kaiten | c7f27cf185dac9e77870c7f53d84091993ed872159b4bffcd2bab7cac25da3b0

Analysis

max time kernel
150s
max time network
152s
platform
debian-9_armhf
resource
debian9-armhf-20231215-en
resource tags

arch:armhfimage:debian9-armhf-20231215-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
20-12-2023 11:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad14082f73f30eb3c924b3677110afb1
Size

62KB
MD5

ad14082f73f30eb3c924b3677110afb1
SHA1

f6ee6acc60439dab4b446bd6269c3525e3277daa
SHA256

c7f27cf185dac9e77870c7f53d84091993ed872159b4bffcd2bab7cac25da3b0
SHA512

9dac25ec117ab7ae4415c0fc16cf320ec07c7247fd332009a5d3ed1d222466a30f86c8074016188927ae12d5d039305e35fc2d7e322e7f48177532a65cbb7de7
SSDEEP

1536:fdoCxk6r6hXBqN9RdSB7LN9orTqobPubGXETiwmMJ:VoUr6LqNbdSdNIdMGXEv

Score

10^/10

kaiten botnet

Malware Config

Signatures

Detects Kaiten/Tsunami Payload 1 IoCs

resource	yara_rule
behavioral1/memory/654-1-0x00008000-0x00031de4-memory.dmp	family_kaiten2

Detects Kaiten/Tsunami payload 1 IoCs

resource	yara_rule
behavioral1/memory/654-1-0x00008000-0x00031de4-memory.dmp	family_kaiten

Kaiten/Tsunami
Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.
botnet kaiten

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery

T1016

description	ioc	Process
File opened for reading	/proc/net/ip_tables_names	iptables-save

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/self/exe	ad14082f73f30eb3c924b3677110afb1

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/resolv.conf	sh

/tmp/ad14082f73f30eb3c924b3677110afb1
/tmp/ad14082f73f30eb3c924b3677110afb1
1⤵
- Reads runtime system information
PID:654
- /bin/sh
  sh -c "IPT=/sbin/iptables;\$IPT -N TN;\$IPT -A TN -s -j ACCEPT;\$IPT -A TN -p tcp -m tcp --dport 23 -j REJECT;\$IPT -I INPUT -j TN;\$IPT-save; echo 'nameserver 4.2.2.2' > /tmp/resolv.conf;echo 'namserver 208.67.222.222' >> /tmp/resolv.conf"
  2⤵
  - Writes file to tmp directory
  PID:656
- - /sbin/iptables
    /sbin/iptables -N TN
    3⤵
    PID:657
- - /sbin/iptables
    /sbin/iptables -A TN -s -j ACCEPT
    3⤵
    PID:665
- - /sbin/iptables
    /sbin/iptables -A TN -p tcp -m tcp --dport 23 -j REJECT
    3⤵
    PID:666
- - /sbin/iptables
    /sbin/iptables -I INPUT -j TN
    3⤵
    PID:675
- - /sbin/iptables-save
    /sbin/iptables-save
    3⤵
    - Reads system network configuration
    PID:677

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/resolv.conf

Filesize
19B

MD5
18e0d4be7ee318c312d30ed75f39224a

SHA1
b9dc9465cf5b3df703210bc0a9c3a9cf99a0a9da

SHA256
ccf6e60942eb1621dc5c14f36e531f15ddab87cd011b0330055b638437969038

SHA512
50d8b06a918649fd3d3b9ddb4e9a5488584adc3fd17c32ed897283bdd96d38f77e51e7bf3580e9ec826aba09112cfcf220a6a989cae1f65e0876787fccd7b7f3

Download Submit
/tmp/resolv.conf

Filesize
44B

MD5
51a49244ffd6b878ded13f8ca99ec374

SHA1
e1b011254290e401e3e033691ac003fb5eb4744e

SHA256
b8b3e8e7ef159fac65286258082f832c227e982512ff9457b7d166e91b77ce98

SHA512
202ecd188cb234b6d21e6a4c895fc1420ec445bea436a9cba0986fc82979df6d2f3afca57542e2944f5df9b380d61ede54e6782cd3baee0f07a1df41b59a10c1

Download Submit