Analysis

  • max time kernel
    19s
  • max time network
    7s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20240418-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    22-10-2024 07:45

General

  • Target

    irq1

  • Size

    510KB

  • MD5

    2aa1abc12fdf779dbe4e71ed20111bce

  • SHA1

    fee772fa1e9c94d9b89ffa3fa89df08c4a1fe84f

  • SHA256

    a1f211877e5ac29682f07d0b97d02ee936ed02f3355b68d7163b3336164d85f6

  • SHA512

    e9b95f9c28e39fa3c57f921ac2e55f5ee1b22d3664b8059f53610b059e620230ff63db7d39a5a9c256f39aa99d1b1333f4bd0acefe44bd826048c60b4e5c6fc0

  • SSDEEP

    6144:21cNQ3N/6H7bvnWGSTOk/Gsw6apMBNedo+nS2Ref6zIfcxnjL/Va+wjdIBKPO7QZ:2CQd/SVV2PsfssIfyn/U+sm7Q380/

Malware Config

Signatures

  • Detects Kaiten/Tsunami Payload 1 IoCs
  • Kaiten/Tsunami

    Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.

  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Indicator Removal: Timestomp 1 TTPs 4 IoCs

    Adversaries may remove indicators of compromise from the host to evade detection.

  • Enumerates kernel/hardware configuration 1 TTPs 21 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/irq1
    /tmp/irq1
    1⤵
      PID:739
      • /bin/sh
        sh -c "touch -acmr /bin/ls /tmp/irq1"
        2⤵
        • Indicator Removal: Timestomp
        PID:742
        • /usr/bin/touch
          touch -acmr /bin/ls /tmp/irq1
          3⤵
          • Indicator Removal: Timestomp
          PID:747
      • /bin/sh
        sh -c "(crontab -l | grep -v \"/tmp/irq1\" | grep -v \"no cron\" | grep -v \"lesshts/run.sh\" > /var/run/.x00740882966) > /dev/null 2>&1"
        2⤵
          PID:749
          • /bin/grep
            grep -v /tmp/irq1
            3⤵
              PID:752
            • /usr/bin/crontab
              crontab -l
              3⤵
                PID:751
              • /bin/grep
                grep -v "no cron"
                3⤵
                  PID:753
                • /bin/grep
                  grep -v lesshts/run.sh
                  3⤵
                    PID:754
                • /bin/sh
                  sh -c "echo \"* * * * * /tmp/irq1 > /dev/null 2>&1 &\" >> /var/run/.x00740882966"
                  2⤵
                    PID:757
                  • /bin/sh
                    sh -c "crontab /var/run/.x00740882966"
                    2⤵
                      PID:759
                      • /usr/bin/crontab
                        crontab /var/run/.x00740882966
                        3⤵
                        • Creates/modifies Cron job
                        PID:761
                    • /bin/sh
                      sh -c "rm -rf /var/run/.x00740882966"
                      2⤵
                        PID:765
                        • /bin/rm
                          rm -rf /var/run/.x00740882966
                          3⤵
                            PID:767
                        • /bin/sh
                          sh -c "cat /etc/inittab | grep -v \"/tmp/irq1\" > /etc/inittab2"
                          2⤵
                            PID:769
                            • /bin/cat
                              cat /etc/inittab
                              3⤵
                                PID:770
                              • /bin/grep
                                grep -v /tmp/irq1
                                3⤵
                                  PID:771
                              • /bin/sh
                                sh -c "echo \"0:2345:respawn:/tmp/irq1\" >> /etc/inittab2"
                                2⤵
                                  PID:774
                                • /bin/sh
                                  sh -c "cat /etc/inittab2 > /etc/inittab"
                                  2⤵
                                    PID:776
                                    • /bin/cat
                                      cat /etc/inittab2
                                      3⤵
                                        PID:777
                                    • /bin/sh
                                      sh -c "rm -rf /etc/inittab2"
                                      2⤵
                                        PID:778
                                        • /bin/rm
                                          rm -rf /etc/inittab2
                                          3⤵
                                            PID:779
                                        • /bin/sh
                                          sh -c "touch -acmr /bin/ls /etc/inittab"
                                          2⤵
                                          • Indicator Removal: Timestomp
                                          PID:780
                                          • /usr/bin/touch
                                            touch -acmr /bin/ls /etc/inittab
                                            3⤵
                                            • Indicator Removal: Timestomp
                                            PID:782
                                        • /bin/sh
                                          sh -c "/bin/uname -n"
                                          2⤵
                                            PID:784
                                            • /bin/uname
                                              /bin/uname -n
                                              3⤵
                                                PID:786
                                            • /bin/sh
                                              sh -c "/bin/uname -n"
                                              2⤵
                                                PID:787
                                                • /bin/uname
                                                  /bin/uname -n
                                                  3⤵
                                                    PID:788
                                                • /bin/sh
                                                  sh -c "/bin/uname -n"
                                                  2⤵
                                                    PID:789
                                                    • /bin/uname
                                                      /bin/uname -n
                                                      3⤵
                                                        PID:790
                                                    • /bin/sh
                                                      sh -c "kill -9 `cat /var/run/httpd.pid` > /dev/null 2>&1 &"
                                                      2⤵
                                                        PID:796
                                                        • /bin/cat
                                                          cat /var/run/httpd.pid
                                                          3⤵
                                                            PID:798
                                                        • /bin/sh
                                                          sh -c "service httpd stop > /dev/null 2>&1 &"
                                                          2⤵
                                                            PID:799
                                                          • /bin/sh
                                                            sh -c "killall -9 mini_httpd > /dev/null 2>&1 &"
                                                            2⤵
                                                              PID:801
                                                            • /bin/sh
                                                              sh -c "killall -9 minihttpd > /dev/null 2>&1 &"
                                                              2⤵
                                                                PID:805
                                                              • /bin/sh
                                                                sh -c "kill -9 `cat /var/run/thttpd.pid` > /dev/null 2>&1 &"
                                                                2⤵
                                                                  PID:807
                                                                  • /bin/cat
                                                                    cat /var/run/thttpd.pid
                                                                    3⤵
                                                                      PID:810
                                                                  • /bin/sh
                                                                    sh -c "nvram set httpd_enable=0 > /dev/null 2>&1"
                                                                    2⤵
                                                                      PID:809
                                                                    • /bin/sh
                                                                      sh -c "nvram set http_enable=0 > /dev/null 2>&1"
                                                                      2⤵
                                                                        PID:811
                                                                      • /bin/sh
                                                                        sh -c "killall -9 httpd > /dev/null 2>&1 &"
                                                                        2⤵
                                                                          PID:813
                                                                        • /bin/sh
                                                                          sh -c "service telnetd stop > /dev/null 2>&1 &"
                                                                          2⤵
                                                                            PID:815
                                                                          • /bin/sh
                                                                            sh -c "service sshd stop > /dev/null 2>&1 &"
                                                                            2⤵
                                                                              PID:817
                                                                            • /bin/sh
                                                                              sh -c "killall -9 telnetd > /dev/null 2>&1 &"
                                                                              2⤵
                                                                                PID:819
                                                                              • /bin/sh
                                                                                sh -c "killall -9 utelnetd > /dev/null 2>&1 &"
                                                                                2⤵
                                                                                  PID:822
                                                                                • /bin/sh
                                                                                  sh -c "killall -9 dropbear > /dev/null 2>&1 &"
                                                                                  2⤵
                                                                                    PID:825
                                                                                  • /bin/sh
                                                                                    sh -c "killall -9 sshd > /dev/null 2>&1 &"
                                                                                    2⤵
                                                                                      PID:829
                                                                                    • /bin/sh
                                                                                      sh -c "killall -9 lighttpd > /dev/null 2>&1 &"
                                                                                      2⤵
                                                                                        PID:839
                                                                                    • /usr/sbin/service
                                                                                      service httpd stop
                                                                                      1⤵
                                                                                        PID:800
                                                                                        • /usr/bin/basename
                                                                                          basename /usr/sbin/service
                                                                                          2⤵
                                                                                            PID:802
                                                                                          • /usr/bin/basename
                                                                                            basename /usr/sbin/service
                                                                                            2⤵
                                                                                              PID:803
                                                                                            • /bin/systemctl
                                                                                              systemctl --quiet is-active multi-user.target
                                                                                              2⤵
                                                                                              • Enumerates kernel/hardware configuration
                                                                                              PID:812
                                                                                            • /bin/systemctl
                                                                                              systemctl list-unit-files --full "--type=socket"
                                                                                              2⤵
                                                                                              • Enumerates kernel/hardware configuration
                                                                                              • Reads runtime system information
                                                                                              PID:833
                                                                                            • /bin/sed
                                                                                              sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
                                                                                              2⤵
                                                                                              • Reads runtime system information
                                                                                              PID:834
                                                                                          • /usr/bin/killall
                                                                                            killall -9 mini_httpd
                                                                                            1⤵
                                                                                            • Reads runtime system information
                                                                                            PID:804
                                                                                          • /usr/bin/killall
                                                                                            killall -9 minihttpd
                                                                                            1⤵
                                                                                            • Reads runtime system information
                                                                                            PID:806
                                                                                          • /usr/bin/killall
                                                                                            killall -9 httpd
                                                                                            1⤵
                                                                                            • Reads runtime system information
                                                                                            PID:814
                                                                                          • /usr/sbin/service
                                                                                            service telnetd stop
                                                                                            1⤵
                                                                                              PID:816
                                                                                              • /usr/bin/basename
                                                                                                basename /usr/sbin/service
                                                                                                2⤵
                                                                                                  PID:820
                                                                                                • /usr/bin/basename
                                                                                                  basename /usr/sbin/service
                                                                                                  2⤵
                                                                                                    PID:826
                                                                                                  • /bin/systemctl
                                                                                                    systemctl --quiet is-active multi-user.target
                                                                                                    2⤵
                                                                                                    • Enumerates kernel/hardware configuration
                                                                                                    • Reads runtime system information
                                                                                                    PID:831
                                                                                                  • /bin/systemctl
                                                                                                    systemctl list-unit-files --full "--type=socket"
                                                                                                    2⤵
                                                                                                    • Enumerates kernel/hardware configuration
                                                                                                    PID:843
                                                                                                  • /bin/sed
                                                                                                    sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
                                                                                                    2⤵
                                                                                                    • Reads runtime system information
                                                                                                    PID:844
                                                                                                  • /bin/systemctl
                                                                                                    systemctl -p Triggers show dbus.socket
                                                                                                    2⤵
                                                                                                    • Enumerates kernel/hardware configuration
                                                                                                    PID:847
                                                                                                  • /bin/systemctl
                                                                                                    systemctl -p Triggers show ssh.socket
                                                                                                    2⤵
                                                                                                    • Enumerates kernel/hardware configuration
                                                                                                    PID:848
                                                                                                  • /bin/systemctl
                                                                                                    systemctl -p Triggers show syslog.socket
                                                                                                    2⤵
                                                                                                    • Enumerates kernel/hardware configuration
                                                                                                    • Reads runtime system information
                                                                                                    PID:852
                                                                                                  • /bin/systemctl
                                                                                                    systemctl -p Triggers show systemd-fsckd.socket
                                                                                                    2⤵
                                                                                                    • Enumerates kernel/hardware configuration
                                                                                                    PID:853
                                                                                                  • /bin/systemctl
                                                                                                    systemctl -p Triggers show systemd-initctl.socket
                                                                                                    2⤵
                                                                                                    • Enumerates kernel/hardware configuration
                                                                                                    PID:855
                                                                                                  • /bin/systemctl
                                                                                                    systemctl -p Triggers show systemd-journald-audit.socket
                                                                                                    2⤵
                                                                                                    • Enumerates kernel/hardware configuration
                                                                                                    PID:856
                                                                                                  • /bin/systemctl
                                                                                                    systemctl -p Triggers show systemd-journald-dev-log.socket
                                                                                                    2⤵
                                                                                                    • Enumerates kernel/hardware configuration
                                                                                                    PID:857
                                                                                                  • /bin/systemctl
                                                                                                    systemctl -p Triggers show systemd-journald.socket
                                                                                                    2⤵
                                                                                                    • Enumerates kernel/hardware configuration
                                                                                                    PID:858
                                                                                                  • /bin/systemctl
                                                                                                    systemctl -p Triggers show systemd-networkd.socket
                                                                                                    2⤵
                                                                                                    • Enumerates kernel/hardware configuration
                                                                                                    • Reads runtime system information
                                                                                                    PID:859
                                                                                                  • /bin/systemctl
                                                                                                    systemctl -p Triggers show systemd-rfkill.socket
                                                                                                    2⤵
                                                                                                    • Enumerates kernel/hardware configuration
                                                                                                    PID:860
                                                                                                  • /bin/systemctl
                                                                                                    systemctl -p Triggers show systemd-udevd-control.socket
                                                                                                    2⤵
                                                                                                    • Enumerates kernel/hardware configuration
                                                                                                    PID:861
                                                                                                  • /bin/systemctl
                                                                                                    systemctl -p Triggers show systemd-udevd-kernel.socket
                                                                                                    2⤵
                                                                                                    • Enumerates kernel/hardware configuration
                                                                                                    PID:862
                                                                                                • /usr/sbin/service
                                                                                                  service sshd stop
                                                                                                  1⤵
                                                                                                    PID:818
                                                                                                    • /usr/bin/basename
                                                                                                      basename /usr/sbin/service
                                                                                                      2⤵
                                                                                                        PID:823
                                                                                                      • /usr/bin/basename
                                                                                                        basename /usr/sbin/service
                                                                                                        2⤵
                                                                                                          PID:827
                                                                                                        • /bin/systemctl
                                                                                                          systemctl --quiet is-active multi-user.target
                                                                                                          2⤵
                                                                                                          • Enumerates kernel/hardware configuration
                                                                                                          • Reads runtime system information
                                                                                                          PID:830
                                                                                                        • /bin/systemctl
                                                                                                          systemctl list-unit-files --full "--type=socket"
                                                                                                          2⤵
                                                                                                          • Enumerates kernel/hardware configuration
                                                                                                          PID:836
                                                                                                        • /bin/sed
                                                                                                          sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
                                                                                                          2⤵
                                                                                                            PID:837
                                                                                                        • /usr/bin/killall
                                                                                                          killall -9 telnetd
                                                                                                          1⤵
                                                                                                          • Reads runtime system information
                                                                                                          PID:821
                                                                                                        • /usr/bin/killall
                                                                                                          killall -9 utelnetd
                                                                                                          1⤵
                                                                                                          • Reads runtime system information
                                                                                                          PID:824
                                                                                                        • /usr/bin/killall
                                                                                                          killall -9 dropbear
                                                                                                          1⤵
                                                                                                          • Reads runtime system information
                                                                                                          PID:828
                                                                                                        • /usr/bin/killall
                                                                                                          killall -9 sshd
                                                                                                          1⤵
                                                                                                          • Reads runtime system information
                                                                                                          PID:838
                                                                                                        • /usr/bin/killall
                                                                                                          killall -9 lighttpd
                                                                                                          1⤵
                                                                                                          • Reads runtime system information
                                                                                                          PID:840
                                                                                                        • /usr/local/sbin/systemctl
                                                                                                          systemctl "--job-mode=ignore-dependencies" stop httpd.service
                                                                                                          1⤵
                                                                                                            PID:800
                                                                                                          • /usr/local/bin/systemctl
                                                                                                            systemctl "--job-mode=ignore-dependencies" stop httpd.service
                                                                                                            1⤵
                                                                                                              PID:800
                                                                                                            • /usr/sbin/systemctl
                                                                                                              systemctl "--job-mode=ignore-dependencies" stop httpd.service
                                                                                                              1⤵
                                                                                                                PID:800
                                                                                                              • /usr/bin/systemctl
                                                                                                                systemctl "--job-mode=ignore-dependencies" stop httpd.service
                                                                                                                1⤵
                                                                                                                  PID:800
                                                                                                                • /sbin/systemctl
                                                                                                                  systemctl "--job-mode=ignore-dependencies" stop httpd.service
                                                                                                                  1⤵
                                                                                                                    PID:800
                                                                                                                  • /bin/systemctl
                                                                                                                    systemctl "--job-mode=ignore-dependencies" stop httpd.service
                                                                                                                    1⤵
                                                                                                                    • Enumerates kernel/hardware configuration
                                                                                                                    • Reads runtime system information
                                                                                                                    PID:800
                                                                                                                  • /usr/local/sbin/systemctl
                                                                                                                    systemctl "--job-mode=ignore-dependencies" stop sshd.service
                                                                                                                    1⤵
                                                                                                                      PID:818
                                                                                                                    • /usr/local/bin/systemctl
                                                                                                                      systemctl "--job-mode=ignore-dependencies" stop sshd.service
                                                                                                                      1⤵
                                                                                                                        PID:818
                                                                                                                      • /usr/sbin/systemctl
                                                                                                                        systemctl "--job-mode=ignore-dependencies" stop sshd.service
                                                                                                                        1⤵
                                                                                                                          PID:818
                                                                                                                        • /usr/bin/systemctl
                                                                                                                          systemctl "--job-mode=ignore-dependencies" stop sshd.service
                                                                                                                          1⤵
                                                                                                                            PID:818
                                                                                                                          • /sbin/systemctl
                                                                                                                            systemctl "--job-mode=ignore-dependencies" stop sshd.service
                                                                                                                            1⤵
                                                                                                                              PID:818
                                                                                                                            • /bin/systemctl
                                                                                                                              systemctl "--job-mode=ignore-dependencies" stop sshd.service
                                                                                                                              1⤵
                                                                                                                              • Enumerates kernel/hardware configuration
                                                                                                                              • Reads runtime system information
                                                                                                                              PID:818
                                                                                                                            • /usr/local/sbin/systemctl
                                                                                                                              systemctl "--job-mode=ignore-dependencies" stop telnetd.service
                                                                                                                              1⤵
                                                                                                                                PID:816
                                                                                                                              • /usr/local/bin/systemctl
                                                                                                                                systemctl "--job-mode=ignore-dependencies" stop telnetd.service
                                                                                                                                1⤵
                                                                                                                                  PID:816
                                                                                                                                • /usr/sbin/systemctl
                                                                                                                                  systemctl "--job-mode=ignore-dependencies" stop telnetd.service
                                                                                                                                  1⤵
                                                                                                                                    PID:816
                                                                                                                                  • /usr/bin/systemctl
                                                                                                                                    systemctl "--job-mode=ignore-dependencies" stop telnetd.service
                                                                                                                                    1⤵
                                                                                                                                      PID:816
                                                                                                                                    • /sbin/systemctl
                                                                                                                                      systemctl "--job-mode=ignore-dependencies" stop telnetd.service
                                                                                                                                      1⤵
                                                                                                                                        PID:816
                                                                                                                                      • /bin/systemctl
                                                                                                                                        systemctl "--job-mode=ignore-dependencies" stop telnetd.service
                                                                                                                                        1⤵
                                                                                                                                        • Enumerates kernel/hardware configuration
                                                                                                                                        PID:816

                                                                                                                                      Network

                                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                                      Replay Monitor

                                                                                                                                      Loading Replay Monitor...

                                                                                                                                      Downloads

                                                                                                                                      • /etc/inittab2

                                                                                                                                        Filesize

                                                                                                                                        25B

                                                                                                                                        MD5

                                                                                                                                        fb9937ff672674502da9a565b7576ed1

                                                                                                                                        SHA1

                                                                                                                                        4e152aef48427b3ed75a06b3b3ae8cd350dc57eb

                                                                                                                                        SHA256

                                                                                                                                        1204206d0f4e038ab65c11096d9ac595dd9ff9b4dd59415840051a756e610fd5

                                                                                                                                        SHA512

                                                                                                                                        b8c0fc312e26387cdeae8bac1c4470f8dd967d3a5706d386f9360ebd67693fb4bd5ed8fbb7ca9e4030cc8a6543fcdc6ccd562db0fa9404991a1dc4e7be01418e

                                                                                                                                      • /run/.x00740882966

                                                                                                                                        Filesize

                                                                                                                                        39B

                                                                                                                                        MD5

                                                                                                                                        d118ee982e25b7da8116537cd4fe7aaf

                                                                                                                                        SHA1

                                                                                                                                        faace3f0f5dcc4f28fe7d613fe4457f11452eb8c

                                                                                                                                        SHA256

                                                                                                                                        94fcb661559435e277be010ee5b1cae44f4660d70628924d8b8e8a184be7039d

                                                                                                                                        SHA512

                                                                                                                                        ee642d887f04c1bca7d7d191e8f101ffc5cfeec4e17b09fb608f8689a7cada704594dd42e4e74effbd339ce3321ec4c8976e0fb85345a3d37fc3be50a6a10a0d

                                                                                                                                      • /var/spool/cron/crontabs/tmp.juuYTB

                                                                                                                                        Filesize

                                                                                                                                        235B

                                                                                                                                        MD5

                                                                                                                                        ced4c39d059799b6f8b3a3a55427154b

                                                                                                                                        SHA1

                                                                                                                                        69ffc9c6ed1f6b991ce3bd08d34e4ccc3cfc1590

                                                                                                                                        SHA256

                                                                                                                                        ca43e6bdc3f34047ab41ef97c6886a814bfe7febc7b97dc99e3dcf3c1c8f50ef

                                                                                                                                        SHA512

                                                                                                                                        da5afee4c6c624e56286f825b810ee5ba7e34882c31af761ca87b965a84ece7ac46268ddbf8ae32c9efcaea2492af684c6b578aa61f5c9f07687108a369c61d7