Overview

overview

10

Static

static

1

bot

ubuntu-18.04-amd64

1

bot

debian-9-armhf

1

bot

debian-9-mips

1

bot

debian-9-mipsel

1

go

ubuntu-18.04-amd64

10

go

debian-9-armhf

10

go

debian-9-mips

10

go

debian-9-mipsel

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    OR4B396XQLONQ2IF82GFI6DRV0REMCS4WL31D1F1YHSZZ1D5A5

  • Size

    24KB

  • Sample

    240828-yybp1svhmm

  • MD5

    3b64c2ecd7ea152f9d4af9d0461db265

  • SHA1

    29f839c71c24a1af7d34ced8c21a57bd98b80ac5

  • SHA256

    975a79e3549d8c0b8f102888d4c407535404a18b17086c6ae580850a8aa32ff1

  • SHA512

    f1447396d8ecbe9c6f984b20cb26c33600176686b9c160858ad0748495e7e0b96ee87b6eb5468e2f660156e7f68e64b8e87155ef376d5c79c6c25f6c2e4191d5

  • SSDEEP

    768:VVlrin9agscJSJe6IynHU5uKkWc4p7TzgYYHi/:t09aQJSsuHUMKS8Oi/

Score
10/10
kaitenbotnetlinuxpersistence

Malware Config

Targets

    • Target

      bot

    • Size

      17KB

    • MD5

      1d4c9039ca7e0b3e93c708f5d02f92a0

    • SHA1

      6725399cf12cd25458f23b941b297d8d0b0ed8b0

    • SHA256

      a675fb9cefb4e1d72a83da99ef6fcc56e83a53f9494bc56316824b8ba4316f90

    • SHA512

      22f67e4abc727055efa23a90c1101bff951384564f98750c5c31d83ecab1bb2216e68530257a2172de7b9566bc38bb1463da7203275b880f720b08b573907c2a

    • SSDEEP

      384:TgsxbX1HTCruTkwRfPdyd0tt8H0f5bUD1G4f:csx71HTJTkwHuPXf

    Score
    1/10
    behavioral1behavioral2behavioral3behavioral4

    • Target

      go

    • Size

      3KB

    • MD5

      fd55f0754084ba041539bb469f06a83d

    • SHA1

      af7beef3297d77bdf1299a4fbf6cc50e27113aa4

    • SHA256

      9bde6ebc01e00f36cb71b979f602f61a0f78e201ad9073ae557d764578789023

    • SHA512

      cee0d136026accde83034f0b135dac8bdc2eec1a395a518f4b15c813062d75d49432b6d0ba996448107c1735382e84c31aeec372e9e1a9f830f1be848f7a8248

    Score
    10/10
    kaitenbotnetpersistence

    • Detects Kaiten/Tsunami Payload

    • Detects Kaiten/Tsunami payload

    • Kaiten/Tsunami

      Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.

      botnetkaiten

    • Adds new SSH keys

      Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.

      persistence

    • Modifies password files for system users/ groups

      Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.

    • Write file to user bin folder

    • Writes file to system bin folder

    behavioral5behavioral6behavioral7behavioral8

MITRE ATT&CK Enterprise v15

Tasks