Overview

overview

10

Static

static

1

3d1dda1265...kes118

debian-12-mipsel

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3d1dda1265835215bec662a920d4ee01_JaffaCakes118

  • Size

    31KB

  • Sample

    240729-j6t41azcnj

  • MD5

    3d1dda1265835215bec662a920d4ee01

  • SHA1

    3f515381462cb4e15f2205bab4b6d8b93430dbd5

  • SHA256

    57f70cf211661f7c521f33899de93b9be81fa467a034f0f35620b1d40e2817a5

  • SHA512

    f8cf3a861f55a1ce2c45109ce5afb1c8ef3c7f37d0de8623e3a698bec8c7bad8bf05d80a06bca39a710de43aecd0ea913e07f6a2d44160db53bd2a6907110ed4

  • SSDEEP

    768:8SKbKLrV2Nrjb6y/uN0pVx2prhPDjWCo/nQTZXTWb:UGLrVUbPXp2fjs/QTC

Score
10/10
kaitenbotnetpersistence

Malware Config

Targets

    • Target

      3d1dda1265835215bec662a920d4ee01_JaffaCakes118

    • Size

      31KB

    • MD5

      3d1dda1265835215bec662a920d4ee01

    • SHA1

      3f515381462cb4e15f2205bab4b6d8b93430dbd5

    • SHA256

      57f70cf211661f7c521f33899de93b9be81fa467a034f0f35620b1d40e2817a5

    • SHA512

      f8cf3a861f55a1ce2c45109ce5afb1c8ef3c7f37d0de8623e3a698bec8c7bad8bf05d80a06bca39a710de43aecd0ea913e07f6a2d44160db53bd2a6907110ed4

    • SSDEEP

      768:8SKbKLrV2Nrjb6y/uN0pVx2prhPDjWCo/nQTZXTWb:UGLrVUbPXp2fjs/QTC

    Score
    10/10
    kaitenbotnetpersistence

    • Detects Kaiten/Tsunami Payload

    • Kaiten/Tsunami

      Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.

      botnetkaiten

    • Writes DNS configuration

      Writes data to DNS resolver config file.

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

      persistence

    • Enumerates running processes

      Discovers information about currently running processes on the system

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks