d0a19d5a414fa5d670805beb7.elf
Size

5.6MB
MD5

9e935100c7c15c560443064221733921
SHA1

8fcbd6d97792e33a094f2ccaecd320a502c8f83e
SHA256

afb83827f6b02cc9f8af865df1872e17d9af1d8d0a19d5a414fa5d670805beb7
SHA512

43b1573d802c4276cd2ac5c91b8ac74d5d8805a72d9acdf66302a8e12cf10634430848d315f9bb55850ff2c7983039dc00b1781371109987ee605f63e6045378
SSDEEP

98304:yC91hAFxvW6WGVqq7g3JDCg76dAuE8iW5ay5mIOX+aaNcc8pNkxXkz8xBs3K4HUM:yC91hAFxvW6WGVqq7g3JDCg76dAuE8i7

Score

10^/10

persistence

Malware Config

Signatures

Kaiji 1 IoCs

Kaiji payload

resource	yara_rule
behavioral1/files/fstream-1.dat	Kaiji

kaiji_chaosbot 1 IoCs

Chaos-variant payload

resource	yara_rule
behavioral1/files/fstream-1.dat	kaiji_chaosbot

Changes its process name 1 IoCs

description	ioc	pid
Changes the process name, possibly in an attempt to hide itself	ksoftirqd/0	722

Executes dropped EXE 7 IoCs

ioc	pid	Process
/etc/32678	715	32678
/etc/id.services.conf	854	id.services.conf
/etc/id.services.conf	861	id.services.conf
/etc/32678	862	32678
/etc/id.services.conf	891	id.services.conf
/etc/id.services.conf	898	id.services.conf
/etc/32678	899	32678

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

persistence

Scheduled Task/Job

T1053

description	ioc	Process
File opened for modification	/etc/crontab	bash

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 2 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	id.services.conf
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	afb83827f6b02cc9f8af865df1872e17d9af1d8d0a19d5a414fa5d670805beb7.elf
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	id.services.conf
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	afb83827f6b02cc9f8af865df1872e17d9af1d8d0a19d5a414fa5d670805beb7.elf
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	id.services.conf
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	id.services.conf
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/21/status	pkill
File opened for reading	/proc/354/cmdline	pkill
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/18/status	pkill
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/843/status	pkill
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/22/status	pkill
File opened for reading	/proc/373/status	pkill
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/8/status	pkill
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/151/cmdline	pkill
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/sys/kernel/osrelease	pkill
File opened for reading	/proc/10/status	pkill
File opened for reading	/proc/2/cmdline	pkill
File opened for reading	/proc/11/status	pkill
File opened for reading	/proc/19/status	pkill
File opened for reading	/proc/11/cmdline	pkill
File opened for reading	/proc/831/cmdline	pkill
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/21/cmdline	pkill
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/79/status	pkill
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/11/cmdline	pkill
File opened for reading	/proc/71/status	pkill
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/9/status	pkill
File opened for reading	/proc/9/cmdline	pkill
File opened for reading	/proc/674/status	pkill
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/674/status	pkill
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/14/cmdline	pkill
File opened for reading	/proc/146/status	pkill
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/555/cmdline	pkill
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/862/status	pkill
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/12/status	pkill
File opened for reading	/proc/8/cmdline	pkill
File opened for reading	/proc/14/status	pkill
File opened for reading	/proc/78/status	pkill
File opened for reading	/proc/358/status	pkill
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/71/cmdline	pkill
File opened for reading	/proc/filesystems	systemctl

/tmp/afb83827f6b02cc9f8af865df1872e17d9af1d8d0a19d5a414fa5d670805beb7.elf
/tmp/afb83827f6b02cc9f8af865df1872e17d9af1d8d0a19d5a414fa5d670805beb7.elf
1⤵
- Enumerates kernel/hardware configuration
PID:696
- /bin/sh
  sh -c "/etc/32678&"
  2⤵
  PID:708
- - /etc/32678
    /etc/32678
    3⤵
    - Executes dropped EXE
    PID:715
  - - /bin/sleep
      sleep 60
      4⤵
      PID:718
  - - /etc/id.services.conf
      /etc/id.services.conf
      4⤵
      Executes dropped EXE
      Enumerates kernel/hardware configuration
      PID:854
    - - /usr/bin/pkill
        
        pkill -9 32678
        5⤵
        Reads CPU attributes
        Reads runtime system information
        
        PID:858
    - - /bin/sh
        
        sh -c "/etc/32678&"
        5⤵
        
        PID:859
    - - /usr/sbin/service
        
        service crond start
        5⤵
        
        PID:860
      - /usr/bin/basename
        
        basename /usr/sbin/service
        6⤵
        
        PID:866
      - /usr/bin/basename
        
        basename /usr/sbin/service
        6⤵
        
        PID:868
      - /bin/systemctl
        
        systemctl --quiet is-active multi-user.target
        6⤵
        Enumerates kernel/hardware configuration
        
        PID:869
      - /bin/systemctl
        
        systemctl -p Triggers show dbus.socket
        6⤵
        
        PID:873
      - /bin/systemctl
        
        systemctl -p Triggers show ssh.socket
        6⤵
        Enumerates kernel/hardware configuration
        
        PID:874
      - /bin/systemctl
        
        systemctl -p Triggers show syslog.socket
        6⤵
        Enumerates kernel/hardware configuration
        Reads runtime system information
        
        PID:875
      - /bin/systemctl
        
        systemctl -p Triggers show systemd-fsckd.socket
        6⤵
        Enumerates kernel/hardware configuration
        
        PID:876
      - /bin/systemctl
        
        systemctl -p Triggers show systemd-initctl.socket
        6⤵
        Enumerates kernel/hardware configuration
        
        PID:877
      - /bin/systemctl
        
        systemctl -p Triggers show systemd-journald-audit.socket
        6⤵
        Enumerates kernel/hardware configuration
        
        PID:878
      - /bin/systemctl
        
        systemctl -p Triggers show systemd-journald-dev-log.socket
        6⤵
        Enumerates kernel/hardware configuration
        Reads runtime system information
        
        PID:879
      - /bin/systemctl
        
        systemctl -p Triggers show systemd-journald.socket
        6⤵
        Enumerates kernel/hardware configuration
        
        PID:880
      - /bin/systemctl
        
        systemctl -p Triggers show systemd-networkd.socket
        6⤵
        Reads runtime system information
        
        PID:881
      - /bin/systemctl
        
        systemctl -p Triggers show systemd-rfkill.socket
        6⤵
        Enumerates kernel/hardware configuration
        
        PID:882
      - /bin/systemctl
        
        systemctl -p Triggers show systemd-udevd-control.socket
        6⤵
        Enumerates kernel/hardware configuration
        Reads runtime system information
        
        PID:883
      - /bin/systemctl
        
        systemctl -p Triggers show systemd-udevd-kernel.socket
        6⤵
        Enumerates kernel/hardware configuration
        
        PID:884
    - - /etc/id.services.conf
        
        /etc/id.services.conf " "
        5⤵
        Executes dropped EXE
        Enumerates kernel/hardware configuration
        
        PID:861
- /usr/sbin/service
  service crond start
  2⤵
  PID:709
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:716
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:719
- - /bin/systemctl
    systemctl --quiet is-active multi-user.target
    3⤵
    - Enumerates kernel/hardware configuration
    PID:728
- - /bin/systemctl
    systemctl -p Triggers show dbus.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:745
- - /bin/systemctl
    systemctl -p Triggers show ssh.socket
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:746
- - /bin/systemctl
    systemctl -p Triggers show syslog.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:748
- - /bin/systemctl
    systemctl -p Triggers show systemd-fsckd.socket
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:762
- - /bin/systemctl
    systemctl -p Triggers show systemd-initctl.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:763
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-audit.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:764
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-dev-log.socket
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:766
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald.socket
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:767
- - /bin/systemctl
    systemctl -p Triggers show systemd-networkd.socket
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:768
- - /bin/systemctl
    systemctl -p Triggers show systemd-rfkill.socket
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:769
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-control.socket
    3⤵
    - Reads runtime system information
    PID:770
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-kernel.socket
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:771
- /tmp/afb83827f6b02cc9f8af865df1872e17d9af1d8d0a19d5a414fa5d670805beb7.elf
  /tmp/afb83827f6b02cc9f8af865df1872e17d9af1d8d0a19d5a414fa5d670805beb7.elf " "
  2⤵
  - Enumerates kernel/hardware configuration
  PID:711

/usr/sbin/update-rc.d
update-rc.d linux_kill defaults
1⤵
PID:726
- /usr/local/sbin/systemctl
  systemctl daemon-reload
  2⤵
  PID:747
- /usr/local/bin/systemctl
  systemctl daemon-reload
  2⤵
  PID:747
- /usr/sbin/systemctl
  systemctl daemon-reload
  2⤵
  PID:747
- /usr/bin/systemctl
  systemctl daemon-reload
  2⤵
  PID:747
- /sbin/systemctl
  systemctl daemon-reload
  2⤵
  PID:747
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:747

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
- Reads runtime system information
PID:743

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Enumerates kernel/hardware configuration
PID:742

/bin/bash
bash -c "echo \"*/1 * * * * root /.img \" >> /etc/crontab"
1⤵
- Creates/modifies Cron job
PID:765

/usr/local/sbin/systemctl
systemctl start crond.service
1⤵
PID:709

/usr/local/bin/systemctl
systemctl start crond.service
1⤵
PID:709

/usr/sbin/systemctl
systemctl start crond.service
1⤵
PID:709

/usr/bin/systemctl
systemctl start crond.service
1⤵
PID:709

/sbin/systemctl
systemctl start crond.service
1⤵
PID:709

/bin/systemctl
systemctl start crond.service
1⤵
- Enumerates kernel/hardware configuration
PID:709

/usr/bin/renice
renice -20 711
1⤵
PID:775

/bin/mount
mount -o bind /tmp/ /proc/711
1⤵
PID:776

/usr/sbin/service
service cron start
1⤵
PID:777
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:778
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:779
- /bin/systemctl
  systemctl --quiet is-active multi-user.target
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:782
- /bin/systemctl
  systemctl -p Triggers show dbus.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:788
- /bin/systemctl
  systemctl -p Triggers show ssh.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:791
- /bin/systemctl
  systemctl -p Triggers show syslog.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:792
- /bin/systemctl
  systemctl -p Triggers show systemd-fsckd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:795
- /bin/systemctl
  systemctl -p Triggers show systemd-initctl.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:796
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-audit.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:799
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-dev-log.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:800
- /bin/systemctl
  systemctl -p Triggers show systemd-journald.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:803
- /bin/systemctl
  systemctl -p Triggers show systemd-networkd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:804
- /bin/systemctl
  systemctl -p Triggers show systemd-rfkill.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:807
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-control.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:808
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-kernel.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:811

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
PID:785

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
PID:784

/usr/local/sbin/systemctl
systemctl start cron.service
1⤵
PID:777

/usr/local/bin/systemctl
systemctl start cron.service
1⤵
PID:777

/usr/sbin/systemctl
systemctl start cron.service
1⤵
PID:777

/usr/bin/systemctl
systemctl start cron.service
1⤵
PID:777

/sbin/systemctl
systemctl start cron.service
1⤵
PID:777

/bin/systemctl
systemctl start cron.service
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:777

/bin/systemctl
systemctl start crond.service
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:813

/etc/32678
/etc/32678
1⤵
- Executes dropped EXE
PID:862
- /bin/sleep
  sleep 60
  2⤵
  PID:867
- /etc/id.services.conf
  /etc/id.services.conf
  2⤵
  - Executes dropped EXE
  - Enumerates kernel/hardware configuration
  PID:891
- - /usr/bin/pkill
    pkill -9 32678
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:895
- - /bin/sh
    sh -c "/etc/32678&"
    3⤵
    PID:896
- - /usr/sbin/service
    service crond start
    3⤵
    PID:897
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:903
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:905
  - - /bin/systemctl
      systemctl --quiet is-active multi-user.target
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:906
  - - /bin/systemctl
      systemctl -p Triggers show dbus.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:910
  - - /bin/systemctl
      systemctl -p Triggers show ssh.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:911
  - - /bin/systemctl
      systemctl -p Triggers show syslog.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:912
  - - /bin/systemctl
      systemctl -p Triggers show systemd-fsckd.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:913
  - - /bin/systemctl
      systemctl -p Triggers show systemd-initctl.socket
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:914
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald-audit.socket
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:915
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald-dev-log.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:916
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:917
  - - /bin/systemctl
      systemctl -p Triggers show systemd-networkd.socket
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:918
  - - /bin/systemctl
      systemctl -p Triggers show systemd-rfkill.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:919
  - - /bin/systemctl
      systemctl -p Triggers show systemd-udevd-control.socket
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:920
  - - /bin/systemctl
      systemctl -p Triggers show systemd-udevd-kernel.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:921
- - /etc/id.services.conf
    /etc/id.services.conf " "
    3⤵
    - Executes dropped EXE
    - Enumerates kernel/hardware configuration
    PID:898

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
- Reads runtime system information
PID:872

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:871

/usr/local/sbin/systemctl
systemctl start crond.service
1⤵
PID:860

/usr/local/bin/systemctl
systemctl start crond.service
1⤵
PID:860

/usr/sbin/systemctl
systemctl start crond.service
1⤵
PID:860

/usr/bin/systemctl
systemctl start crond.service
1⤵
PID:860

/sbin/systemctl
systemctl start crond.service
1⤵
PID:860

/bin/systemctl
systemctl start crond.service
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:860

/etc/32678
/etc/32678
1⤵
- Executes dropped EXE
PID:899
- /bin/sleep
  sleep 60
  2⤵
  PID:904

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Enumerates kernel/hardware configuration
PID:908

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
PID:909

/usr/local/sbin/systemctl
systemctl start crond.service
1⤵
PID:897

/usr/local/bin/systemctl
systemctl start crond.service
1⤵
PID:897

/usr/sbin/systemctl
systemctl start crond.service
1⤵
PID:897

/usr/bin/systemctl
systemctl start crond.service
1⤵
PID:897

/sbin/systemctl
systemctl start crond.service
1⤵
PID:897

/bin/systemctl
systemctl start crond.service
1⤵
- Enumerates kernel/hardware configuration
PID:897

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/.img

Filesize
33B

MD5
d73d3376908ea075a939e3871ad0fabe

SHA1
320ff65831247ba199515f1b94df26cc8a3e5f76

SHA256
edbdabe30d8236a2c0a4eb89dfd597552130e4c1a4e93f8fe1568920442ad73a

SHA512
57b83fef88620598beb5d65626bf757d0abef242d2d6a01796a61474dedc5095a4a9d0f292b6abb450cad3d4410ab8456253600f58ddb66cfe6d79e1c8415536

Download Submit
/etc/32678

Filesize
61B

MD5
768eaf287796da19e1cf5e0b2fb1b161

SHA1
6a1ce2ee5ccc86d1f33806feb14547b35290df2a

SHA256
1d22620dfb2a6715e5d745aed5cf841ede0e75e1747f12b9b925a2d346bc7ecb

SHA512
e6af30c9df4f7f47696069511e64ecbc8e841629d692ee4056503df3533fb7a7a74960698826260355e1dba7b6c562482a27a39bb51a4237473ce4b68472d620

Download Submit
/etc/id.services.conf

Filesize
5.6MB

MD5
9e935100c7c15c560443064221733921

SHA1
8fcbd6d97792e33a094f2ccaecd320a502c8f83e

SHA256
afb83827f6b02cc9f8af865df1872e17d9af1d8d0a19d5a414fa5d670805beb7

SHA512
43b1573d802c4276cd2ac5c91b8ac74d5d8805a72d9acdf66302a8e12cf10634430848d315f9bb55850ff2c7983039dc00b1781371109987ee605f63e6045378

Download Submit
/etc/init.d/linux_kill

Filesize
189B

MD5
3909975f7cc0d1121c1819b800069f31

SHA1
3e68de708c2e6c40fab6794afdee3104e5590189

SHA256
6876dac71f13a068afb863d257134275f2edba43b2acaf4924fabf97c079070b

SHA512
50600cceeb03b05f45ae61d890caee9f51ff390b6776930866e527e071d65d08241fc66673fd9b99d62fbc77d3c00fc3de4d7378cbc42f5daba5d83072b0906e

Download Submit
/etc/profile.d/bash_config.sh

Filesize
37B

MD5
cfb4e51061485fe91169381fbdc1538e

SHA1
9a85b9b766a15b01737a41d680e4593b7a9bde87

SHA256
897f37267d0ceaa2fbdaa09847f5d08e6f8b01a0348a0d666264b0f10acd0c90

SHA512
fb154ec711d2090a7461da4db8ddad2b522649a27e74162ecb203f539b1729430288bc02d78d2071bde9c4bbc005693403a57612ef50277d52f816cb94524216

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads