kaiten | 9c7a12678651d72127c3c6e4dac250439fa4a3be0a8728754cea327c86a529a2

Analysis

max time kernel
148s
max time network
151s
platform
ubuntu-20.04_amd64
resource
ubuntu2004-amd64-20240221-en
resource tags

arch:amd64arch:i386image:ubuntu2004-amd64-20240221-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
submitted
25-03-2024 02:17

Target

9c7a12678651d72127c3c6e4dac250439fa4a3be0a8728754cea327c86a529a2.elf
Size

48KB
MD5

37a193112bd3af6c71f7e98837dbfb3f
SHA1

253937627e0729ca2cb81b286c8f35d7421417b3
SHA256

9c7a12678651d72127c3c6e4dac250439fa4a3be0a8728754cea327c86a529a2
SHA512

faa64bd0b44c896c627872ac76ddd633283e04646e1c0bf8623fbffbe614c9acd3ed66fe71b3efe0f3a0d231308f5e28c5aa357740774e0e26c49bd30f83e026
SSDEEP

768:tY/ko7wrEIjqbBs0eMyRi4Wb6tRihbR4+gE6y4CswG1yyo+7n5yTvnKqCAC:tK2AIWbW5E4YuQbR4U6yW750iqCAC

Score

10^/10

kaiten botnet

Detects Kaiten/Tsunami Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1470-1-0x0000000000400000-0x0000000000419fa8-memory.dmp	family_kaiten2

Detects Kaiten/Tsunami payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1470-1-0x0000000000400000-0x0000000000419fa8-memory.dmp	family_kaiten

Kaiten/Tsunami
Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.
botnet kaiten
Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.

Processes:

9c7a12678651d72127c3c6e4dac250439fa4a3be0a8728754cea327c86a529a2.elf

description ioc process

File opened for reading /proc/self/exe 9c7a12678651d72127c3c6e4dac250439fa4a3be0a8728754cea327c86a529a2.elf

description	ioc	process
File opened for reading	/proc/self/exe	9c7a12678651d72127c3c6e4dac250439fa4a3be0a8728754cea327c86a529a2.elf

/tmp/9c7a12678651d72127c3c6e4dac250439fa4a3be0a8728754cea327c86a529a2.elf
/tmp/9c7a12678651d72127c3c6e4dac250439fa4a3be0a8728754cea327c86a529a2.elf
1⤵
- Reads runtime system information
PID:1470