Analysis Overview
SHA256
3668b167f5c9083a9738cfc4bd863a07379a5b02ee14f48a10fb1240f3e421a6
Threat Level: Known bad
The file vulcan.x64 was found to be: Known bad.
Malicious Activity Summary
Identified Kaiten Bot
Kaiten family
Writes DNS configuration
Modifies hosts file
Reads CPU attributes
Reads runtime system information
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2021-01-16 14:50
Signatures
Identified Kaiten Bot
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Kaiten family
Analysis: behavioral1
Detonation Overview
Submitted
2021-01-16 14:50
Reported
2021-01-16 14:52
Platform
ubuntu-amd64
Max time kernel
5007s
Max time network
124s
Command Line
Signatures
Modifies hosts file
| Description | Indicator | Process | Target |
| /etc/hosts | /etc/hosts | N/A | N/A |
Writes DNS configuration
| Description | Indicator | Process | Target |
| /etc/resolv.conf | /etc/resolv.conf | N/A | N/A |
Reads CPU attributes
| Description | Indicator | Process | Target |
| /sys/devices/system/cpu/online | /sys/devices/system/cpu/online | /usr/bin/uptime | N/A |
| /sys/devices/system/cpu/online | /sys/devices/system/cpu/online | /usr/bin/w | N/A |
Reads runtime system information
| Description | Indicator | Process | Target |
| /proc/250/cmdline | /proc/250/cmdline | /usr/bin/w | N/A |
| /proc/443/cmdline | /proc/443/cmdline | /usr/bin/w | N/A |
| /proc/167/stat | /proc/167/stat | /usr/bin/w | N/A |
| /proc/237/cmdline | /proc/237/cmdline | /usr/bin/w | N/A |
| /proc/477/cmdline | /proc/477/cmdline | /usr/bin/w | N/A |
| /proc/700/stat | /proc/700/stat | /usr/bin/w | N/A |
| /proc/uptime | /proc/uptime | /usr/bin/w | N/A |
| /proc/9/cmdline | /proc/9/cmdline | /usr/bin/w | N/A |
| /proc/33/cmdline | /proc/33/cmdline | /usr/bin/w | N/A |
| /proc/151/cmdline | /proc/151/cmdline | /usr/bin/w | N/A |
| /proc/153/stat | /proc/153/stat | /usr/bin/w | N/A |
| /proc/160/cmdline | /proc/160/cmdline | /usr/bin/w | N/A |
| /proc/250/stat | /proc/250/stat | /usr/bin/w | N/A |
| /proc/561/cmdline | /proc/561/cmdline | /usr/bin/w | N/A |
| /proc/3/cmdline | /proc/3/cmdline | /usr/bin/w | N/A |
| /proc/5/cmdline | /proc/5/cmdline | /usr/bin/w | N/A |
| /proc/81/stat | /proc/81/stat | /usr/bin/w | N/A |
| /proc/479/cmdline | /proc/479/cmdline | /usr/bin/w | N/A |
| /proc/8/stat | /proc/8/stat | /usr/bin/w | N/A |
| /proc/19/cmdline | /proc/19/cmdline | /usr/bin/w | N/A |
| /proc/97/stat | /proc/97/stat | /usr/bin/w | N/A |
| /proc/169/cmdline | /proc/169/cmdline | /usr/bin/w | N/A |
| /proc/4/cmdline | /proc/4/cmdline | /usr/bin/w | N/A |
| /proc/13/cmdline | /proc/13/cmdline | /usr/bin/w | N/A |
| /proc/162/cmdline | /proc/162/cmdline | /usr/bin/w | N/A |
| /proc/163/cmdline | /proc/163/cmdline | /usr/bin/w | N/A |
| /proc/166/stat | /proc/166/stat | /usr/bin/w | N/A |
| /proc/300/cmdline | /proc/300/cmdline | /usr/bin/w | N/A |
| /proc/699/stat | /proc/699/stat | /usr/bin/w | N/A |
| /proc/22/stat | /proc/22/stat | /usr/bin/w | N/A |
| /proc/158/cmdline | /proc/158/cmdline | /usr/bin/w | N/A |
| /proc/77/stat | /proc/77/stat | /usr/bin/w | N/A |
| /proc/164/stat | /proc/164/stat | /usr/bin/w | N/A |
| /proc/302/stat | /proc/302/stat | /usr/bin/w | N/A |
| /proc/416/cmdline | /proc/416/cmdline | /usr/bin/w | N/A |
| /proc/443/stat | /proc/443/stat | /usr/bin/w | N/A |
| /proc/564/stat | /proc/564/stat | /usr/bin/w | N/A |
| /proc/11/stat | /proc/11/stat | /usr/bin/w | N/A |
| /proc/19/stat | /proc/19/stat | /usr/bin/w | N/A |
| /proc/563/cmdline | /proc/563/cmdline | /usr/bin/w | N/A |
| /proc/21/cmdline | /proc/21/cmdline | /usr/bin/w | N/A |
| /proc/387/cmdline | /proc/387/cmdline | /usr/bin/w | N/A |
| /proc/161/stat | /proc/161/stat | /usr/bin/w | N/A |
| /proc/191/cmdline | /proc/191/cmdline | /usr/bin/w | N/A |
| /proc/1/stat | /proc/1/stat | /usr/bin/w | N/A |
| /proc/24/stat | /proc/24/stat | /usr/bin/w | N/A |
| /proc/359/cmdline | /proc/359/cmdline | /usr/bin/w | N/A |
| /proc/369/cmdline | /proc/369/cmdline | /usr/bin/w | N/A |
| /proc/447/cmdline | /proc/447/cmdline | /usr/bin/w | N/A |
| /proc/34/stat | /proc/34/stat | /usr/bin/w | N/A |
| /proc/161/cmdline | /proc/161/cmdline | /usr/bin/w | N/A |
| /proc/23/stat | /proc/23/stat | /usr/bin/w | N/A |
| /proc/29/stat | /proc/29/stat | /usr/bin/w | N/A |
| /proc/30/cmdline | /proc/30/cmdline | /usr/bin/w | N/A |
| /proc/31/stat | /proc/31/stat | /usr/bin/w | N/A |
| /proc/31/cmdline | /proc/31/cmdline | /usr/bin/w | N/A |
| /proc/78/stat | /proc/78/stat | /usr/bin/w | N/A |
| /proc/13/stat | /proc/13/stat | /usr/bin/w | N/A |
| /proc/21/stat | /proc/21/stat | /usr/bin/w | N/A |
| /proc/387/stat | /proc/387/stat | /usr/bin/w | N/A |
| /proc/479/stat | /proc/479/stat | /usr/bin/w | N/A |
| /proc/82/stat | /proc/82/stat | /usr/bin/w | N/A |
| /proc/97/cmdline | /proc/97/cmdline | /usr/bin/w | N/A |
| /proc/154/stat | /proc/154/stat | /usr/bin/w | N/A |
| /proc/158/stat | /proc/158/stat | /usr/bin/w | N/A |
| /proc/169/stat | /proc/169/stat | /usr/bin/w | N/A |
| /proc/300/stat | /proc/300/stat | /usr/bin/w | N/A |
| /proc/27/stat | /proc/27/stat | /usr/bin/w | N/A |
| /proc/29/cmdline | /proc/29/cmdline | /usr/bin/w | N/A |
| /proc/79/cmdline | /proc/79/cmdline | /usr/bin/w | N/A |
| /proc/159/cmdline | /proc/159/cmdline | /usr/bin/w | N/A |
| /proc/162/stat | /proc/162/stat | /usr/bin/w | N/A |
| /proc/249/cmdline | /proc/249/cmdline | /usr/bin/w | N/A |
| /proc/14/stat | /proc/14/stat | /usr/bin/w | N/A |
| /proc/28/stat | /proc/28/stat | /usr/bin/w | N/A |
| /proc/28/cmdline | /proc/28/cmdline | /usr/bin/w | N/A |
| /proc/151/stat | /proc/151/stat | /usr/bin/w | N/A |
| /proc/370/cmdline | /proc/370/cmdline | /usr/bin/w | N/A |
| /proc/701/stat | /proc/701/stat | /usr/bin/w | N/A |
| /proc/8/cmdline | /proc/8/cmdline | /usr/bin/w | N/A |
| /proc/25/cmdline | /proc/25/cmdline | /usr/bin/w | N/A |
| /proc/83/stat | /proc/83/stat | /usr/bin/w | N/A |
| /proc/165/stat | /proc/165/stat | /usr/bin/w | N/A |
| /proc/344/cmdline | /proc/344/cmdline | /usr/bin/w | N/A |
| /proc/416/stat | /proc/416/stat | /usr/bin/w | N/A |
| /proc/12/stat | /proc/12/stat | /usr/bin/w | N/A |
| /proc/79/stat | /proc/79/stat | /usr/bin/w | N/A |
| /proc/18/stat | /proc/18/stat | /usr/bin/w | N/A |
| /proc/18/cmdline | /proc/18/cmdline | /usr/bin/w | N/A |
| /proc/32/stat | /proc/32/stat | /usr/bin/w | N/A |
| /proc/34/cmdline | /proc/34/cmdline | /usr/bin/w | N/A |
| /proc/83/cmdline | /proc/83/cmdline | /usr/bin/w | N/A |
| /proc/114/stat | /proc/114/stat | /usr/bin/w | N/A |
| /proc/6/cmdline | /proc/6/cmdline | /usr/bin/w | N/A |
| /proc/17/stat | /proc/17/stat | /usr/bin/w | N/A |
| /proc/166/cmdline | /proc/166/cmdline | /usr/bin/w | N/A |
| /proc/349/cmdline | /proc/349/cmdline | /usr/bin/w | N/A |
| /proc/24/cmdline | /proc/24/cmdline | /usr/bin/w | N/A |
| /proc/152/stat | /proc/152/stat | /usr/bin/w | N/A |
| /proc/160/stat | /proc/160/stat | /usr/bin/w | N/A |
| /proc/191/stat | /proc/191/stat | /usr/bin/w | N/A |
| /proc/563/stat | /proc/563/stat | /usr/bin/w | N/A |
| /proc/10/cmdline | /proc/10/cmdline | /usr/bin/w | N/A |
| /proc/15/stat | /proc/15/stat | /usr/bin/w | N/A |
| /proc/114/cmdline | /proc/114/cmdline | /usr/bin/w | N/A |
| /proc/157/cmdline | /proc/157/cmdline | /usr/bin/w | N/A |
| /proc/343/cmdline | /proc/343/cmdline | /usr/bin/w | N/A |
| /proc/369/stat | /proc/369/stat | /usr/bin/w | N/A |
| /proc/loadavg | /proc/loadavg | /usr/bin/w | N/A |
| /proc/82/cmdline | /proc/82/cmdline | /usr/bin/w | N/A |
| /proc/84/cmdline | /proc/84/cmdline | /usr/bin/w | N/A |
| /proc/9/stat | /proc/9/stat | /usr/bin/w | N/A |
| /proc/23/cmdline | /proc/23/cmdline | /usr/bin/w | N/A |
| /proc/32/cmdline | /proc/32/cmdline | /usr/bin/w | N/A |
| /proc/35/cmdline | /proc/35/cmdline | /usr/bin/w | N/A |
| /proc/80/cmdline | /proc/80/cmdline | /usr/bin/w | N/A |
| /proc/302/cmdline | /proc/302/cmdline | /usr/bin/w | N/A |
| /proc/7/stat | /proc/7/stat | /usr/bin/w | N/A |
| /proc/14/cmdline | /proc/14/cmdline | /usr/bin/w | N/A |
| /proc/237/stat | /proc/237/stat | /usr/bin/w | N/A |
| /proc/345/stat | /proc/345/stat | /usr/bin/w | N/A |
| /proc/447/stat | /proc/447/stat | /usr/bin/w | N/A |
| /proc/20/stat | /proc/20/stat | /usr/bin/w | N/A |
| /proc/155/stat | /proc/155/stat | /usr/bin/w | N/A |
| /proc/26/cmdline | /proc/26/cmdline | /usr/bin/w | N/A |
| /proc/27/cmdline | /proc/27/cmdline | /usr/bin/w | N/A |
| /proc/163/stat | /proc/163/stat | /usr/bin/w | N/A |
| /proc/164/cmdline | /proc/164/cmdline | /usr/bin/w | N/A |
| /proc/190/stat | /proc/190/stat | /usr/bin/w | N/A |
| /proc/5/stat | /proc/5/stat | /usr/bin/w | N/A |
| /proc/17/cmdline | /proc/17/cmdline | /usr/bin/w | N/A |
| /proc/16/stat | /proc/16/stat | /usr/bin/w | N/A |
| /proc/20/cmdline | /proc/20/cmdline | /usr/bin/w | N/A |
| /proc/22/cmdline | /proc/22/cmdline | /usr/bin/w | N/A |
| /proc/26/stat | /proc/26/stat | /usr/bin/w | N/A |
| /proc/157/stat | /proc/157/stat | /usr/bin/w | N/A |
| /proc/344/stat | /proc/344/stat | /usr/bin/w | N/A |
| /proc/2/cmdline | /proc/2/cmdline | /usr/bin/w | N/A |
| /proc/12/cmdline | /proc/12/cmdline | /usr/bin/w | N/A |
| /proc/352/stat | /proc/352/stat | /usr/bin/w | N/A |
| /proc/701/cmdline | /proc/701/cmdline | /usr/bin/w | N/A |
| /proc/165/cmdline | /proc/165/cmdline | /usr/bin/w | N/A |
| /proc/249/stat | /proc/249/stat | /usr/bin/w | N/A |
| /proc/167/cmdline | /proc/167/cmdline | /usr/bin/w | N/A |
| /proc/343/stat | /proc/343/stat | /usr/bin/w | N/A |
| /proc/349/stat | /proc/349/stat | /usr/bin/w | N/A |
| /proc/561/stat | /proc/561/stat | /usr/bin/w | N/A |
| /proc/700/cmdline | /proc/700/cmdline | /usr/bin/w | N/A |
| /proc/25/stat | /proc/25/stat | /usr/bin/w | N/A |
| /proc/88/cmdline | /proc/88/cmdline | /usr/bin/w | N/A |
| /proc/88/stat | /proc/88/stat | /usr/bin/w | N/A |
| /proc/345/cmdline | /proc/345/cmdline | /usr/bin/w | N/A |
| /proc/699/cmdline | /proc/699/cmdline | /usr/bin/w | N/A |
| /proc/11/cmdline | /proc/11/cmdline | /usr/bin/w | N/A |
| /proc/35/stat | /proc/35/stat | /usr/bin/w | N/A |
| /proc/84/stat | /proc/84/stat | /usr/bin/w | N/A |
| /proc/154/cmdline | /proc/154/cmdline | /usr/bin/w | N/A |
| /proc/156/cmdline | /proc/156/cmdline | /usr/bin/w | N/A |
| /proc/7/cmdline | /proc/7/cmdline | /usr/bin/w | N/A |
| /proc/16/cmdline | /proc/16/cmdline | /usr/bin/w | N/A |
| /proc/30/stat | /proc/30/stat | /usr/bin/w | N/A |
| /proc/78/cmdline | /proc/78/cmdline | /usr/bin/w | N/A |
| /proc/80/stat | /proc/80/stat | /usr/bin/w | N/A |
| /proc/153/cmdline | /proc/153/cmdline | /usr/bin/w | N/A |
| /proc/155/cmdline | /proc/155/cmdline | /usr/bin/w | N/A |
| /proc/359/stat | /proc/359/stat | /usr/bin/w | N/A |
| /proc/loadavg | /proc/loadavg | /usr/bin/uptime | N/A |
| /proc/2/stat | /proc/2/stat | /usr/bin/w | N/A |
| /proc/370/stat | /proc/370/stat | /usr/bin/w | N/A |
| /proc/3/stat | /proc/3/stat | /usr/bin/w | N/A |
| /proc/4/stat | /proc/4/stat | /usr/bin/w | N/A |
| /proc/6/stat | /proc/6/stat | /usr/bin/w | N/A |
| /proc/15/cmdline | /proc/15/cmdline | /usr/bin/w | N/A |
| /proc/33/stat | /proc/33/stat | /usr/bin/w | N/A |
| /proc/152/cmdline | /proc/152/cmdline | /usr/bin/w | N/A |
| /proc/sys/kernel/osrelease | /proc/sys/kernel/osrelease | /usr/bin/uptime | N/A |
| /proc/sys/kernel/osrelease | /proc/sys/kernel/osrelease | /usr/bin/w | N/A |
| /proc/77/cmdline | /proc/77/cmdline | /usr/bin/w | N/A |
| /proc/81/cmdline | /proc/81/cmdline | /usr/bin/w | N/A |
| /proc/156/stat | /proc/156/stat | /usr/bin/w | N/A |
| /proc/477/stat | /proc/477/stat | /usr/bin/w | N/A |
| /proc/uptime | /proc/uptime | /usr/bin/uptime | N/A |
| /proc/10/stat | /proc/10/stat | /usr/bin/w | N/A |
| /proc/190/cmdline | /proc/190/cmdline | /usr/bin/w | N/A |
| /proc/352/cmdline | /proc/352/cmdline | /usr/bin/w | N/A |
| /proc/564/cmdline | /proc/564/cmdline | /usr/bin/w | N/A |
| /proc/1/cmdline | /proc/1/cmdline | /usr/bin/w | N/A |
| /proc/159/stat | /proc/159/stat | /usr/bin/w | N/A |
Processes
./vulcan.x64
[./vulcan.x64]
/bin/sh
[sh -c export PATH=/bin:/sbin:/usr/bin:/usr/local/bin:/usr/sbin;uname -a;uptime]
/bin/uname
[uname -a]
/usr/bin/uptime
[uptime]
/bin/sh
[sh -c export PATH=/bin:/sbin:/usr/bin:/usr/local/bin:/usr/sbin;w]
/usr/bin/w
[w]
Network
| Country | Destination | Domain | Proto |
| N/A | 1.1.1.1:53 | irc.n3twork30cm.ml | udp |
| N/A | 31.31.72.123:4445 | irc.n3twork30cm.ml | tcp |
| N/A | 1.1.1.1:53 | ntp.ubuntu.com | udp |
| N/A | 1.1.1.1:53 | ntp.ubuntu.com | udp |
| N/A | 91.189.94.4:123 | ntp.ubuntu.com | udp |
| N/A | 91.189.94.4:123 | ntp.ubuntu.com | udp |
| N/A | 91.189.94.4:123 | ntp.ubuntu.com | udp |