kaiten | b8e0d51884523ed4a8e79246faafff4a8c2f4070bec0cd9e526be36d9b0d4c0d | Triage

Sharing

General

Target

121719543d8d5e1dda976200c619f82d
Size

576KB
Sample

231219-2gb61ahchk
MD5

121719543d8d5e1dda976200c619f82d
SHA1

ebdbdda19e76931a2f6154da160d1a6b597533e0
SHA256

b8e0d51884523ed4a8e79246faafff4a8c2f4070bec0cd9e526be36d9b0d4c0d
SHA512

81135dce29498d56c5110759a9712316af25e4992a9ce33ff2b86637aa011f50e231a9ac4fa146dab113ac011851c799a493909f263abb26467687436b2e11ec
SSDEEP

12288:gl7H+P4WdRE8+GEWQTQfeiUklkFeXfSYbMa9vJesJeGtq0iVv0Eun5PxLO:Y7H+gWEThEUklk8tbMatgWpCVv0EL

Score

10^/10

kaiten botnet persistence

Malware Config

Targets

- Target
  
  121719543d8d5e1dda976200c619f82d
- Size
  
  576KB
- MD5
  
  121719543d8d5e1dda976200c619f82d
- SHA1
  
  ebdbdda19e76931a2f6154da160d1a6b597533e0
- SHA256
  
  b8e0d51884523ed4a8e79246faafff4a8c2f4070bec0cd9e526be36d9b0d4c0d
- SHA512
  
  81135dce29498d56c5110759a9712316af25e4992a9ce33ff2b86637aa011f50e231a9ac4fa146dab113ac011851c799a493909f263abb26467687436b2e11ec
- SSDEEP
  
  12288:gl7H+P4WdRE8+GEWQTQfeiUklkFeXfSYbMa9vJesJeGtq0iVv0Eun5PxLO:Y7H+gWEThEUklk8tbMatgWpCVv0EL
Score

10^/10

kaiten botnet persistence
- Detects Kaiten/Tsunami Payload
- Kaiten/Tsunami
  Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.
  botnet kaiten
- Creates/modifies Cron job
  Cron allows running tasks on a schedule, and is commonly used for malware persistence.
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

kaitenbotnetpersistence