kaiten | f96295c7ae9d719b5722d1f9e90bdddd65e6955ee4b56b05fb0584c09df28601

Analysis

max time kernel
149s
max time network
148s
platform
ubuntu-20.04_amd64
resource
ubuntu2004-amd64-20240221-en
resource tags

arch:amd64arch:i386image:ubuntu2004-amd64-20240221-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
submitted
31-03-2024 17:30

Target

598944121a19335a95de4a7b40e01fd1_JaffaCakes118
Size

41KB
MD5

598944121a19335a95de4a7b40e01fd1
SHA1

d39d26ec77c567a92533076fd14375fff72e64ff
SHA256

f96295c7ae9d719b5722d1f9e90bdddd65e6955ee4b56b05fb0584c09df28601
SHA512

2d10a07acfd34a69f234fcb0ddfe8292fbfd4224ee19d52728842a3e360cedee79ed962991cc3826d579de787159da6d89b87664f2cb069e6a7ce6d8ed0bb0c2
SSDEEP

768:y1E2rNgEuScnb6iXZ/srXZhjiA8mmNH4ATA1lDoObBPzRwIA:cE2ren2iX23iABmNH9kHFzRwH

Score

10^/10

kaiten botnet

Detects Kaiten/Tsunami Payload 1 IoCs

resource	yara_rule
behavioral1/memory/1484-1-0x0000000000400000-0x0000000000416f68-memory.dmp	family_kaiten2

Detects Kaiten/Tsunami payload 1 IoCs

resource	yara_rule
behavioral1/memory/1484-1-0x0000000000400000-0x0000000000416f68-memory.dmp	family_kaiten

Kaiten/Tsunami
Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.
botnet kaiten

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/self/exe	598944121a19335a95de4a7b40e01fd1_JaffaCakes118

/tmp/598944121a19335a95de4a7b40e01fd1_JaffaCakes118
/tmp/598944121a19335a95de4a7b40e01fd1_JaffaCakes118
1⤵
- Reads runtime system information
PID:1484