Overview

overview

10

Static

static

1

3f0ba0848d...kes118

debian-9-mipsel

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3f0ba0848dbceb9c6ffef89bfa4e4a1c_JaffaCakes118

  • Size

    32KB

  • Sample

    240729-lwrl8s1hqn

  • MD5

    3f0ba0848dbceb9c6ffef89bfa4e4a1c

  • SHA1

    30081402cd8d2d8253a531fca5a76374a4c7445f

  • SHA256

    e4385a86e5b0f299fee2110bec4f8add82a7f106d869ff5024044c98048cefd5

  • SHA512

    bacce18da136050e66fbc7b3e9f8bdc4428589f6a2aba882c817d240f1be3ff67de36f809a14930b4c8d00f156bd6bad7cad64f231c2ece9e75628435fd0fc22

  • SSDEEP

    768:qH5ckn7T8bQcetXy7+vNRfai4TBW3vso6RrhtompWb:qTnX8mo+vNRCXT430tHtFu

Score
10/10
kaitenbotnetpersistence

Malware Config

Targets

    • Target

      3f0ba0848dbceb9c6ffef89bfa4e4a1c_JaffaCakes118

    • Size

      32KB

    • MD5

      3f0ba0848dbceb9c6ffef89bfa4e4a1c

    • SHA1

      30081402cd8d2d8253a531fca5a76374a4c7445f

    • SHA256

      e4385a86e5b0f299fee2110bec4f8add82a7f106d869ff5024044c98048cefd5

    • SHA512

      bacce18da136050e66fbc7b3e9f8bdc4428589f6a2aba882c817d240f1be3ff67de36f809a14930b4c8d00f156bd6bad7cad64f231c2ece9e75628435fd0fc22

    • SSDEEP

      768:qH5ckn7T8bQcetXy7+vNRfai4TBW3vso6RrhtompWb:qTnX8mo+vNRCXT430tHtFu

    Score
    10/10
    kaitenbotnetpersistence

    • Detects Kaiten/Tsunami Payload

    • Kaiten/Tsunami

      Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.

      botnetkaiten

    • Writes DNS configuration

      Writes data to DNS resolver config file.

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

      persistence

    • Enumerates running processes

      Discovers information about currently running processes on the system

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks