kaiten | a64ddaa1e3747b10863af3b60e79bbef1295a71ffdf3dd15a390d5926a6c3c13

Analysis

max time kernel
18s
max time network
12s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
20-10-2024 07:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

irq0
Size

605KB
MD5

8d4a6b005fe1b8b6ab08ac9501a13110
SHA1

ac3449f4ff85338a4cc99581070f358fb30ce1a1
SHA256

a64ddaa1e3747b10863af3b60e79bbef1295a71ffdf3dd15a390d5926a6c3c13
SHA512

7214699e67d101a6fb15e9a7571de1541480818bd399a6e26d018dd22ba33e8d8ebc42c2e7ba62b5268e595658eb57a7be744dee790cbeff71b7f18f9704bb84
SSDEEP

12288:To2aovPAC2u24h68Qugl3qCiJ7o6xt95DujbUjWWkGHnon3MYNBEEx9IRXa:8IvPAC2utTQug7iJ7oOtO3UjLkConLfx

Score

10^/10

kaiten botnet defense_evasion discovery execution persistence privilege_escalatio

Malware Config

Signatures

Detects Kaiten/Tsunami Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/667-1-0x00010000-0x00170b4c-memory.dmp	family_kaiten2

Kaiten/Tsunami
Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.
botnet kaiten
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
execution persistence privilege_escalatio

Cron
T1053.003

Processes:

crontab

description ioc process

File opened for modification /var/spool/cron/crontabs/tmp.3CdHYz crontab
Enumerates running processes
Discovers information about currently running processes on the system
Indicator Removal: Timestomp 1 TTPs 4 IoCs
Adversaries may remove indicators of compromise from the host to evade detection.
defense_evasion

Timestomp
T1070.006

Processes:

shtouchshtouch

pid process

675 sh
677 touch
712 sh
714 touch

description	ioc	process
File opened for modification	/var/spool/cron/crontabs/tmp.3CdHYz	crontab

pid	process
675	sh
677	touch
712	sh
714	touch

Enumerates kernel/hardware configuration 1 TTPs 9 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

Processes:

systemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctl

description	ioc	process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

systemctlkillallkillallkillallsystemctlkillallkillallkillallkillallkillallsystemctlsystemctl

description	ioc	process
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/659/cmdline	killall
File opened for reading	/proc/410/stat	killall
File opened for reading	/proc/108/cmdline	killall
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/29/stat	killall
File opened for reading	/proc/25/stat	killall
File opened for reading	/proc/5/stat	killall
File opened for reading	/proc/306/stat	killall
File opened for reading	/proc/658/stat	killall
File opened for reading	/proc/658/cmdline	killall
File opened for reading	/proc/755/stat	killall
File opened for reading	/proc/141/stat	killall
File opened for reading	/proc/9/stat	killall
File opened for reading	/proc/107/stat	killall
File opened for reading	/proc/748/stat	killall
File opened for reading	/proc/138/stat	killall
File opened for reading	/proc/22/stat	killall
File opened for reading	/proc/287/stat	killall
File opened for reading	/proc/410/stat	killall
File opened for reading	/proc/278/stat	killall
File opened for reading	/proc/669/stat	killall
File opened for reading	/proc/676/stat	killall
File opened for reading	/proc/42/stat	killall
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/669/stat	killall
File opened for reading	/proc/447/stat	killall
File opened for reading	/proc/762/stat	killall
File opened for reading	/proc/665/stat	killall
File opened for reading	/proc/622/stat	killall
File opened for reading	/proc/669/stat	killall
File opened for reading	/proc/27/stat	killall
File opened for reading	/proc/107/stat	killall
File opened for reading	/proc/664/stat	killall
File opened for reading	/proc/108/stat	killall
File opened for reading	/proc/280/stat	killall
File opened for reading	/proc/6/stat	killall
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/659/cmdline	killall
File opened for reading	/proc/731/stat	killall
File opened for reading	/proc/715/stat	killall
File opened for reading	/proc/743/stat	killall
File opened for reading	/proc/308/stat	killall
File opened for reading	/proc/287/stat	killall
File opened for reading	/proc/279/stat	killall
File opened for reading	/proc/658/stat	killall
File opened for reading	/proc/678/cmdline	killall
File opened for reading	/proc/280/stat	killall
File opened for reading	/proc/105/stat	killall
File opened for reading	/proc/765/stat	killall
File opened for reading	/proc/16/stat	killall
File opened for reading	/proc/5/stat	killall
File opened for reading	/proc/107/stat	killall
File opened for reading	/proc/404/stat	killall
File opened for reading	/proc/724/stat	killall
File opened for reading	/proc/23/stat	killall
File opened for reading	/proc/29/stat	killall
File opened for reading	/proc/147/stat	killall
File opened for reading	/proc/219/stat	killall
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/676/stat	killall
File opened for reading	/proc/22/stat	killall
File opened for reading	/proc/15/stat	killall
File opened for reading	/proc/410/stat	killall

/tmp/irq0
/tmp/irq0
1⤵
PID:667
- /bin/sh
  sh -c "touch -acmr /bin/ls /tmp/irq0"
  2⤵
  - Indicator Removal: Timestomp
  PID:675
- - /usr/bin/touch
    touch -acmr /bin/ls /tmp/irq0
    3⤵
    - Indicator Removal: Timestomp
    PID:677
- /bin/sh
  sh -c "(crontab -l | grep -v \"/tmp/irq0\" | grep -v \"no cron\" | grep -v \"lesshts/run.sh\" > /var/run/.x00740882966) > /dev/null 2>&1"
  2⤵
  PID:680
- - /usr/bin/crontab
    crontab -l
    3⤵
    PID:683
- - /bin/grep
    grep -v /tmp/irq0
    3⤵
    PID:684
- - /bin/grep
    grep -v "no cron"
    3⤵
    PID:685
- - /bin/grep
    grep -v lesshts/run.sh
    3⤵
    PID:686
- /bin/sh
  sh -c "echo \"* * * * * /tmp/irq0 > /dev/null 2>&1 &\" >> /var/run/.x00740882966"
  2⤵
  PID:689
- /bin/sh
  sh -c "crontab /var/run/.x00740882966"
  2⤵
  PID:691
- - /usr/bin/crontab
    crontab /var/run/.x00740882966
    3⤵
    - Creates/modifies Cron job
    PID:693
- /bin/sh
  sh -c "rm -rf /var/run/.x00740882966"
  2⤵
  PID:697
- - /bin/rm
    rm -rf /var/run/.x00740882966
    3⤵
    PID:699
- /bin/sh
  sh -c "cat /etc/inittab | grep -v \"/tmp/irq0\" > /etc/inittab2"
  2⤵
  PID:701
- - /bin/cat
    cat /etc/inittab
    3⤵
    PID:702
- - /bin/grep
    grep -v /tmp/irq0
    3⤵
    PID:703
- /bin/sh
  sh -c "echo \"0:2345:respawn:/tmp/irq0\" >> /etc/inittab2"
  2⤵
  PID:706
- /bin/sh
  sh -c "cat /etc/inittab2 > /etc/inittab"
  2⤵
  PID:707
- - /bin/cat
    cat /etc/inittab2
    3⤵
    PID:708
- /bin/sh
  sh -c "rm -rf /etc/inittab2"
  2⤵
  PID:710
- - /bin/rm
    rm -rf /etc/inittab2
    3⤵
    PID:711
- /bin/sh
  sh -c "touch -acmr /bin/ls /etc/inittab"
  2⤵
  - Indicator Removal: Timestomp
  PID:712
- - /usr/bin/touch
    touch -acmr /bin/ls /etc/inittab
    3⤵
    - Indicator Removal: Timestomp
    PID:714
- /bin/sh
  sh -c "/bin/uname -n"
  2⤵
  PID:716
- - /bin/uname
    /bin/uname -n
    3⤵
    PID:717
- /bin/sh
  sh -c "/bin/uname -n"
  2⤵
  PID:718
- - /bin/uname
    /bin/uname -n
    3⤵
    PID:720
- /bin/sh
  sh -c "/bin/uname -n"
  2⤵
  PID:721
- - /bin/uname
    /bin/uname -n
    3⤵
    PID:723
- /bin/sh
  sh -c "kill -9 `cat /var/run/httpd.pid` > /dev/null 2>&1 &"
  2⤵
  PID:727
- - /bin/cat
    cat /var/run/httpd.pid
    3⤵
    PID:730
- /bin/sh
  sh -c "service httpd stop > /dev/null 2>&1 &"
  2⤵
  PID:729
- /bin/sh
  sh -c "killall -9 mini_httpd > /dev/null 2>&1 &"
  2⤵
  PID:732
- /bin/sh
  sh -c "killall -9 minihttpd > /dev/null 2>&1 &"
  2⤵
  PID:735
- /bin/sh
  sh -c "kill -9 `cat /var/run/thttpd.pid` > /dev/null 2>&1 &"
  2⤵
  PID:737
- - /bin/cat
    cat /var/run/thttpd.pid
    3⤵
    PID:741
- /bin/sh
  sh -c "nvram set httpd_enable=0 > /dev/null 2>&1"
  2⤵
  PID:740
- /bin/sh
  sh -c "nvram set http_enable=0 > /dev/null 2>&1"
  2⤵
  PID:742
- /bin/sh
  sh -c "killall -9 httpd > /dev/null 2>&1 &"
  2⤵
  PID:744
- /bin/sh
  sh -c "service telnetd stop > /dev/null 2>&1 &"
  2⤵
  PID:746
- /bin/sh
  sh -c "service sshd stop > /dev/null 2>&1 &"
  2⤵
  PID:748
- /bin/sh
  sh -c "killall -9 telnetd > /dev/null 2>&1 &"
  2⤵
  PID:750
- /bin/sh
  sh -c "killall -9 utelnetd > /dev/null 2>&1 &"
  2⤵
  PID:756
- /bin/sh
  sh -c "killall -9 dropbear > /dev/null 2>&1 &"
  2⤵
  PID:760
- /bin/sh
  sh -c "killall -9 sshd > /dev/null 2>&1 &"
  2⤵
  PID:762
- /bin/sh
  sh -c "killall -9 lighttpd > /dev/null 2>&1 &"
  2⤵
  PID:766

/usr/sbin/service
service httpd stop
1⤵
PID:731
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:733
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:738
- /bin/systemctl
  systemctl --quiet is-active multi-user.target
  2⤵
  - Enumerates kernel/hardware configuration
  PID:743
- /bin/systemctl
  systemctl list-unit-files --full "--type=socket"
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:753
- /bin/sed
  sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
  2⤵
  PID:754

/usr/bin/killall
killall -9 mini_httpd
1⤵
- Reads runtime system information
PID:734

/usr/bin/killall
killall -9 minihttpd
1⤵
- Reads runtime system information
PID:736

/usr/bin/killall
killall -9 httpd
1⤵
- Reads runtime system information
PID:745

/usr/sbin/service
service telnetd stop
1⤵
PID:747
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:751
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:758
- /bin/systemctl
  systemctl --quiet is-active multi-user.target
  2⤵
  - Enumerates kernel/hardware configuration
  PID:764
- /bin/sed
  sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
  2⤵
  PID:775
- /bin/systemctl
  systemctl list-unit-files --full "--type=socket"
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:774

/usr/sbin/service
service sshd stop
1⤵
PID:749
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:757
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:763
- /bin/systemctl
  systemctl --quiet is-active multi-user.target
  2⤵
  - Enumerates kernel/hardware configuration
  PID:767
- /bin/systemctl
  systemctl list-unit-files --full "--type=socket"
  2⤵
  - Enumerates kernel/hardware configuration
  PID:778
- /bin/sed
  sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
  2⤵
  PID:779

/usr/bin/killall
killall -9 telnetd
1⤵
- Reads runtime system information
PID:755

/usr/bin/killall
killall -9 utelnetd
1⤵
- Reads runtime system information
PID:759

/usr/bin/killall
killall -9 dropbear
1⤵
- Reads runtime system information
PID:761

/usr/bin/killall
killall -9 sshd
1⤵
- Reads runtime system information
PID:765

/usr/bin/killall
killall -9 lighttpd
1⤵
- Reads runtime system information
PID:769

/usr/local/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop httpd.service
1⤵
PID:731

/usr/local/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop httpd.service
1⤵
PID:731

/usr/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop httpd.service
1⤵
PID:731

/usr/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop httpd.service
1⤵
PID:731

/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop httpd.service
1⤵
PID:731

/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop httpd.service
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:731

/usr/local/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop telnetd.service
1⤵
PID:747

/usr/local/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop telnetd.service
1⤵
PID:747

/usr/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop telnetd.service
1⤵
PID:747

/usr/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop telnetd.service
1⤵
PID:747

/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop telnetd.service
1⤵
PID:747

/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop telnetd.service
1⤵
- Enumerates kernel/hardware configuration
PID:747

/usr/local/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop sshd.service
1⤵
PID:749

/usr/local/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop sshd.service
1⤵
PID:749

/usr/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop sshd.service
1⤵
PID:749

/usr/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop sshd.service
1⤵
PID:749

/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop sshd.service
1⤵
PID:749

/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop sshd.service
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:749

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Indicator Removal

T1070

Timestomp

T1070.006

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/inittab2

Filesize
25B

MD5
e9b814d4e5b86c25d1c358084e248b06

SHA1
411fb7a5523a86fb463a787860ed2e24b71bb322

SHA256
64a4e363c0277a89bf1c1c7e208ef7a691a3539727eea024c4a5e2f678656b95

SHA512
a9540c700f392f8cc192bc097def17d0373a8fe8d52516f814cb7431b06b47c9ac338ce035d782c83d5c7db8bbef9fcf29487a81a0abecd25b3d3c5933a1fa04

Download Submit
/run/.x00740882966

Filesize
39B

MD5
50a4c4e1488834681534ce3efdb9068e

SHA1
9b54a359fda088ff5424694230b2bfb5e2807f13

SHA256
e5edae720d7e5448a5d1e2fabc204cf8d90c16dcaea0e239afea7431c9de57ae

SHA512
6fb7cf90e78d864e8a0ca7c6b5bb19a5bcef0f99d799f2d617e1a0afce869bc6f07e531ac971ce3ecf2d9864fc5dcddc3962b0bc8a29f8b253cf4f5dbf0ce27d

Download Submit
/var/spool/cron/crontabs/tmp.3CdHYz

Filesize
235B

MD5
9031359c428803dec460311165357058

SHA1
91d9477a77bbc7c981208c5ff596e21a69b07c33

SHA256
2f87724b7b4ecc32c980d8a90620db90d09ea3de96f7c98daf0834b09cd49853

SHA512
8d56f5d46f0a7a17258273fb7b0977d1e993c8cc6bd720294645a8f542df9bee5ba850995604dba8fedca0921ae24d0417425c7e4a0fed9e283bce354b355720

Download Submit
memory/667-1-0x00010000-0x00170b4c-memory.dmp

Download