Overview

overview

10

Static

static

7

538c8b6f96...kes118

ubuntu-22.04-amd64

10

Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    ubuntu-22.04_amd64
  • resource
    ubuntu2204-amd64-20240522.1-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2204-amd64-20240522.1-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
  • submitted
    29-07-2024 16:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    538c8b6f96695b21d29adc2f71b8aa5f_JaffaCakes118

  • Size

    65KB

  • MD5

    538c8b6f96695b21d29adc2f71b8aa5f

  • SHA1

    6a31467dcba0257b7cc35a98f3d157696a76e647

  • SHA256

    af2ba69e4ff33cfed726c3e3cfe5da7521435b534206a717ca353ee167eaa3bb

  • SHA512

    d5f81d54d318311ddd2ee6ae219183f8b945da11d918e03c08ff2553ed4bb7e7a8ed8465ac61453a4d8386d0c8d10c01a27f4f2505ac61628a73fb9302162690

  • SSDEEP

    1536:st+Y79B21IKmM0y+6x1SucfpFu9HyZiSvhTP:RY9BmxXhncbu9HiJP

Score
10/10
kaitenbotnet

Malware Config

Signatures

  • Detects Kaiten/Tsunami Payload 1 IoCs
  • Detects Kaiten/Tsunami payload 1 IoCs
  • Kaiten/Tsunami

    Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.

    botnetkaiten
  • Reads runtime system information 1 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/538c8b6f96695b21d29adc2f71b8aa5f_JaffaCakes118
    /tmp/538c8b6f96695b21d29adc2f71b8aa5f_JaffaCakes118
    1⤵
    • Reads runtime system information
    PID:1558
    • /bin/sh
      sh -c "IPT=/sbin/iptables;\$IPT -N TN;\$IPT -A TN -s -j ACCEPT;\$IPT -A TN -p tcp -m tcp --dport 23 -j REJECT;\$IPT -I INPUT -j TN;\$IPT-save; echo 'nameserver 4.2.2.2' > /tmp/resolv.conf;echo 'namserver 208.67.222.222' >> /tmp/resolv.conf"
      2⤵
      • Writes file to tmp directory
      PID:1559
      • /sbin/iptables
        /sbin/iptables -N TN
        3⤵
          PID:1560
        • /sbin/iptables
          /sbin/iptables -A TN -s -j ACCEPT
          3⤵
            PID:1561
          • /sbin/iptables
            /sbin/iptables -A TN -p tcp -m tcp --dport 23 -j REJECT
            3⤵
              PID:1562
            • /sbin/iptables
              /sbin/iptables -I INPUT -j TN
              3⤵
                PID:1563
              • /sbin/iptables-save
                /sbin/iptables-save
                3⤵
                  PID:1564

            Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • /tmp/resolv.conf
              Filesize

              19B

              MD5

              18e0d4be7ee318c312d30ed75f39224a

              SHA1

              b9dc9465cf5b3df703210bc0a9c3a9cf99a0a9da

              SHA256

              ccf6e60942eb1621dc5c14f36e531f15ddab87cd011b0330055b638437969038

              SHA512

              50d8b06a918649fd3d3b9ddb4e9a5488584adc3fd17c32ed897283bdd96d38f77e51e7bf3580e9ec826aba09112cfcf220a6a989cae1f65e0876787fccd7b7f3

              Download Submit

            • /tmp/resolv.conf
              Filesize

              44B

              MD5

              51a49244ffd6b878ded13f8ca99ec374

              SHA1

              e1b011254290e401e3e033691ac003fb5eb4744e

              SHA256

              b8b3e8e7ef159fac65286258082f832c227e982512ff9457b7d166e91b77ce98

              SHA512

              202ecd188cb234b6d21e6a4c895fc1420ec445bea436a9cba0986fc82979df6d2f3afca57542e2944f5df9b380d61ede54e6782cd3baee0f07a1df41b59a10c1

              Download Submit