kaiten | 33c8591edd61c6e968e727683a63fba0352b5b6b59a0b3005628c38848dd7dd3

Analysis

max time kernel
149s
max time network
148s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240226-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
10/04/2024, 10:16

Target

33c8591edd61c6e968e727683a63fba0352b5b6b59a0b3005628c38848dd7dd3
Size

41KB
MD5

bdb404a243e374cda8948a5480f263e6
SHA1

98bea07044c2a756f5179b8bc776971f9a03b7db
SHA256

33c8591edd61c6e968e727683a63fba0352b5b6b59a0b3005628c38848dd7dd3
SHA512

6d6ce4f156e3250965bf9b445be968967f8c5a596448ad1b8d41a189d28e9d4aa8fe8a32d8a0ad5956c020629b7401c705117832f48058bac071c7bb37e1ab62
SSDEEP

768:Yjo7npPeMEjUJ5xOcT8Pv2jwLME7ruzcKpV8gDfb7wIP:9p2MEjb/+jEucY17XwA

Score

10^/10

kaiten botnet

Detects Kaiten/Tsunami Payload 1 IoCs

resource	yara_rule
behavioral1/memory/1586-1-0x0000000000400000-0x0000000000416f68-memory.dmp	family_kaiten2

Detects Kaiten/Tsunami payload 1 IoCs

resource	yara_rule
behavioral1/memory/1586-1-0x0000000000400000-0x0000000000416f68-memory.dmp	family_kaiten

Kaiten/Tsunami
Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.
botnet kaiten

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/self/exe	33c8591edd61c6e968e727683a63fba0352b5b6b59a0b3005628c38848dd7dd3

/tmp/33c8591edd61c6e968e727683a63fba0352b5b6b59a0b3005628c38848dd7dd3
/tmp/33c8591edd61c6e968e727683a63fba0352b5b6b59a0b3005628c38848dd7dd3
1⤵
- Reads runtime system information
PID:1586