Overview

overview

10

Static

static

1

irq2

debian-12-mipsel

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    irq2
  • Size 515KB
  • Sample241027-ntldjsvlfm
  • SHA256 8e9cd77c31ba14b925208fa5e3d9f5675909f0a5ebc2399bdd9e36279314abd1
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
kaitenbotnetdefense_evasiondiscoveryexecutionpersistenceprivilege_escalatio

Malware Config

Targets

    • Target
      irq2
    • Size 515KB
    • SHA256 8e9cd77c31ba14b925208fa5e3d9f5675909f0a5ebc2399bdd9e36279314abd1
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    kaitenbotnetdefense_evasiondiscoveryexecutionpersistenceprivilege_escalatio

    • Detects Kaiten/Tsunami Payload

    • Kaiten family

      kaiten

    • Kaiten/Tsunami

      Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.

      botnetkaiten

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

      executionpersistenceprivilege_escalatio

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Indicator Removal: Timestomp

      Adversaries may remove indicators of compromise from the host to evade detection.

      defense_evasion
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks