kaiten | 9d5036d204e6598fd4c4ac93688c9acdec3d6a1e4d14018ec16db955f3ee8b24

Analysis

max time kernel
28s
max time network
38s
platform
debian-9_mipsel
resource
debian9-mipsel-20231215-en
resource tags

arch:mipselimage:debian9-mipsel-20231215-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
20/12/2023, 05:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ai.sh
Size

831B
MD5

b1a64a7afeda8fc66076eae49bdb6267
SHA1

0d840e800c0dac1d51f8a243056e94ed385c3a98
SHA256

9d5036d204e6598fd4c4ac93688c9acdec3d6a1e4d14018ec16db955f3ee8b24
SHA512

619c55b6f6d222c8a831a441205b75359976d9d80ba01734640d81b96a32e2b263448e16be8d3dad9afb1c78ebcd717cbc8dbefe134fc593f079a931140c67fa

Score

10^/10

kaiten xmrig botnet miner persistence

Malware Config

Signatures

Detects Kaiten/Tsunami Payload 1 IoCs

resource	yara_rule
behavioral4/files/fstream-6.dat	family_kaiten2

Detects Kaiten/Tsunami payload 1 IoCs

resource	yara_rule
behavioral4/files/fstream-6.dat	family_kaiten

Kaiten/Tsunami
Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.
botnet kaiten

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral4/files/fstream-3.dat	family_xmrig
behavioral4/files/fstream-3.dat	xmrig

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Executes dropped EXE 7 IoCs

ioc	pid	Process
/var/tmp/.22/start	742	start
/var/tmp/.22/hide	744	hide
/var/tmp/.22/create	746	create
/var/tmp/.22/auto	755	auto
/var/tmp/.22/init	758	init
/var/tmp/.22/mining	762	mining
/var/tmp/.22/init	764	init

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

persistence

Scheduled Task/Job

T1053

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.RIkBNe	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 2 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/9/status	pkill
File opened for reading	/proc/4/status	ps
File opened for reading	/proc/6/cmdline	ps
File opened for reading	/proc/232/cmdline	ps
File opened for reading	/proc/2/status	pkill
File opened for reading	/proc/8/cmdline	pkill
File opened for reading	/proc/77/status	pkill
File opened for reading	/proc/328/stat	ps
File opened for reading	/proc/582/stat	ps
File opened for reading	/proc/770/status	ps
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/2/cmdline	ps
File opened for reading	/proc/20/cmdline	ps
File opened for reading	/proc/37/status	ps
File opened for reading	/proc/76/status	ps
File opened for reading	/proc/325/stat	ps
File opened for reading	/proc/761/status	pkill
File opened for reading	/proc/19/cmdline	ps
File opened for reading	/proc/695/stat	ps
File opened for reading	/proc/1/cmdline	pkill
File opened for reading	/proc/17/cmdline	pkill
File opened for reading	/proc/23/cmdline	pkill
File opened for reading	/proc/70/status	pkill
File opened for reading	/proc/582/status	pkill
File opened for reading	/proc/544/stat	ps
File opened for reading	/proc/695/cmdline	ps
File opened for reading	/proc/6/status	pkill
File opened for reading	/proc/76/status	pkill
File opened for reading	/proc/232/status	pkill
File opened for reading	/proc/7/stat	ps
File opened for reading	/proc/9/stat	ps
File opened for reading	/proc/762/stat	ps
File opened for reading	/proc/767/status	ps
File opened for reading	/proc/76/cmdline	pkill
File opened for reading	/proc/78/cmdline	pkill
File opened for reading	/proc/400/status	ps
File opened for reading	/proc/77/cmdline	pkill
File opened for reading	/proc/81/cmdline	pkill
File opened for reading	/proc/uptime	ps
File opened for reading	/proc/527/cmdline	ps
File opened for reading	/proc/767/stat	ps
File opened for reading	/proc/700/cmdline	pkill
File opened for reading	/proc/23/status	ps
File opened for reading	/proc/24/status	ps
File opened for reading	/proc/150/stat	ps
File opened for reading	/proc/322/stat	ps
File opened for reading	/proc/527/stat	ps
File opened for reading	/proc/700/stat	ps
File opened for reading	/proc/2/cmdline	pkill
File opened for reading	/proc/150/status	pkill
File opened for reading	/proc/21/cmdline	ps
File opened for reading	/proc/71/cmdline	ps
File opened for reading	/proc/771/cmdline	ps
File opened for reading	/proc/3/cmdline	pkill
File opened for reading	/proc/83/cmdline	pkill
File opened for reading	/proc/320/status	pkill
File opened for reading	/proc/698/status	pkill
File opened for reading	/proc/18/status	ps
File opened for reading	/proc/770/stat	ps
File opened for reading	/proc/71/status	pkill
File opened for reading	/proc/15/cmdline	ps
File opened for reading	/proc/115/cmdline	ps
File opened for reading	/proc/382/cmdline	ps
File opened for reading	/proc/116/status	ps

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sh-thd.6Has9e	ai.sh

/tmp/ai.sh
/tmp/ai.sh
1⤵
- Writes file to tmp directory
PID:711
- /bin/grep
  grep EST
  2⤵
  PID:722
- /bin/grep
  grep 94.241.140.177
  2⤵
  PID:723
- /bin/grep
  grep 80
  2⤵
  PID:726
- /bin/mkdir
  mkdir -p /var/tmp/.22
  2⤵
  PID:729
- /bin/tar
  tar -xf xm.jpg
  2⤵
  PID:737
- - /usr/local/sbin/gzip
    gzip -d
    3⤵
    PID:739
- - /usr/local/bin/gzip
    gzip -d
    3⤵
    PID:739
- - /usr/sbin/gzip
    gzip -d
    3⤵
    PID:739
- - /usr/bin/gzip
    gzip -d
    3⤵
    PID:739
- - /sbin/gzip
    gzip -d
    3⤵
    PID:739
- - /bin/gzip
    gzip -d
    3⤵
    PID:739
- /bin/chmod
  chmod +x start
  2⤵
  PID:741
- /var/tmp/.22/start
  ./start
  2⤵
  - Executes dropped EXE
  PID:742
- - /bin/uname
    uname -m
    3⤵
    PID:743
- - /var/tmp/.22/hide
    ./hide
    3⤵
    - Executes dropped EXE
    PID:744
- - /var/tmp/.22/create
    ./create
    3⤵
    - Executes dropped EXE
    PID:746
  - - /bin/cat
      cat auto
      4⤵
      PID:748
  - - /usr/bin/crontab
      crontab cronjobs
      4⤵
      Creates/modifies Cron job
      Reads runtime system information
      PID:749
  - - /bin/rm
      rm -f cronjobs
      4⤵
      PID:751
  - - /usr/bin/crontab
      crontab -l
      4⤵
      PID:752
  - - /bin/chmod
      chmod u+x auto init.d
      4⤵
      PID:753
  - - /bin/sh
      sh -c "./auto > /dev/null 2>&1 &"
      4⤵
      PID:754
  - - /bin/rm
      rm -f aarch64 x86_64 hide.c init.c start create
      4⤵
      PID:756

/usr/bin/base64
base64 -d
1⤵
PID:718

/bin/cat
cat
1⤵
PID:736

/var/tmp/.22/auto
./auto
1⤵
- Executes dropped EXE
PID:755
- /var/tmp/.22/init.d
  /var/tmp/.22/init.d
  2⤵
  PID:757
- - /var/tmp/.22/init
    ./init
    3⤵
    - Executes dropped EXE
    PID:758
- /bin/chmod
  chmod 755 auto hide init init.d logs mining mkcfg xm.jpg
  2⤵
  PID:760
- /usr/bin/pkill
  pkill -9 init
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:761

/var/tmp/.22/mining
./mining
1⤵
- Executes dropped EXE
PID:762
- /var/tmp/.22/init
  /var/tmp/.22/init
  2⤵
  - Executes dropped EXE
  PID:764
- /bin/uname
  uname -m
  2⤵
  PID:766
- /bin/ps
  ps -ef
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:767
- /bin/grep
  grep "sendmail: accepting connections"
  2⤵
  PID:768
- /bin/grep
  grep -v grep
  2⤵
  PID:769
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:770
- /usr/bin/head
  head -1
  2⤵
  PID:771

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/sh-thd.6Has9e

Filesize
34B

MD5
d73b6cacb30d623ccbb82cb8b3489476

SHA1
83a9395088a8885f45dfb4de5dc509aa74bb5164

SHA256
1a6177c310e4ddd1526252e4fcecfa3c78a440760f4adae90e4b2d60ad3000c5

SHA512
94e1949188ff086eec6dbc72dc01967f5c952928399db92656d65dc30f767e188f1a43f9558ffcf0fffaf38a522b335e6509228330780a97f09432c1b50f5941

Download Submit
/var/spool/cron/crontabs/tmp.RIkBNe

Filesize
266B

MD5
e165276b0243975af35e09ae112ea1ae

SHA1
a9a6370b3f457bf0b01115c31ba71f83cd21111b

SHA256
0bff2762490a418588c440a07c1c67d3c4494c8e6fbd3e4df8840a16a4971645

SHA512
70e49370dd561c2226c9504d0f265b87026689eb98630167dfbefc6920c7cc81de6e3ede289a7bd5831cd7fecba33e1fefa85234116e954b7311a14b8db62fab

Download Submit
/var/tmp/.22/aarch64

Filesize
4.6MB

MD5
1ba3f6f197a8ddd84cf30e29eed01ae9

SHA1
e63b06246de680ac8357fb2d2fb467c630b85dd2

SHA256
bbcdffd6fa3b1370dfc091bfd3bfca38be013f72f94af7ef29466d911c9604d8

SHA512
818f671bbe14e3b863511fc13fd83bf30fdf6c89240431d96b4d85105d99552c16f3e90ff52f90ce2e1cb3a14df37be6f99203eeb24ff0327245987d3ebeb3a3

Download Submit
/var/tmp/.22/auto

Filesize
13B

MD5
814dd64cc10a8383fa795113ba6fc201

SHA1
bfd109586b63447862882cacc5e1560cbbc5d759

SHA256
2d6b8ac13c7c35eb920dbdb703537e379bd275089a090aa2043bdcd4db6ae319

SHA512
22d94b78f5079941c475999bb38a56b7f3253e503a349157f4a8da1afe77385253a9adf2e046bed99e258bce423195bcd9a518fbc1de622aa09dd052284f448e

Download Submit
/var/tmp/.22/auto

Filesize
237B

MD5
31dd8df9646ec4ba759bb9bab05d50d2

SHA1
56d64851b676586beaab6b385e270855815e95bd

SHA256
5b1574e562a37087c472f214870d022e7ca80de38a601f6b16893cc2a398071f

SHA512
ae95c5016b6ccbd94a0700801bd31f113e366a1f54460a1c102f694a52d703fde19242a8bd886a854494b679793344ae123d1cd9086e97254122e8bd51d5ffb0

Download Submit
/var/tmp/.22/create

Filesize
669B

MD5
18d2b80638dc8ed90e86c7caf316fe43

SHA1
887f50f37a7e57abd113153becd5d8e36a780b19

SHA256
d6a88499031026e3216ac733dd5b6365d597fa91599d33ec10a65cbb72e229b8

SHA512
1ab557c50377097f1b4f59bacea66de1b569ea8e341d47155919d2996157f71e078e3a4b474ef005c7320e4eb46199fdda01dcffe5df6973778059466c0f2cec

Download Submit
/var/tmp/.22/cronjobs

Filesize
44B

MD5
98b58e548a19a44729a7d714872f9c40

SHA1
e547c6d88e92e35b5ebec931f0437aa1ea5885ac

SHA256
0bf4705afed32cc558a79fc696d1a4f9d58fa5e50a6cf4debd7ef0fba4e4016a

SHA512
a1892a0e42d614dfda33ba377e59227f9c1fb1f88d1378e45f3620ddfa4150def0b453e26289c9056c5a24f07909ce0d04fe607c1f41d05b087358a6c62f7e28

Download Submit
/var/tmp/.22/cronjobs

Filesize
84B

MD5
376ad2f12d602894f51b5af852cd66fe

SHA1
54817f1951a10091d576fe3adbd1ded616227087

SHA256
9a90d545850ccd6839475a2409fc65db6a7261e3f4c9c0b9a005bee4539941be

SHA512
dee880479e82fc7d4627e1aec389b16fdfa5c64921da048b23ca7ccc6d60271118230eb0487831a5d1509cc291504a897e552a680997db99db78bd181084c019

Download Submit
/var/tmp/.22/hide

Filesize
17KB

MD5
0bb4618c041fdb18c2e115b65bc5401f

SHA1
d9d039df279c4cdcceba347630a5fbdd296fca22

SHA256
3f1e584ca9393a3f635d8a8573e5b7f863df0dc092911de03bffc2d4ab4f8b53

SHA512
7dfc744f8aa5d571db704a56d6f5d5bda4b1889b1829a1cdbcc0272d059dc9fa1d2055e56c47ffb39851f175bbde41a6b137a1175cb7ad06eb64c601302538cf

Download Submit
/var/tmp/.22/init

Filesize
41KB

MD5
3d7964550b662754985bae37e0ee427b

SHA1
3de28ccabe03f53cc4f534c96337ece4878d7a0e

SHA256
03fab42e0825e6c35b803a125d63191dcf819f48bc9152180379b6c598632075

SHA512
75849f318fa46c8415fac9bded6b0bcecc2762cbb3b2c63d0d27794bfaaf8803fff3b67919758a2b7d534f30ea0a4010e828615a09d64f562820e111b00ea7c3

Download Submit
/var/tmp/.22/mining

Filesize
355B

MD5
8674ce902ffedf49ae4be47baabcc2c0

SHA1
441ecd5d3a928125e10a0b6b19f7eed31cfd4476

SHA256
8f93a7dd12dbd84749cb5cf675cd8371bd732655a8d048f269d8e88e8136e2e3

SHA512
8428b05454cc9a6ccc3ddea862d9f38b6f10f542ebf6f784b2f7027a985f1adc9bf7c69d3306b6d4d1896af9ec8e7fe1e1d9291c60652c46d7e5126a2d2e3380

Download Submit
/var/tmp/.22/mkcfg

Filesize
2KB

MD5
b586844bb52809b9dd6c5982347e27e0

SHA1
1aa9693db7bd01099d3022c5d697b601a938e205

SHA256
a86693407c7ec7a73e1f0e39ae7727f8bdbbc690cbaedeb3817f04cb9f87a57c

SHA512
2a3c4031b987178e8b93ced37794d2b2803ffb595b431f05b25793fd4874d8059d9499b8c00ca5abeb7524bba3c4d23a3a5cf2091a811c79224803f7a5f440f0

Download Submit
/var/tmp/.22/start

Filesize
176B

MD5
fe2ac6ae76a359f127213790c460496f

SHA1
df036a0088e1f418cb6e618fae06cf6282e79452

SHA256
0f1e5ab87d39835c6c28f242e68f7855a57813ef8e3e07091eee4f4d4f7ef78d

SHA512
8e41371af2cca37fff463fa1fff44db1cb462c8bf65f93f0ba0779adcfb4c812e411baf00bd67a2e7c92ddb27d65894bb18e205d6ca0e588c81219ba1b272889

Download Submit
/var/tmp/.22/xm.jpg

Filesize
1.4MB

MD5
851e72608e4caf44594714073897813d

SHA1
ec4c57c077548690c3bbd45f0a820a150ccf49db

SHA256
0124049b38aff1d2f03467f2bb8156ba7ad4b1f9f6bd89a1a11a4ff97bef8e7c

SHA512
b3a453de1d310dc2a4ed10ff81f1c288cd331eaac6bbc89bfe62207d1d002eae7ca40efd89a5665b7be0cddbec7b8f505b63421be30d6f8aa8d0276a67f5531e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads