kaiten | 594a4bc0f819e60976e43139ae1f09259a87c5c014e1bfde62efabe34997beb7

Analysis

max time kernel
149s
max time network
147s
platform
debian-9_mips
resource
debian9-mipsbe-20240729-en
resource tags

arch:mipsimage:debian9-mipsbe-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
28-07-2024 23:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b404255f46cc50edb66b11d3c559636_JaffaCakes118
Size

57KB
MD5

2b404255f46cc50edb66b11d3c559636
SHA1

149d024cd07e346b9bc983153ccd544997efa77a
SHA256

594a4bc0f819e60976e43139ae1f09259a87c5c014e1bfde62efabe34997beb7
SHA512

6ff44170d0b610d3ffa2b8c61b2cc70b68b856b1d8b065e77299c49e8e0f6d6cb9b06a37325332b8c330ff7405bbc5ebd64824b67018b4247f3ef16e16c05047
SSDEEP

1536:/oo48wXR5lvyN76/KTRAjDSzEhVcuqqBW:AopwXR55+6STzsV7vBW

Score

10^/10

kaiten botnet persistence

Malware Config

Signatures

Detects Kaiten/Tsunami Payload 1 IoCs

resource	yara_rule
behavioral1/memory/712-1-0x00400000-0x0045e714-memory.dmp	family_kaiten2

Kaiten/Tsunami
Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.
botnet kaiten

Writes DNS configuration 1 TTPs 1 IoCs

Writes data to DNS resolver config file.

Dynamic Resolution

T1568

description	ioc	Process
File opened for modification	/etc/resolv.conf	sh

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

persistence

Scheduled Task/Job

T1053

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.TDmAGP	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/5/stat	killall
File opened for reading	/proc/176/stat	killall
File opened for reading	/proc/9/stat	killall
File opened for reading	/proc/121/stat	killall
File opened for reading	/proc/10/stat	killall
File opened for reading	/proc/74/stat	killall
File opened for reading	/proc/9/stat	killall
File opened for reading	/proc/240/stat	killall
File opened for reading	/proc/386/stat	killall
File opened for reading	/proc/711/stat	killall
File opened for reading	/proc/122/cmdline	killall
File opened for reading	/proc/712/stat	killall
File opened for reading	/proc/758/stat	killall
File opened for reading	/proc/434/stat	killall
File opened for reading	/proc/673/stat	killall
File opened for reading	/proc/37/stat	killall
File opened for reading	/proc/327/stat	killall
File opened for reading	/proc/84/stat	killall
File opened for reading	/proc/380/stat	killall
File opened for reading	/proc/19/stat	killall
File opened for reading	/proc/1/stat	killall
File opened for reading	/proc/379/stat	killall
File opened for reading	/proc/37/stat	killall
File opened for reading	/proc/7/stat	killall
File opened for reading	/proc/18/stat	killall
File opened for reading	/proc/15/stat	killall
File opened for reading	/proc/176/stat	killall
File opened for reading	/proc/24/stat	killall
File opened for reading	/proc/71/stat	killall
File opened for reading	/proc/12/stat	killall
File opened for reading	/proc/155/cmdline	killall
File opened for reading	/proc/176/stat	killall
File opened for reading	/proc/718/stat	killall
File opened for reading	/proc/2/stat	killall
File opened for reading	/proc/36/stat	killall
File opened for reading	/proc/filesystems	killall
File opened for reading	/proc/710/stat	killall
File opened for reading	/proc/filesystems	killall
File opened for reading	/proc/712/cmdline	killall
File opened for reading	/proc/76/stat	killall
File opened for reading	/proc/76/stat	killall
File opened for reading	/proc/121/stat	killall
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/6/stat	killall
File opened for reading	/proc/10/stat	killall
File opened for reading	/proc/71/stat	killall
File opened for reading	/proc/718/stat	killall
File opened for reading	/proc/23/stat	killall
File opened for reading	/proc/753/stat	killall
File opened for reading	/proc/386/stat	killall
File opened for reading	/proc/707/stat	killall
File opened for reading	/proc/693/stat	killall
File opened for reading	/proc/16/stat	killall
File opened for reading	/proc/23/stat	killall
File opened for reading	/proc/17/stat	killall
File opened for reading	/proc/122/stat	killall
File opened for reading	/proc/74/stat	killall
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/21/stat	killall
File opened for reading	/proc/37/stat	killall
File opened for reading	/proc/filesystems	killall
File opened for reading	/proc/6/stat	killall
File opened for reading	/proc/18/stat	killall
File opened for reading	/proc/176/stat	killall

/tmp/2b404255f46cc50edb66b11d3c559636_JaffaCakes118
/tmp/2b404255f46cc50edb66b11d3c559636_JaffaCakes118
1⤵
PID:712
- /bin/sh
  sh -c "rm -rf /var/run/wgsh > /dev/null 2>&1 &"
  2⤵
  PID:713
- /bin/sh
  sh -c "rm -rf /var/run/bbsh > /dev/null 2>&1 &"
  2⤵
  PID:715
- /bin/sh
  sh -c "rm -rf /var/run/tty0 > /dev/null 2>&1 &"
  2⤵
  PID:717
- /bin/sh
  sh -c "rm -rf /var/run/tty2 > /dev/null 2>&1 &"
  2⤵
  PID:721
- /bin/sh
  sh -c "rm -rf /var/run/tty3 > /dev/null 2>&1 &"
  2⤵
  PID:725
- /bin/sh
  sh -c "rm -rf /var/run/tty4 > /dev/null 2>&1 &"
  2⤵
  PID:727
- /bin/sh
  sh -c "rm -rf /var/run/tty5 > /dev/null 2>&1 &"
  2⤵
  PID:729
- /bin/sh
  sh -c "rm -rf /var/run/tty6 > /dev/null 2>&1 &"
  2⤵
  PID:731
- /bin/sh
  sh -c "rm -rf /tmp/tty0 > /dev/null 2>&1 &"
  2⤵
  PID:733
- /bin/sh
  sh -c "rm -rf /tmp/tty2 > /dev/null 2>&1 &"
  2⤵
  PID:735
- /bin/sh
  sh -c "rm -rf /tmp/tty3 > /dev/null 2>&1 &"
  2⤵
  PID:737
- /bin/sh
  sh -c "rm -rf /tmp/tty4 > /dev/null 2>&1 &"
  2⤵
  PID:739
- /bin/sh
  sh -c "rm -rf /tmp/tty5 > /dev/null 2>&1 &"
  2⤵
  PID:741
- /bin/sh
  sh -c "rm -rf /tmp/tty6 > /dev/null 2>&1 &"
  2⤵
  PID:743
- /bin/sh
  sh -c "rm -rf /var/run/pty > /dev/null 2>&1 &"
  2⤵
  PID:745
- /bin/sh
  sh -c "killall -9 arm > /dev/null 2>&1 &"
  2⤵
  PID:747
- /bin/sh
  sh -c "killall -9 mips > /dev/null 2>&1 &"
  2⤵
  PID:749
- /bin/sh
  sh -c "killall -9 mipsel > /dev/null 2>&1 &"
  2⤵
  PID:751
- /bin/sh
  sh -c "killall -9 powerpc > /dev/null 2>&1 &"
  2⤵
  PID:753
- /bin/sh
  sh -c "killall -9 ppc > /dev/null 2>&1 &"
  2⤵
  PID:755
- /bin/sh
  sh -c "killall -9 daemon.armv4l.mod > /dev/null 2>&1 &"
  2⤵
  PID:757
- /bin/sh
  sh -c "killall -9 daemon.i686.mod > /dev/null 2>&1 &"
  2⤵
  PID:759
- /bin/sh
  sh -c "killall -9 daemon.mips.mod > /dev/null 2>&1 &"
  2⤵
  PID:761
- /bin/sh
  sh -c "killall -9 daemon.mipsel.mod > /dev/null 2>&1 &"
  2⤵
  PID:763
- /bin/sh
  sh -c "kill -9 `cat /tmp/.xs/*.pid` > /dev/null 2>&1 &"
  2⤵
  PID:765
- - /bin/cat
    cat "/tmp/.xs/*.pid"
    3⤵
    PID:768
- /bin/sh
  sh -c "rm -rf /tmp/.xs/* > /dev/null 2>&1 &"
  2⤵
  PID:767
- /bin/sh
  sh -c "echo \"nameserver 8.8.8.8\" > /etc/resolv.conf &"
  2⤵
  - Writes DNS configuration
  PID:770
- /bin/sh
  sh -c "chmod 700 /tmp/2b404255f46cc50edb66b11d3c559636_JaffaCakes118 > /dev/null 2>&1 &"
  2⤵
  PID:772
- /bin/sh
  sh -c "touch -acmr /bin/ls /tmp/2b404255f46cc50edb66b11d3c559636_JaffaCakes118"
  2⤵
  PID:774
- - /usr/bin/touch
    touch -acmr /bin/ls /tmp/2b404255f46cc50edb66b11d3c559636_JaffaCakes118
    3⤵
    PID:775
- /bin/sh
  sh -c "(crontab -l | grep -v \"/tmp/2b404255f46cc50edb66b11d3c559636_JaffaCakes118\" | grep -v \"no cron\" | grep -v \"lesshts/run.sh\" > /var/run/.x001804289383) > /dev/null 2>&1"
  2⤵
  PID:776
- - /bin/grep
    grep -v "no cron"
    3⤵
    PID:780
- - /bin/grep
    grep -v /tmp/2b404255f46cc50edb66b11d3c559636_JaffaCakes118
    3⤵
    PID:779
- - /usr/bin/crontab
    crontab -l
    3⤵
    PID:778
- - /bin/grep
    grep -v lesshts/run.sh
    3⤵
    PID:781
- /bin/sh
  sh -c "echo \"* * * * * /tmp/2b404255f46cc50edb66b11d3c559636_JaffaCakes118 > /dev/null 2>&1 &\" >> /var/run/.x001804289383"
  2⤵
  PID:782
- /bin/sh
  sh -c "crontab /var/run/.x001804289383"
  2⤵
  PID:783
- - /usr/bin/crontab
    crontab /var/run/.x001804289383
    3⤵
    - Creates/modifies Cron job
    PID:784
- /bin/sh
  sh -c "rm -rf /var/run/.x001804289383"
  2⤵
  PID:785
- - /bin/rm
    rm -rf /var/run/.x001804289383
    3⤵
    PID:786
- /bin/sh
  sh -c "/bin/uname -n"
  2⤵
  PID:787
- - /bin/uname
    /bin/uname -n
    3⤵
    PID:788
- /bin/sh
  sh -c "/bin/uname -n"
  2⤵
  PID:789
- - /bin/uname
    /bin/uname -n
    3⤵
    PID:790

/bin/rm
rm -rf /var/run/wgsh
1⤵
PID:714

/bin/rm
rm -rf /var/run/bbsh
1⤵
PID:716

/bin/rm
rm -rf /var/run/tty0
1⤵
PID:719

/bin/rm
rm -rf /var/run/tty2
1⤵
PID:724

/bin/rm
rm -rf /var/run/tty3
1⤵
PID:726

/bin/rm
rm -rf /var/run/tty4
1⤵
PID:728

/bin/rm
rm -rf /var/run/tty5
1⤵
PID:730

/bin/rm
rm -rf /var/run/tty6
1⤵
PID:732

/bin/rm
rm -rf /tmp/tty0
1⤵
PID:734

/bin/rm
rm -rf /tmp/tty2
1⤵
PID:736

/bin/rm
rm -rf /tmp/tty3
1⤵
PID:738

/bin/rm
rm -rf /tmp/tty4
1⤵
PID:740

/bin/rm
rm -rf /tmp/tty5
1⤵
PID:742

/bin/rm
rm -rf /tmp/tty6
1⤵
PID:744

/bin/rm
rm -rf /var/run/pty
1⤵
PID:746

/usr/bin/killall
killall -9 arm
1⤵
- Reads runtime system information
PID:748

/usr/bin/killall
killall -9 mips
1⤵
- Reads runtime system information
PID:750

/usr/bin/killall
killall -9 mipsel
1⤵
- Reads runtime system information
PID:752

/usr/bin/killall
killall -9 powerpc
1⤵
- Reads runtime system information
PID:754

/usr/bin/killall
killall -9 ppc
1⤵
- Reads runtime system information
PID:756

/usr/bin/killall
killall -9 daemon.armv4l.mod
1⤵
- Reads runtime system information
PID:758

/usr/bin/killall
killall -9 daemon.i686.mod
1⤵
- Reads runtime system information
PID:760

/usr/bin/killall
killall -9 daemon.mips.mod
1⤵
- Reads runtime system information
PID:762

/usr/bin/killall
killall -9 daemon.mipsel.mod
1⤵
- Reads runtime system information
PID:764

/bin/rm
rm -rf "/tmp/.xs/*"
1⤵
PID:769

/bin/chmod
chmod 700 /tmp/2b404255f46cc50edb66b11d3c559636_JaffaCakes118
1⤵
PID:773

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Dynamic Resolution

T1568

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/run/.x001804289383

Filesize
81B

MD5
b2167fad29aba1362be262f298d2ac1f

SHA1
8f1bf83b382faeb4d65f8f4226b1eb98bf00e710

SHA256
ff067b17364203690705d954896b2d896f6806cda942ef794a24cee6e0bdb768

SHA512
30637718075e34ef8ef921fcfb476b019fbc7357ef836b5c41a5877063fa2859ba58d2b3de7563a8607215b2d94e4483a9082088dad4eb798b072d3ac9d8cb6b

Download Submit
/var/spool/cron/crontabs/tmp.TDmAGP

Filesize
278B

MD5
b7aa03929d3184a33fe1f3b44968594b

SHA1
fe22f61afbf2c558e3c6eac7b123387d87775ca9

SHA256
1da14e1325c6b592de6cc032e534d8e55aaa80c6e83c21cfa629720df5b0a5fa

SHA512
28e8f6869591c824fd11530dc216ad986987e0eaaa22b1dca157efa6369d90425fe97799bf1cfeaf695b18c39ff9b2ac8ccc509b97c068bb96eee644e0252880

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads