kaiten | a1f211877e5ac29682f07d0b97d02ee936ed02f3355b68d7163b3336164d85f6

Analysis

max time kernel
151s
max time network
157s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
23-10-2024 01:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a1f211877e5ac29682f07d0b97d02ee936ed02f3355b68d7163b3336164d85f6.elf
Size

510KB
MD5

2aa1abc12fdf779dbe4e71ed20111bce
SHA1

fee772fa1e9c94d9b89ffa3fa89df08c4a1fe84f
SHA256

a1f211877e5ac29682f07d0b97d02ee936ed02f3355b68d7163b3336164d85f6
SHA512

e9b95f9c28e39fa3c57f921ac2e55f5ee1b22d3664b8059f53610b059e620230ff63db7d39a5a9c256f39aa99d1b1333f4bd0acefe44bd826048c60b4e5c6fc0
SSDEEP

6144:21cNQ3N/6H7bvnWGSTOk/Gsw6apMBNedo+nS2Ref6zIfcxnjL/Va+wjdIBKPO7QZ:2CQd/SVV2PsfssIfyn/U+sm7Q380/

Score

10^/10

kaiten botnet defense_evasion discovery execution persistence privilege_escalatio privilege_escalation

Malware Config

Signatures

Detects Kaiten/Tsunami Payload 1 IoCs

resource	yara_rule
behavioral1/memory/698-1-0x00400000-0x00568718-memory.dmp	family_kaiten2

Kaiten/Tsunami
Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.
botnet kaiten

Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 3 IoCs

Abuse sudo or cached sudo credentials to execute code.

privilege_escalation defense_evasion

Sudo and Sudo Caching

T1548.003

pid	Process
909	sh
921	sudo
913	sudo

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalatio

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.psKzB6	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Indicator Removal: Timestomp 1 TTPs 4 IoCs

Adversaries may remove indicators of compromise from the host to evade detection.

defense_evasion

Timestomp

T1070.006

pid	Process
706	touch
741	sh
742	touch
705	sh

Reads CPU attributes 1 TTPs 2 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	exim4
File opened for reading	/sys/devices/system/cpu/online	exim4

Enumerates kernel/hardware configuration 1 TTPs 15 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/781/stat	killall
File opened for reading	/proc/492/stat	killall
File opened for reading	/proc/115/stat	killall
File opened for reading	/proc/140/cmdline	killall
File opened for reading	/proc/167/stat	killall
File opened for reading	/proc/493/stat	killall
File opened for reading	/proc/763/stat	killall
File opened for reading	/proc/24/stat	killall
File opened for reading	/proc/375/stat	killall
File opened for reading	/proc/72/stat	killall
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/72/stat	killall
File opened for reading	/proc/797/stat	killall
File opened for reading	/proc/389/stat	killall
File opened for reading	/proc/69/stat	killall
File opened for reading	/proc/797/stat	killall
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/16/stat	killall
File opened for reading	/proc/24/stat	killall
File opened for reading	/proc/375/stat	killall
File opened for reading	/proc/330/stat	killall
File opened for reading	/proc/10/stat	killall
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/708/stat	killall
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/330/stat	killall
File opened for reading	/proc/167/stat	killall
File opened for reading	/proc/677/stat	killall
File opened for reading	/proc/235/stat	killall
File opened for reading	/proc/691/cmdline	killall
File opened for reading	/proc/697/stat	killall
File opened for reading	/proc/115/stat	killall
File opened for reading	/proc/3/stat	killall
File opened for reading	/proc/10/stat	killall
File opened for reading	/proc/167/stat	killall
File opened for reading	/proc/763/stat	killall
File opened for reading	/proc/78/stat	killall
File opened for reading	/proc/105/stat	killall
File opened for reading	/proc/757/stat	killall
File opened for reading	/proc/677/stat	killall
File opened for reading	/proc/333/stat	killall
File opened for reading	/proc/5/stat	killall
File opened for reading	/proc/21/stat	killall
File opened for reading	/proc/150/stat	killall
File opened for reading	/proc/36/stat	killall
File opened for reading	/proc/filesystems	killall
File opened for reading	/proc/5/stat	killall
File opened for reading	/proc/sys/kernel/ngroups_max	sendmail
File opened for reading	/proc/1/cmdline	a1f211877e5ac29682f07d0b97d02ee936ed02f3355b68d7163b3336164d85f6.elf
File opened for reading	/proc/15/stat	killall
File opened for reading	/proc/17/stat	killall
File opened for reading	/proc/73/stat	killall
File opened for reading	/proc/743/cmdline	killall
File opened for reading	/proc/695/stat	killall
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/116/stat	killall
File opened for reading	/proc/743/cmdline	killall
File opened for reading	/proc/19/stat	killall
File opened for reading	/proc/899/stat	killall
File opened for reading	/proc/765/stat	killall
File opened for reading	/proc/335/stat	killall
File opened for reading	/proc/13/stat	killall
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/12/stat	killall

/tmp/a1f211877e5ac29682f07d0b97d02ee936ed02f3355b68d7163b3336164d85f6.elf
/tmp/a1f211877e5ac29682f07d0b97d02ee936ed02f3355b68d7163b3336164d85f6.elf
1⤵
- Reads runtime system information
PID:698
- /bin/sh
  sh -c "touch -acmr /bin/ls /tmp/a1f211877e5ac29682f07d0b97d02ee936ed02f3355b68d7163b3336164d85f6.elf"
  2⤵
  - Indicator Removal: Timestomp
  PID:705
- - /usr/bin/touch
    touch -acmr /bin/ls /tmp/a1f211877e5ac29682f07d0b97d02ee936ed02f3355b68d7163b3336164d85f6.elf
    3⤵
    - Indicator Removal: Timestomp
    PID:706
- /bin/sh
  sh -c "(crontab -l | grep -v \"/tmp/a1f211877e5ac29682f07d0b97d02ee936ed02f3355b68d7163b3336164d85f6.elf\" | grep -v \"no cron\" | grep -v \"lesshts/run.sh\" > /var/run/.x00740882966) > /dev/null 2>&1"
  2⤵
  PID:711
- - /bin/grep
    grep -v lesshts/run.sh
    3⤵
    PID:716
- - /bin/grep
    grep -v "no cron"
    3⤵
    PID:715
- - /bin/grep
    grep -v /tmp/a1f211877e5ac29682f07d0b97d02ee936ed02f3355b68d7163b3336164d85f6.elf
    3⤵
    PID:714
- - /usr/bin/crontab
    crontab -l
    3⤵
    PID:713
- /bin/sh
  sh -c "echo \"* * * * * /tmp/a1f211877e5ac29682f07d0b97d02ee936ed02f3355b68d7163b3336164d85f6.elf > /dev/null 2>&1 &\" >> /var/run/.x00740882966"
  2⤵
  PID:721
- /bin/sh
  sh -c "crontab /var/run/.x00740882966"
  2⤵
  PID:722
- - /usr/bin/crontab
    crontab /var/run/.x00740882966
    3⤵
    - Creates/modifies Cron job
    PID:723
- /bin/sh
  sh -c "rm -rf /var/run/.x00740882966"
  2⤵
  PID:727
- - /bin/rm
    rm -rf /var/run/.x00740882966
    3⤵
    PID:728
- /bin/sh
  sh -c "cat /etc/inittab | grep -v \"/tmp/a1f211877e5ac29682f07d0b97d02ee936ed02f3355b68d7163b3336164d85f6.elf\" > /etc/inittab2"
  2⤵
  PID:730
- - /bin/grep
    grep -v /tmp/a1f211877e5ac29682f07d0b97d02ee936ed02f3355b68d7163b3336164d85f6.elf
    3⤵
    PID:732
- - /bin/cat
    cat /etc/inittab
    3⤵
    PID:731
- /bin/sh
  sh -c "echo \"0:2345:respawn:/tmp/a1f211877e5ac29682f07d0b97d02ee936ed02f3355b68d7163b3336164d85f6.elf\" >> /etc/inittab2"
  2⤵
  PID:736
- /bin/sh
  sh -c "cat /etc/inittab2 > /etc/inittab"
  2⤵
  PID:737
- - /bin/cat
    cat /etc/inittab2
    3⤵
    PID:738
- /bin/sh
  sh -c "rm -rf /etc/inittab2"
  2⤵
  PID:739
- - /bin/rm
    rm -rf /etc/inittab2
    3⤵
    PID:740
- /bin/sh
  sh -c "touch -acmr /bin/ls /etc/inittab"
  2⤵
  - Indicator Removal: Timestomp
  PID:741
- - /usr/bin/touch
    touch -acmr /bin/ls /etc/inittab
    3⤵
    - Indicator Removal: Timestomp
    PID:742
- /bin/sh
  sh -c "/bin/uname -n"
  2⤵
  PID:744
- - /bin/uname
    /bin/uname -n
    3⤵
    PID:746
- /bin/sh
  sh -c "/bin/uname -n"
  2⤵
  PID:748
- - /bin/uname
    /bin/uname -n
    3⤵
    PID:749
- /bin/sh
  sh -c "/bin/uname -n"
  2⤵
  PID:751
- - /bin/uname
    /bin/uname -n
    3⤵
    PID:752
- /bin/sh
  sh -c "kill -9 `cat /var/run/httpd.pid` > /dev/null 2>&1 &"
  2⤵
  PID:759
- - /bin/cat
    cat /var/run/httpd.pid
    3⤵
    PID:762
- /bin/sh
  sh -c "service httpd stop > /dev/null 2>&1 &"
  2⤵
  PID:761
- /bin/sh
  sh -c "killall -9 mini_httpd > /dev/null 2>&1 &"
  2⤵
  PID:764
- /bin/sh
  sh -c "killall -9 minihttpd > /dev/null 2>&1 &"
  2⤵
  PID:766
- /bin/sh
  sh -c "kill -9 `cat /var/run/thttpd.pid` > /dev/null 2>&1 &"
  2⤵
  PID:769
- - /bin/cat
    cat /var/run/thttpd.pid
    3⤵
    PID:774
- /bin/sh
  sh -c "nvram set httpd_enable=0 > /dev/null 2>&1"
  2⤵
  PID:773
- /bin/sh
  sh -c "nvram set http_enable=0 > /dev/null 2>&1"
  2⤵
  PID:775
- /bin/sh
  sh -c "killall -9 httpd > /dev/null 2>&1 &"
  2⤵
  PID:777
- /bin/sh
  sh -c "service telnetd stop > /dev/null 2>&1 &"
  2⤵
  PID:779
- /bin/sh
  sh -c "service sshd stop > /dev/null 2>&1 &"
  2⤵
  PID:781
- /bin/sh
  sh -c "killall -9 telnetd > /dev/null 2>&1 &"
  2⤵
  PID:783
- /bin/sh
  sh -c "killall -9 utelnetd > /dev/null 2>&1 &"
  2⤵
  PID:789
- /bin/sh
  sh -c "killall -9 dropbear > /dev/null 2>&1 &"
  2⤵
  PID:793
- /bin/sh
  sh -c "killall -9 sshd > /dev/null 2>&1 &"
  2⤵
  PID:796
- /bin/sh
  sh -c "killall -9 lighttpd > /dev/null 2>&1 &"
  2⤵
  PID:800
- /bin/sh
  sh -c "export PATH=/bin:/sbin:/usr/bin:/usr/local/bin:/usr/sbin;( kill -9 `cat /var/run/dropbear.pid` `cat /var/run/sshd.pid` ; killall -9 sshd dropbear ; /etc/init.d/dropbear stop )>/dev/null 2>&1 & "
  2⤵
  PID:898
- - /bin/cat
    cat /var/run/dropbear.pid
    3⤵
    PID:900
- - /bin/cat
    cat /var/run/sshd.pid
    3⤵
    PID:901
- - /usr/bin/killall
    killall -9 sshd dropbear
    3⤵
    - Reads runtime system information
    PID:903
- /bin/sh
  sh -c "export PATH=/bin:/sbin:/usr/bin:/usr/local/bin:/usr/sbin;(service dropbear stop ; sudo service sshd stop ; sudo systemctl stop ssh )>/dev/null 2>&1 & "
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:909
- - /usr/sbin/service
    service dropbear stop
    3⤵
    PID:914
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:915
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:916
  - - /bin/systemctl
      systemctl --quiet is-active multi-user.target
      4⤵
      Enumerates kernel/hardware configuration
      PID:917
  - - /bin/sed
      sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
      4⤵
      PID:920
  - - /bin/systemctl
      systemctl list-unit-files --full "--type=socket"
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:919
- - /bin/systemctl
    systemctl "--job-mode=ignore-dependencies" stop dropbear.service
    3⤵
    - Enumerates kernel/hardware configuration
    PID:914
- - /usr/bin/sudo
    sudo service sshd stop
    3⤵
    - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
    PID:921
  - - /usr/sbin/sendmail
      sendmail -t
      4⤵
      Reads runtime system information
      PID:924
    - - /usr/sbin/exim4
        
        /usr/sbin/exim4 -Mc 1t3OU0-0000Eu-FA
        5⤵
        Reads CPU attributes
        
        PID:935
  - - /usr/sbin/sendmail
      sendmail -t
      4⤵
      PID:927
    - - /usr/sbin/exim4
        
        /usr/sbin/exim4 -Mc 1t3OU0-0000Ex-FD
        5⤵
        Reads CPU attributes
        
        PID:936
  - - /usr/sbin/service
      service sshd stop
      4⤵
      PID:928
    - - /usr/bin/basename
        
        basename /usr/sbin/service
        5⤵
        
        PID:929
    - - /usr/bin/basename
        
        basename /usr/sbin/service
        5⤵
        
        PID:930
    - - /bin/systemctl
        
        systemctl --quiet is-active multi-user.target
        5⤵
        Enumerates kernel/hardware configuration
        
        PID:931
    - - /bin/systemctl
        
        systemctl list-unit-files --full "--type=socket"
        5⤵
        Enumerates kernel/hardware configuration
        
        PID:933
    - - /bin/sed
        
        sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
        5⤵
        
        PID:934
  - - /usr/local/sbin/systemctl
      systemctl "--job-mode=ignore-dependencies" stop sshd.service
      4⤵
      PID:928
  - - /usr/local/bin/systemctl
      systemctl "--job-mode=ignore-dependencies" stop sshd.service
      4⤵
      PID:928
  - - /usr/sbin/systemctl
      systemctl "--job-mode=ignore-dependencies" stop sshd.service
      4⤵
      PID:928
  - - /usr/bin/systemctl
      systemctl "--job-mode=ignore-dependencies" stop sshd.service
      4⤵
      PID:928
  - - /sbin/systemctl
      systemctl "--job-mode=ignore-dependencies" stop sshd.service
      4⤵
      PID:928
  - - /bin/systemctl
      systemctl "--job-mode=ignore-dependencies" stop sshd.service
      4⤵
      Enumerates kernel/hardware configuration
      PID:928

/usr/sbin/service
service httpd stop
1⤵
PID:763
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:767
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:770
- /bin/systemctl
  systemctl --quiet is-active multi-user.target
  2⤵
  - Enumerates kernel/hardware configuration
  PID:776
- /bin/sed
  sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
  2⤵
  PID:786
- /bin/systemctl
  systemctl list-unit-files --full "--type=socket"
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:785

/usr/bin/killall
killall -9 mini_httpd
1⤵
- Reads runtime system information
PID:765

/usr/bin/killall
killall -9 minihttpd
1⤵
- Reads runtime system information
PID:768

/usr/bin/killall
killall -9 httpd
1⤵
- Reads runtime system information
PID:778

/usr/sbin/service
service telnetd stop
1⤵
PID:780
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:787
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:791
- /bin/systemctl
  systemctl --quiet is-active multi-user.target
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:797
- /bin/systemctl
  systemctl list-unit-files --full "--type=socket"
  2⤵
  - Enumerates kernel/hardware configuration
  PID:804
- /bin/sed
  sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
  2⤵
  PID:805

/usr/sbin/service
service sshd stop
1⤵
PID:782
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:790
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:794
- /bin/systemctl
  systemctl --quiet is-active multi-user.target
  2⤵
  - Enumerates kernel/hardware configuration
  PID:798
- /bin/systemctl
  systemctl list-unit-files --full "--type=socket"
  2⤵
  - Enumerates kernel/hardware configuration
  PID:808
- /bin/sed
  sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
  2⤵
  PID:809

/usr/bin/killall
killall -9 telnetd
1⤵
- Reads runtime system information
PID:788

/usr/bin/killall
killall -9 utelnetd
1⤵
- Reads runtime system information
PID:792

/usr/bin/killall
killall -9 dropbear
1⤵
- Reads runtime system information
PID:795

/usr/local/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop httpd.service
1⤵
PID:763

/usr/local/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop httpd.service
1⤵
PID:763

/usr/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop httpd.service
1⤵
PID:763

/usr/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop httpd.service
1⤵
PID:763

/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop httpd.service
1⤵
PID:763

/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop httpd.service
1⤵
- Enumerates kernel/hardware configuration
PID:763

/usr/bin/killall
killall -9 sshd
1⤵
- Reads runtime system information
PID:799

/usr/bin/killall
killall -9 lighttpd
1⤵
- Reads runtime system information
PID:801

/usr/local/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop telnetd.service
1⤵
PID:780

/usr/local/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop telnetd.service
1⤵
PID:780

/usr/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop telnetd.service
1⤵
PID:780

/usr/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop telnetd.service
1⤵
PID:780

/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop telnetd.service
1⤵
PID:780

/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop telnetd.service
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:780

/usr/local/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop sshd.service
1⤵
PID:782

/usr/local/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop sshd.service
1⤵
PID:782

/usr/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop sshd.service
1⤵
PID:782

/usr/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop sshd.service
1⤵
PID:782

/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop sshd.service
1⤵
PID:782

/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop sshd.service
1⤵
- Enumerates kernel/hardware configuration
PID:782

/etc/init.d/dropbear
/etc/init.d/dropbear stop
1⤵
PID:899

/usr/bin/sudo
sudo systemctl stop ssh
1⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
PID:913

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Indicator Removal

T1070

Timestomp

T1070.006

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/inittab2

Filesize
89B

MD5
f3e01c956b421a2976a790b74e3de2ab

SHA1
ad121970bb5deb91773b54c0f896b48c04bfed15

SHA256
8b642be05b9a4c48bb478839fb28c0785853ab851fd82f7109cbed022660ad6a

SHA512
87959d2b49f0783a17b93e4f45e0305e592c019b61122fa25223976438f1971c665f9a2ff5d0976298ba6e695db7490e633a12c68d023cd88f054910894fe90a

Download Submit
/run/.x00740882966

Filesize
103B

MD5
7202569586819c1f1efd5b19b69a2b50

SHA1
e7fed409a869131db23b052e9bdb979abb1592a1

SHA256
af04cfcfc4e0ab869b4838e08d813b88cef93b2a03f49529f965fc5455a40bd6

SHA512
85eadca4442adc09b89ac45a4f553060b3b6bcf3eda18ac71f908f9d8ed19c73d5571980963bd6816bb74301957a4d597170cf887c8b7445056bc8ba4b8f9a68

Download Submit
/var/mail/user

Filesize
825B

MD5
62788012d2fc36e25388f637e9885f4c

SHA1
9fbe1c5a64330d00d801644c3103127f8fd39710

SHA256
40da23a1d5019e772de490326dbfc1ea1e78342c2821d265acd56e08430e2b26

SHA512
73056559e8667f2e8038e351558fafe56ac0d1853278fc193f22bd737ea0001ce19ec2b09d99dc8bbfdaedb24951e3db4f08e080f056cf11763c9de551476c57

Download Submit
/var/mail/user

Filesize
1KB

MD5
2f3c42e17ae6558d4545e3e9024e311f

SHA1
68cec9af1916fcc86e1842746b5ed74d4e483e3d

SHA256
7fccc321f4ac722536e5210b991c886c09bc0070176e056e1435c0da4145582c

SHA512
1ffaead3bb92c3082f999602aea4992600bb72ab83a4fa7e0d206a59440ca0bc8184caafa3392714ad3efb0996eca1096e6759a809352b5d0945101afe72c52c

Download Submit
/var/spool/cron/crontabs/tmp.psKzB6

Filesize
299B

MD5
bac6b33e3a0f8a833a29dca4d3af3dbb

SHA1
bb28f7e1427b3602cbbada89c1afc78647b50311

SHA256
7dbd6d264132a24d05ae94b2ed9630680e88f1587fe28df09d01c9db05b1dd36

SHA512
02d652e1682b2afd7d793d7c06af7ccf08b66fce1bb7524fcc890b50df4e6d972abc208eb4f8ab2acbaeed59d208f3a92c20a325f6812a6d1657303412b89aca

Download Submit
/var/spool/exim4/input/1t3OU0-0000Eu-FA-D

Filesize
128B

MD5
a34a0945148b2e4455a5ccfe4f872354

SHA1
d8a86eaac9fd1ae83b3ce22bf215944cb20566a0

SHA256
c29817dc5b98571c57e346e2e6752b3b77c77b3a48abc3a4a7450dc4587a0427

SHA512
b3e5516875dd13e2bff44ab4bd7ec997fd2e5281301cd6b6cca8abeccc610b241ffc7ad3afb0822dac182914f1bf4a7adef008db21a414116d4892d25d5034a9

Download Submit
/var/spool/exim4/input/1t3OU0-0000Eu-FA-J

Filesize
34B

MD5
d7d96d63d643a4ce3e408eba7dfcedc5

SHA1
c53607f95c5c57beafc1d8266646797a035f76ea

SHA256
21db3a59b2d0ce18fb250b787d6e2c85d12919f5fdf1448c8f48207c4083b159

SHA512
703a03e54776a6ad9b8adc6c475bbc91c06502618fa3b6f495b1a01a4f6f7aa6fb65dc6ba6885ddc6af961627062f1ce1e1d66688288cbd3bef7754d249fa9b3

Download Submit
/var/spool/exim4/input/1t3OU0-0000Ex-FD-D

Filesize
146B

MD5
adf8e29faf8033725da4757a8eaaab42

SHA1
384cfdbfd7a112b70e56343b52f4100dfa5da1fe

SHA256
7e243820b4bb043d17aa091ee7e9fdd87b1b2f48f47b6d716453f45eadb0af8d

SHA512
ceebd71454240ef52410efaff9fde2adc7c6bb548f05a820dce81c6d96ce46c1f8ba624f7be6566a03e5f53641c80e85f3502669f228b963665c46a4ef90ff86

Download Submit
/var/spool/exim4/input/hdr.924

Filesize
915B

MD5
d701985bc086c88fed12d0d57f80cbcc

SHA1
509bfeb46c87becf18aec8bbcef2f5add1cdfdfe

SHA256
3ac536af4053d246f1554664022ecbfecf7bf3ee2c5322537d19691f5a485828

SHA512
8a1820ea884a9aa0fc342656a94500bda3e6d9ec93d01f128d30db50c4727880569c83833b779cda9a61327ebd7122b6fb5c84db17e4fa3ab3938b21e69c0d7e

Download Submit
/var/spool/exim4/input/hdr.927

Filesize
915B

MD5
b74ccd51a3e3f09b52c51151f66e0c3e

SHA1
587f2ed490b37e30e6be2f7c0183a613ff45f64e

SHA256
faa6e4c717875345bcef1b62660c0a40727746aca1c76ac97bf6957f4316f18c

SHA512
ed70bae953dc65286cc7ffebeb3aad374c8b12aa7563f433fe5510b0e15e9fc3791c23a48fad5933da48d88dea2b36f2b0da0aefadef4f3cd8f48f169e4f4ba2

Download Submit
/var/spool/exim4/msglog/1t3OU0-0000Eu-FA

Filesize
89B

MD5
6ee1d9c234b27722d1f57536340cd159

SHA1
c2490c549005315e310cba4a204ce175dffa814c

SHA256
61ee07be33b5f3562af6d9382c2091ba55a09fbe0df504319fd64e92f9e4ccd9

SHA512
705e76490188802c1714f61612abb58b2ce4e299f9aee871f66d70745b364416328cf7f034329b0aa25913244e9dbb3fe8233014449911dc0c32ab566642f782

Download Submit
/var/spool/exim4/msglog/1t3OU0-0000Eu-FA

Filesize
288B

MD5
1136e17e926e6d2dda16fb1dbfa39456

SHA1
90204c18e8cebc39544084069a92c963cfd98ae9

SHA256
4f9999b6298e42f1abc2226b0d017857841e2accc9f9f9aa940cf06287069e45

SHA512
86cd5ba22a6f5dab7df7438004cb25e3413d55ca5472740477f054fc67e31dced2088bdb4599816f88b39c6859dac5d1b35b3a5ec217a5dc68bfae825bce1c9c

Download Submit
/var/spool/exim4/msglog/1t3OU0-0000Ex-FD

Filesize
89B

MD5
6770fb6e179db92f5134e1f7f8432185

SHA1
e374d0b7f4c21706ac25e6da90070a6b1894c438

SHA256
597b0e657dcbcadbdcc9eef16df484b621b5f4e2f9e2cf25e319cc4a168e090a

SHA512
aa8331544dd3ed17b7cb9492ec370c39f7be0eb71a8fa87a3f6bf5cc755af31befee9179933167b4e15e22d8225432ad205a4975839de406a0c72cb54beca23f

Download Submit
/var/spool/exim4/msglog/1t3OU0-0000Ex-FD

Filesize
288B

MD5
6aa608b127246f9f4cf20e95c4a794af

SHA1
4c8a098752aa6ee0bd1147451547f4cc0e15d2bf

SHA256
d948bf6c2193e34faa1dcd42cf239c63fdcd5d203a90a45d603f2aa875ca3651

SHA512
f2afea8f8af9418caa0b8d59642814610d9ab72f5aace765cb8e2824d3b882a22481359d236df9643259d624fc337ba738ea5bdc5ab4a7eec9da8a8a6055cde6

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads