Overview

overview

10

Static

static

1

432da22627...kes118

debian-9-mips

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    432da226279b1d29bf077cbb689777eb_JaffaCakes118

  • Size

    662KB

  • Sample

    240729-nek48szgpa

  • MD5

    432da226279b1d29bf077cbb689777eb

  • SHA1

    976391ad6b740eda1ffb70d33c28a60c4baeb74b

  • SHA256

    6a3d6e28dbed506a14110577cb4bcb68efc1d2b0e13c9217f9c972fbcc6e0b3f

  • SHA512

    7bd971667ae15861a3bbaa20e4c41611cd7f1a623f2485961da31f6edb9772bf247b8fe0e94d93dc5c1fbf30ec48fac69155a04d3e9684954d16ec9979394bc5

  • SSDEEP

    12288:cdUMRT8U2E7hFNPuN0oR9DfCDkAnEzDLjsC4jvtwDFiKCdgOEFwUCdV:ceMRT8RINa/PzDLmYFiRgTwb

Score
10/10
kaitenbotnetpersistence

Malware Config

Targets

    • Target

      432da226279b1d29bf077cbb689777eb_JaffaCakes118

    • Size

      662KB

    • MD5

      432da226279b1d29bf077cbb689777eb

    • SHA1

      976391ad6b740eda1ffb70d33c28a60c4baeb74b

    • SHA256

      6a3d6e28dbed506a14110577cb4bcb68efc1d2b0e13c9217f9c972fbcc6e0b3f

    • SHA512

      7bd971667ae15861a3bbaa20e4c41611cd7f1a623f2485961da31f6edb9772bf247b8fe0e94d93dc5c1fbf30ec48fac69155a04d3e9684954d16ec9979394bc5

    • SSDEEP

      12288:cdUMRT8U2E7hFNPuN0oR9DfCDkAnEzDLjsC4jvtwDFiKCdgOEFwUCdV:ceMRT8RINa/PzDLmYFiRgTwb

    Score
    10/10
    kaitenbotnetpersistence

    • Detects Kaiten/Tsunami Payload

    • Kaiten/Tsunami

      Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.

      botnetkaiten

    • Writes DNS configuration

      Writes data to DNS resolver config file.

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

      persistence
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks