kaiten | a64ddaa1e3747b10863af3b60e79bbef1295a71ffdf3dd15a390d5926a6c3c13

Analysis

max time kernel
21s
max time network
24s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
12/02/2025, 23:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

irq0
Size

605KB
MD5

8d4a6b005fe1b8b6ab08ac9501a13110
SHA1

ac3449f4ff85338a4cc99581070f358fb30ce1a1
SHA256

a64ddaa1e3747b10863af3b60e79bbef1295a71ffdf3dd15a390d5926a6c3c13
SHA512

7214699e67d101a6fb15e9a7571de1541480818bd399a6e26d018dd22ba33e8d8ebc42c2e7ba62b5268e595658eb57a7be744dee790cbeff71b7f18f9704bb84
SSDEEP

12288:To2aovPAC2u24h68Qugl3qCiJ7o6xt95DujbUjWWkGHnon3MYNBEEx9IRXa:8IvPAC2utTQug7iJ7oOtO3UjLkConLfx

Score

10^/10

kaiten botnet defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Detects Kaiten/Tsunami Payload 1 IoCs

resource	yara_rule
behavioral1/memory/649-1-0x00010000-0x00170b4c-memory.dmp	family_kaiten2

Kaiten family
kaiten
Kaiten/Tsunami
Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.
botnet kaiten

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.9NTVMJ	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Indicator Removal: Timestomp 1 TTPs 4 IoCs

Adversaries may remove indicators of compromise from the host to evade detection.

defense_evasion

Timestomp

T1070.006

pid	Process
655	sh
657	touch
692	sh
693	touch

Enumerates kernel/hardware configuration 1 TTPs 45 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/167/stat	killall
File opened for reading	/proc/805/stat	killall
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/140/stat	killall
File opened for reading	/proc/186/stat	killall
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/152/stat	killall
File opened for reading	/proc/42/stat	killall
File opened for reading	/proc/23/stat	killall
File opened for reading	/proc/648/stat	killall
File opened for reading	/proc/646/stat	killall
File opened for reading	/proc/787/stat	killall
File opened for reading	/proc/141/cmdline	killall
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/598/stat	killall
File opened for reading	/proc/16/stat	killall
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/601/stat	killall
File opened for reading	/proc/310/stat	killall
File opened for reading	/proc/41/stat	killall
File opened for reading	/proc/694/stat	killall
File opened for reading	/proc/27/stat	killall
File opened for reading	/proc/213/stat	killall
File opened for reading	/proc/110/cmdline	killall
File opened for reading	/proc/152/stat	killall
File opened for reading	/proc/641/stat	killall
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/6/stat	killall
File opened for reading	/proc/42/stat	killall
File opened for reading	/proc/284/stat	killall
File opened for reading	/proc/646/stat	killall
File opened for reading	/proc/2/stat	killall
File opened for reading	/proc/10/stat	killall
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/805/stat	killall
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/110/cmdline	killall
File opened for reading	/proc/808/stat	killall
File opened for reading	/proc/110/cmdline	killall
File opened for reading	/proc/641/stat	killall
File opened for reading	/proc/648/stat	killall
File opened for reading	/proc/322/stat	killall
File opened for reading	/proc/4/stat	killall
File opened for reading	/proc/651/stat	killall
File opened for reading	/proc/581/stat	killall
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/594/stat	killall
File opened for reading	/proc/139/stat	killall
File opened for reading	/proc/9/stat	killall
File opened for reading	/proc/42/stat	killall
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/11/stat	killall
File opened for reading	/proc/22/stat	killall
File opened for reading	/proc/598/stat	killall
File opened for reading	/proc/803/stat	killall

/tmp/irq0
/tmp/irq0
1⤵
PID:649
- /bin/sh
  sh -c "touch -acmr /bin/ls /tmp/irq0"
  2⤵
  - Indicator Removal: Timestomp
  PID:655
- - /usr/bin/touch
    touch -acmr /bin/ls /tmp/irq0
    3⤵
    - Indicator Removal: Timestomp
    PID:657
- /bin/sh
  sh -c "(crontab -l | grep -v \"/tmp/irq0\" | grep -v \"no cron\" | grep -v \"lesshts/run.sh\" > /var/run/.x00740882966) > /dev/null 2>&1"
  2⤵
  PID:659
- - /bin/grep
    grep -v /tmp/irq0
    3⤵
    PID:663
- - /bin/grep
    grep -v "no cron"
    3⤵
    PID:664
- - /usr/bin/crontab
    crontab -l
    3⤵
    PID:662
- - /bin/grep
    grep -v lesshts/run.sh
    3⤵
    PID:665
- /bin/sh
  sh -c "echo \"* * * * * /tmp/irq0 > /dev/null 2>&1 &\" >> /var/run/.x00740882966"
  2⤵
  PID:668
- /bin/sh
  sh -c "crontab /var/run/.x00740882966"
  2⤵
  PID:670
- - /usr/bin/crontab
    crontab /var/run/.x00740882966
    3⤵
    - Creates/modifies Cron job
    PID:672
- /bin/sh
  sh -c "rm -rf /var/run/.x00740882966"
  2⤵
  PID:677
- - /bin/rm
    rm -rf /var/run/.x00740882966
    3⤵
    PID:679
- /bin/sh
  sh -c "cat /etc/inittab | grep -v \"/tmp/irq0\" > /etc/inittab2"
  2⤵
  PID:681
- - /bin/cat
    cat /etc/inittab
    3⤵
    PID:683
- - /bin/grep
    grep -v /tmp/irq0
    3⤵
    PID:684
- /bin/sh
  sh -c "echo \"0:2345:respawn:/tmp/irq0\" >> /etc/inittab2"
  2⤵
  PID:685
- /bin/sh
  sh -c "cat /etc/inittab2 > /etc/inittab"
  2⤵
  PID:686
- - /bin/cat
    cat /etc/inittab2
    3⤵
    PID:688
- /bin/sh
  sh -c "rm -rf /etc/inittab2"
  2⤵
  PID:689
- - /bin/rm
    rm -rf /etc/inittab2
    3⤵
    PID:691
- /bin/sh
  sh -c "touch -acmr /bin/ls /etc/inittab"
  2⤵
  - Indicator Removal: Timestomp
  PID:692
- - /usr/bin/touch
    touch -acmr /bin/ls /etc/inittab
    3⤵
    - Indicator Removal: Timestomp
    PID:693
- /bin/sh
  sh -c "/bin/uname -n"
  2⤵
  PID:696
- - /bin/uname
    /bin/uname -n
    3⤵
    PID:698
- /bin/sh
  sh -c "/bin/uname -n"
  2⤵
  PID:700
- - /bin/uname
    /bin/uname -n
    3⤵
    PID:702
- /bin/sh
  sh -c "/bin/uname -n"
  2⤵
  PID:703
- - /bin/uname
    /bin/uname -n
    3⤵
    PID:704
- /bin/sh
  sh -c "kill -9 `cat /var/run/httpd.pid` > /dev/null 2>&1 &"
  2⤵
  PID:783
- - /bin/cat
    cat /var/run/httpd.pid
    3⤵
    PID:786
- /bin/sh
  sh -c "service httpd stop > /dev/null 2>&1 &"
  2⤵
  PID:785
- /bin/sh
  sh -c "killall -9 mini_httpd > /dev/null 2>&1 &"
  2⤵
  PID:788
- /bin/sh
  sh -c "killall -9 minihttpd > /dev/null 2>&1 &"
  2⤵
  PID:791
- /bin/sh
  sh -c "kill -9 `cat /var/run/thttpd.pid` > /dev/null 2>&1 &"
  2⤵
  PID:793
- - /bin/cat
    cat /var/run/thttpd.pid
    3⤵
    PID:797
- /bin/sh
  sh -c "nvram set httpd_enable=0 > /dev/null 2>&1"
  2⤵
  PID:796
- /bin/sh
  sh -c "nvram set http_enable=0 > /dev/null 2>&1"
  2⤵
  PID:798
- /bin/sh
  sh -c "killall -9 httpd > /dev/null 2>&1 &"
  2⤵
  PID:800
- /bin/sh
  sh -c "service telnetd stop > /dev/null 2>&1 &"
  2⤵
  PID:802
- /bin/sh
  sh -c "service sshd stop > /dev/null 2>&1 &"
  2⤵
  PID:804
- /bin/sh
  sh -c "killall -9 telnetd > /dev/null 2>&1 &"
  2⤵
  PID:809
- /bin/sh
  sh -c "killall -9 utelnetd > /dev/null 2>&1 &"
  2⤵
  PID:812
- /bin/sh
  sh -c "killall -9 dropbear > /dev/null 2>&1 &"
  2⤵
  PID:814
- /bin/sh
  sh -c "killall -9 sshd > /dev/null 2>&1 &"
  2⤵
  PID:818
- /bin/sh
  sh -c "killall -9 lighttpd > /dev/null 2>&1 &"
  2⤵
  PID:822

/usr/sbin/service
service httpd stop
1⤵
PID:787
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:789
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:794
- /bin/systemctl
  systemctl --quiet is-active multi-user.target
  2⤵
  - Enumerates kernel/hardware configuration
  PID:799
- /bin/systemctl
  systemctl list-unit-files --full "--type=socket"
  2⤵
  - Enumerates kernel/hardware configuration
  PID:806
- /bin/sed
  sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
  2⤵
  PID:807
- /bin/systemctl
  systemctl -p Triggers show dbus.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:825
- /bin/systemctl
  systemctl -p Triggers show ssh.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:834
- /bin/systemctl
  systemctl -p Triggers show syslog.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:840
- /bin/systemctl
  systemctl -p Triggers show systemd-fsckd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:846
- /bin/systemctl
  systemctl -p Triggers show systemd-initctl.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:849
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-audit.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:851
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-dev-log.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:854
- /bin/systemctl
  systemctl -p Triggers show systemd-journald.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:857
- /bin/systemctl
  systemctl -p Triggers show systemd-networkd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:860
- /bin/systemctl
  systemctl -p Triggers show systemd-rfkill.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:863
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-control.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:866
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-kernel.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:870

/usr/bin/killall
killall -9 mini_httpd
1⤵
- Reads runtime system information
PID:790

/usr/bin/killall
killall -9 minihttpd
1⤵
- Reads runtime system information
PID:792

/usr/bin/killall
killall -9 httpd
1⤵
- Reads runtime system information
PID:801

/usr/sbin/service
service telnetd stop
1⤵
PID:803
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:810
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:816
- /bin/systemctl
  systemctl --quiet is-active multi-user.target
  2⤵
  - Enumerates kernel/hardware configuration
  PID:820
- /bin/systemctl
  systemctl list-unit-files --full "--type=socket"
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:829
- /bin/sed
  sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
  2⤵
  PID:830
- /bin/systemctl
  systemctl -p Triggers show dbus.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:838
- /bin/systemctl
  systemctl -p Triggers show ssh.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:841
- /bin/systemctl
  systemctl -p Triggers show syslog.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:845
- /bin/systemctl
  systemctl -p Triggers show systemd-fsckd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:848
- /bin/systemctl
  systemctl -p Triggers show systemd-initctl.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:852
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-audit.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:855
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-dev-log.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:858
- /bin/systemctl
  systemctl -p Triggers show systemd-journald.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:861
- /bin/systemctl
  systemctl -p Triggers show systemd-networkd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:864
- /bin/systemctl
  systemctl -p Triggers show systemd-rfkill.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:867
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-control.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:868
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-kernel.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:871

/usr/sbin/service
service sshd stop
1⤵
PID:808
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:815
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:819
- /bin/systemctl
  systemctl --quiet is-active multi-user.target
  2⤵
  - Enumerates kernel/hardware configuration
  PID:823
- /bin/sed
  sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
  2⤵
  PID:833
- /bin/systemctl
  systemctl list-unit-files --full "--type=socket"
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:832
- /bin/systemctl
  systemctl -p Triggers show dbus.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:839
- /bin/systemctl
  systemctl -p Triggers show ssh.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:844
- /bin/systemctl
  systemctl -p Triggers show syslog.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:847
- /bin/systemctl
  systemctl -p Triggers show systemd-fsckd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:850
- /bin/systemctl
  systemctl -p Triggers show systemd-initctl.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:853
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-audit.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:856
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-dev-log.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:859
- /bin/systemctl
  systemctl -p Triggers show systemd-journald.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:862
- /bin/systemctl
  systemctl -p Triggers show systemd-networkd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:865
- /bin/systemctl
  systemctl -p Triggers show systemd-rfkill.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:869
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-control.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:872
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-kernel.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:873

/usr/bin/killall
killall -9 telnetd
1⤵
- Reads runtime system information
PID:811

/usr/bin/killall
killall -9 utelnetd
1⤵
- Reads runtime system information
PID:813

/usr/bin/killall
killall -9 dropbear
1⤵
- Reads runtime system information
PID:817

/usr/bin/killall
killall -9 sshd
1⤵
- Reads runtime system information
PID:821

/usr/bin/killall
killall -9 lighttpd
1⤵
- Reads runtime system information
PID:824

/usr/local/sbin/systemctl
systemctl stop httpd.service
1⤵
PID:787

/usr/local/bin/systemctl
systemctl stop httpd.service
1⤵
PID:787

/usr/sbin/systemctl
systemctl stop httpd.service
1⤵
PID:787

/usr/bin/systemctl
systemctl stop httpd.service
1⤵
PID:787

/sbin/systemctl
systemctl stop httpd.service
1⤵
PID:787

/bin/systemctl
systemctl stop httpd.service
1⤵
- Enumerates kernel/hardware configuration
PID:787

/usr/local/sbin/systemctl
systemctl stop telnetd.service
1⤵
PID:803

/usr/local/bin/systemctl
systemctl stop telnetd.service
1⤵
PID:803

/usr/sbin/systemctl
systemctl stop telnetd.service
1⤵
PID:803

/usr/bin/systemctl
systemctl stop telnetd.service
1⤵
PID:803

/sbin/systemctl
systemctl stop telnetd.service
1⤵
PID:803

/bin/systemctl
systemctl stop telnetd.service
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:803

/usr/local/sbin/systemctl
systemctl stop sshd.service
1⤵
PID:808

/usr/local/bin/systemctl
systemctl stop sshd.service
1⤵
PID:808

/usr/sbin/systemctl
systemctl stop sshd.service
1⤵
PID:808

/usr/bin/systemctl
systemctl stop sshd.service
1⤵
PID:808

/sbin/systemctl
systemctl stop sshd.service
1⤵
PID:808

/bin/systemctl
systemctl stop sshd.service
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Indicator Removal

T1070

Timestomp

T1070.006

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/inittab2

Filesize
25B

MD5
e9b814d4e5b86c25d1c358084e248b06

SHA1
411fb7a5523a86fb463a787860ed2e24b71bb322

SHA256
64a4e363c0277a89bf1c1c7e208ef7a691a3539727eea024c4a5e2f678656b95

SHA512
a9540c700f392f8cc192bc097def17d0373a8fe8d52516f814cb7431b06b47c9ac338ce035d782c83d5c7db8bbef9fcf29487a81a0abecd25b3d3c5933a1fa04

Download Submit
/run/.x00740882966

Filesize
39B

MD5
50a4c4e1488834681534ce3efdb9068e

SHA1
9b54a359fda088ff5424694230b2bfb5e2807f13

SHA256
e5edae720d7e5448a5d1e2fabc204cf8d90c16dcaea0e239afea7431c9de57ae

SHA512
6fb7cf90e78d864e8a0ca7c6b5bb19a5bcef0f99d799f2d617e1a0afce869bc6f07e531ac971ce3ecf2d9864fc5dcddc3962b0bc8a29f8b253cf4f5dbf0ce27d

Download Submit
/var/spool/cron/crontabs/tmp.9NTVMJ

Filesize
235B

MD5
5f451c8285c877e19608ed692a269a5c

SHA1
a8bc28185ec0f73cb8eb696e90253581bf28e7d4

SHA256
e5f7fb4f87795245e934ba7d7f3ecf8295f111b494132af0af6adbb26f7b5051

SHA512
ce229147b03cc55b3e5c7dad5ab410a5292dcefa6e97a57831b3277ceb813e60e84a2b6ef12b73b9fcd812c9c47f4d34bf1dfcfb60ef63c4d6bb813189fa39b0

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads