kaiten | a1f211877e5ac29682f07d0b97d02ee936ed02f3355b68d7163b3336164d85f6

Analysis

max time kernel
19s
max time network
7s
platform
debian-9_mips
resource
debian9-mipsbe-20240418-en
resource tags

arch:mipsimage:debian9-mipsbe-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
22-10-2024 07:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

irq1
Size

510KB
MD5

2aa1abc12fdf779dbe4e71ed20111bce
SHA1

fee772fa1e9c94d9b89ffa3fa89df08c4a1fe84f
SHA256

a1f211877e5ac29682f07d0b97d02ee936ed02f3355b68d7163b3336164d85f6
SHA512

e9b95f9c28e39fa3c57f921ac2e55f5ee1b22d3664b8059f53610b059e620230ff63db7d39a5a9c256f39aa99d1b1333f4bd0acefe44bd826048c60b4e5c6fc0
SSDEEP

6144:21cNQ3N/6H7bvnWGSTOk/Gsw6apMBNedo+nS2Ref6zIfcxnjL/Va+wjdIBKPO7QZ:2CQd/SVV2PsfssIfyn/U+sm7Q380/

Score

10^/10

kaiten botnet defense_evasion discovery execution persistence privilege_escalatio

Malware Config

Signatures

Detects Kaiten/Tsunami Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/739-1-0x00400000-0x00568718-memory.dmp	family_kaiten2

Kaiten/Tsunami
Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.
botnet kaiten
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
execution persistence privilege_escalatio

Cron
T1053.003

Processes:

crontab

description ioc process

File opened for modification /var/spool/cron/crontabs/tmp.juuYTB crontab
Enumerates running processes
Discovers information about currently running processes on the system
Indicator Removal: Timestomp 1 TTPs 4 IoCs
Adversaries may remove indicators of compromise from the host to evade detection.
defense_evasion

Timestomp
T1070.006

Processes:

touchshtouchsh

pid process

782 touch
742 sh
747 touch
780 sh

description	ioc	process
File opened for modification	/var/spool/cron/crontabs/tmp.juuYTB	crontab

pid	process
782	touch
742	sh
747	touch
780	sh

Enumerates kernel/hardware configuration 1 TTPs 21 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

Processes:

systemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctl

description	ioc	process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

killallkillallkillallsystemctlsystemctlsedkillallkillallsedkillallsystemctlkillallsystemctlsystemctlsystemctlkillallsystemctl

description	ioc	process
File opened for reading	/proc/10/stat	killall
File opened for reading	/proc/720/stat	killall
File opened for reading	/proc/385/stat	killall
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/153/stat	killall
File opened for reading	/proc/23/stat	killall
File opened for reading	/proc/123/stat	killall
File opened for reading	/proc/732/stat	killall
File opened for reading	/proc/732/cmdline	killall
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/743/stat	killall
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/731/cmdline	killall
File opened for reading	/proc/667/stat	killall
File opened for reading	/proc/732/cmdline	killall
File opened for reading	/proc/379/stat	killall
File opened for reading	/proc/698/stat	killall
File opened for reading	/proc/783/stat	killall
File opened for reading	/proc/420/stat	killall
File opened for reading	/proc/6/stat	killall
File opened for reading	/proc/71/stat	killall
File opened for reading	/proc/736/stat	killall
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/809/stat	killall
File opened for reading	/proc/73/stat	killall
File opened for reading	/proc/80/stat	killall
File opened for reading	/proc/783/stat	killall
File opened for reading	/proc/75/stat	killall
File opened for reading	/proc/filesystems	killall
File opened for reading	/proc/6/stat	killall
File opened for reading	/proc/816/stat	killall
File opened for reading	/proc/filesystems	killall
File opened for reading	/proc/79/stat	killall
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/797/stat	killall
File opened for reading	/proc/13/stat	killall
File opened for reading	/proc/16/stat	killall
File opened for reading	/proc/11/stat	killall
File opened for reading	/proc/16/stat	killall
File opened for reading	/proc/2/stat	killall
File opened for reading	/proc/385/stat	killall
File opened for reading	/proc/837/stat	killall
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/74/stat	killall
File opened for reading	/proc/743/stat	killall
File opened for reading	/proc/79/stat	killall
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/837/stat	killall
File opened for reading	/proc/172/stat	killall
File opened for reading	/proc/720/stat	killall
File opened for reading	/proc/731/stat	killall
File opened for reading	/proc/737/stat	killall
File opened for reading	/proc/156/stat	killall
File opened for reading	/proc/701/stat	killall
File opened for reading	/proc/73/stat	killall
File opened for reading	/proc/245/stat	killall
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/36/stat	killall
File opened for reading	/proc/79/stat	killall

/tmp/irq1
/tmp/irq1
1⤵
PID:739
- /bin/sh
  sh -c "touch -acmr /bin/ls /tmp/irq1"
  2⤵
  - Indicator Removal: Timestomp
  PID:742
- - /usr/bin/touch
    touch -acmr /bin/ls /tmp/irq1
    3⤵
    - Indicator Removal: Timestomp
    PID:747
- /bin/sh
  sh -c "(crontab -l | grep -v \"/tmp/irq1\" | grep -v \"no cron\" | grep -v \"lesshts/run.sh\" > /var/run/.x00740882966) > /dev/null 2>&1"
  2⤵
  PID:749
- - /bin/grep
    grep -v /tmp/irq1
    3⤵
    PID:752
- - /usr/bin/crontab
    crontab -l
    3⤵
    PID:751
- - /bin/grep
    grep -v "no cron"
    3⤵
    PID:753
- - /bin/grep
    grep -v lesshts/run.sh
    3⤵
    PID:754
- /bin/sh
  sh -c "echo \"* * * * * /tmp/irq1 > /dev/null 2>&1 &\" >> /var/run/.x00740882966"
  2⤵
  PID:757
- /bin/sh
  sh -c "crontab /var/run/.x00740882966"
  2⤵
  PID:759
- - /usr/bin/crontab
    crontab /var/run/.x00740882966
    3⤵
    - Creates/modifies Cron job
    PID:761
- /bin/sh
  sh -c "rm -rf /var/run/.x00740882966"
  2⤵
  PID:765
- - /bin/rm
    rm -rf /var/run/.x00740882966
    3⤵
    PID:767
- /bin/sh
  sh -c "cat /etc/inittab | grep -v \"/tmp/irq1\" > /etc/inittab2"
  2⤵
  PID:769
- - /bin/cat
    cat /etc/inittab
    3⤵
    PID:770
- - /bin/grep
    grep -v /tmp/irq1
    3⤵
    PID:771
- /bin/sh
  sh -c "echo \"0:2345:respawn:/tmp/irq1\" >> /etc/inittab2"
  2⤵
  PID:774
- /bin/sh
  sh -c "cat /etc/inittab2 > /etc/inittab"
  2⤵
  PID:776
- - /bin/cat
    cat /etc/inittab2
    3⤵
    PID:777
- /bin/sh
  sh -c "rm -rf /etc/inittab2"
  2⤵
  PID:778
- - /bin/rm
    rm -rf /etc/inittab2
    3⤵
    PID:779
- /bin/sh
  sh -c "touch -acmr /bin/ls /etc/inittab"
  2⤵
  - Indicator Removal: Timestomp
  PID:780
- - /usr/bin/touch
    touch -acmr /bin/ls /etc/inittab
    3⤵
    - Indicator Removal: Timestomp
    PID:782
- /bin/sh
  sh -c "/bin/uname -n"
  2⤵
  PID:784
- - /bin/uname
    /bin/uname -n
    3⤵
    PID:786
- /bin/sh
  sh -c "/bin/uname -n"
  2⤵
  PID:787
- - /bin/uname
    /bin/uname -n
    3⤵
    PID:788
- /bin/sh
  sh -c "/bin/uname -n"
  2⤵
  PID:789
- - /bin/uname
    /bin/uname -n
    3⤵
    PID:790
- /bin/sh
  sh -c "kill -9 `cat /var/run/httpd.pid` > /dev/null 2>&1 &"
  2⤵
  PID:796
- - /bin/cat
    cat /var/run/httpd.pid
    3⤵
    PID:798
- /bin/sh
  sh -c "service httpd stop > /dev/null 2>&1 &"
  2⤵
  PID:799
- /bin/sh
  sh -c "killall -9 mini_httpd > /dev/null 2>&1 &"
  2⤵
  PID:801
- /bin/sh
  sh -c "killall -9 minihttpd > /dev/null 2>&1 &"
  2⤵
  PID:805
- /bin/sh
  sh -c "kill -9 `cat /var/run/thttpd.pid` > /dev/null 2>&1 &"
  2⤵
  PID:807
- - /bin/cat
    cat /var/run/thttpd.pid
    3⤵
    PID:810
- /bin/sh
  sh -c "nvram set httpd_enable=0 > /dev/null 2>&1"
  2⤵
  PID:809
- /bin/sh
  sh -c "nvram set http_enable=0 > /dev/null 2>&1"
  2⤵
  PID:811
- /bin/sh
  sh -c "killall -9 httpd > /dev/null 2>&1 &"
  2⤵
  PID:813
- /bin/sh
  sh -c "service telnetd stop > /dev/null 2>&1 &"
  2⤵
  PID:815
- /bin/sh
  sh -c "service sshd stop > /dev/null 2>&1 &"
  2⤵
  PID:817
- /bin/sh
  sh -c "killall -9 telnetd > /dev/null 2>&1 &"
  2⤵
  PID:819
- /bin/sh
  sh -c "killall -9 utelnetd > /dev/null 2>&1 &"
  2⤵
  PID:822
- /bin/sh
  sh -c "killall -9 dropbear > /dev/null 2>&1 &"
  2⤵
  PID:825
- /bin/sh
  sh -c "killall -9 sshd > /dev/null 2>&1 &"
  2⤵
  PID:829
- /bin/sh
  sh -c "killall -9 lighttpd > /dev/null 2>&1 &"
  2⤵
  PID:839

/usr/sbin/service
service httpd stop
1⤵
PID:800
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:802
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:803
- /bin/systemctl
  systemctl --quiet is-active multi-user.target
  2⤵
  - Enumerates kernel/hardware configuration
  PID:812
- /bin/systemctl
  systemctl list-unit-files --full "--type=socket"
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:833
- /bin/sed
  sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
  2⤵
  - Reads runtime system information
  PID:834

/usr/bin/killall
killall -9 mini_httpd
1⤵
- Reads runtime system information
PID:804

/usr/bin/killall
killall -9 minihttpd
1⤵
- Reads runtime system information
PID:806

/usr/bin/killall
killall -9 httpd
1⤵
- Reads runtime system information
PID:814

/usr/sbin/service
service telnetd stop
1⤵
PID:816
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:820
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:826
- /bin/systemctl
  systemctl --quiet is-active multi-user.target
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:831
- /bin/systemctl
  systemctl list-unit-files --full "--type=socket"
  2⤵
  - Enumerates kernel/hardware configuration
  PID:843
- /bin/sed
  sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
  2⤵
  - Reads runtime system information
  PID:844
- /bin/systemctl
  systemctl -p Triggers show dbus.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:847
- /bin/systemctl
  systemctl -p Triggers show ssh.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:848
- /bin/systemctl
  systemctl -p Triggers show syslog.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:852
- /bin/systemctl
  systemctl -p Triggers show systemd-fsckd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:853
- /bin/systemctl
  systemctl -p Triggers show systemd-initctl.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:855
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-audit.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:856
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-dev-log.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:857
- /bin/systemctl
  systemctl -p Triggers show systemd-journald.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:858
- /bin/systemctl
  systemctl -p Triggers show systemd-networkd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:859
- /bin/systemctl
  systemctl -p Triggers show systemd-rfkill.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:860
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-control.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:861
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-kernel.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:862

/usr/sbin/service
service sshd stop
1⤵
PID:818
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:823
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:827
- /bin/systemctl
  systemctl --quiet is-active multi-user.target
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:830
- /bin/systemctl
  systemctl list-unit-files --full "--type=socket"
  2⤵
  - Enumerates kernel/hardware configuration
  PID:836
- /bin/sed
  sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
  2⤵
  PID:837

/usr/bin/killall
killall -9 telnetd
1⤵
- Reads runtime system information
PID:821

/usr/bin/killall
killall -9 utelnetd
1⤵
- Reads runtime system information
PID:824

/usr/bin/killall
killall -9 dropbear
1⤵
- Reads runtime system information
PID:828

/usr/bin/killall
killall -9 sshd
1⤵
- Reads runtime system information
PID:838

/usr/bin/killall
killall -9 lighttpd
1⤵
- Reads runtime system information
PID:840

/usr/local/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop httpd.service
1⤵
PID:800

/usr/local/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop httpd.service
1⤵
PID:800

/usr/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop httpd.service
1⤵
PID:800

/usr/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop httpd.service
1⤵
PID:800

/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop httpd.service
1⤵
PID:800

/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop httpd.service
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:800

/usr/local/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop sshd.service
1⤵
PID:818

/usr/local/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop sshd.service
1⤵
PID:818

/usr/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop sshd.service
1⤵
PID:818

/usr/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop sshd.service
1⤵
PID:818

/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop sshd.service
1⤵
PID:818

/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop sshd.service
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:818

/usr/local/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop telnetd.service
1⤵
PID:816

/usr/local/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop telnetd.service
1⤵
PID:816

/usr/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop telnetd.service
1⤵
PID:816

/usr/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop telnetd.service
1⤵
PID:816

/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop telnetd.service
1⤵
PID:816

/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop telnetd.service
1⤵
- Enumerates kernel/hardware configuration
PID:816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Indicator Removal

T1070

Timestomp

T1070.006

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/inittab2

Filesize
25B

MD5
fb9937ff672674502da9a565b7576ed1

SHA1
4e152aef48427b3ed75a06b3b3ae8cd350dc57eb

SHA256
1204206d0f4e038ab65c11096d9ac595dd9ff9b4dd59415840051a756e610fd5

SHA512
b8c0fc312e26387cdeae8bac1c4470f8dd967d3a5706d386f9360ebd67693fb4bd5ed8fbb7ca9e4030cc8a6543fcdc6ccd562db0fa9404991a1dc4e7be01418e

Download Submit
/run/.x00740882966

Filesize
39B

MD5
d118ee982e25b7da8116537cd4fe7aaf

SHA1
faace3f0f5dcc4f28fe7d613fe4457f11452eb8c

SHA256
94fcb661559435e277be010ee5b1cae44f4660d70628924d8b8e8a184be7039d

SHA512
ee642d887f04c1bca7d7d191e8f101ffc5cfeec4e17b09fb608f8689a7cada704594dd42e4e74effbd339ce3321ec4c8976e0fb85345a3d37fc3be50a6a10a0d

Download Submit
/var/spool/cron/crontabs/tmp.juuYTB

Filesize
235B

MD5
ced4c39d059799b6f8b3a3a55427154b

SHA1
69ffc9c6ed1f6b991ce3bd08d34e4ccc3cfc1590

SHA256
ca43e6bdc3f34047ab41ef97c6886a814bfe7febc7b97dc99e3dcf3c1c8f50ef

SHA512
da5afee4c6c624e56286f825b810ee5ba7e34882c31af761ca87b965a84ece7ac46268ddbf8ae32c9efcaea2492af684c6b578aa61f5c9f07687108a369c61d7

Download Submit
memory/739-1-0x00400000-0x00568718-memory.dmp

Download