kaiten | 9c7a12678651d72127c3c6e4dac250439fa4a3be0a8728754cea327c86a529a2

Analysis

max time kernel
149s
max time network
147s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240226-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
24-03-2024 22:36

Target

37a193112bd3af6c71f7e98837dbfb3f.elf
Size

48KB
MD5

37a193112bd3af6c71f7e98837dbfb3f
SHA1

253937627e0729ca2cb81b286c8f35d7421417b3
SHA256

9c7a12678651d72127c3c6e4dac250439fa4a3be0a8728754cea327c86a529a2
SHA512

faa64bd0b44c896c627872ac76ddd633283e04646e1c0bf8623fbffbe614c9acd3ed66fe71b3efe0f3a0d231308f5e28c5aa357740774e0e26c49bd30f83e026
SSDEEP

768:tY/ko7wrEIjqbBs0eMyRi4Wb6tRihbR4+gE6y4CswG1yyo+7n5yTvnKqCAC:tK2AIWbW5E4YuQbR4U6yW750iqCAC

Score

10^/10

kaiten botnet

Detects Kaiten/Tsunami Payload 1 IoCs

resource	yara_rule
behavioral1/memory/1546-1-0x0000000000400000-0x0000000000419fa8-memory.dmp	family_kaiten2

Detects Kaiten/Tsunami payload 1 IoCs

resource	yara_rule
behavioral1/memory/1546-1-0x0000000000400000-0x0000000000419fa8-memory.dmp	family_kaiten

Kaiten/Tsunami
Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.
botnet kaiten

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/self/exe	37a193112bd3af6c71f7e98837dbfb3f.elf

/tmp/37a193112bd3af6c71f7e98837dbfb3f.elf
/tmp/37a193112bd3af6c71f7e98837dbfb3f.elf
1⤵
- Reads runtime system information
PID:1546