kaiten | a64ddaa1e3747b10863af3b60e79bbef1295a71ffdf3dd15a390d5926a6c3c13

Analysis

max time kernel
18s
max time network
145s
platform
debian-12_armhf
resource
debian12-armhf-20240729-en
resource tags

arch:armhfimage:debian12-armhf-20240729-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
22/10/2024, 16:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

irq0.elf
Size

605KB
MD5

8d4a6b005fe1b8b6ab08ac9501a13110
SHA1

ac3449f4ff85338a4cc99581070f358fb30ce1a1
SHA256

a64ddaa1e3747b10863af3b60e79bbef1295a71ffdf3dd15a390d5926a6c3c13
SHA512

7214699e67d101a6fb15e9a7571de1541480818bd399a6e26d018dd22ba33e8d8ebc42c2e7ba62b5268e595658eb57a7be744dee790cbeff71b7f18f9704bb84
SSDEEP

12288:To2aovPAC2u24h68Qugl3qCiJ7o6xt95DujbUjWWkGHnon3MYNBEEx9IRXa:8IvPAC2utTQug7iJ7oOtO3UjLkConLfx

Score

10^/10

kaiten botnet defense_evasion discovery execution persistence privilege_escalatio

Malware Config

Signatures

Detects Kaiten/Tsunami Payload 1 IoCs

resource	yara_rule
behavioral1/memory/701-1-0x00010000-0x00170b4c-memory.dmp	family_kaiten2

Kaiten/Tsunami
Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.
botnet kaiten

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalatio

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.xuQXdJ	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Indicator Removal: Timestomp 1 TTPs 4 IoCs

Adversaries may remove indicators of compromise from the host to evade detection.

defense_evasion

Timestomp

T1070.006

pid	Process
708	sh
714	touch
755	sh
757	touch

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/317/stat	killall
File opened for reading	/proc/33	killall
File opened for reading	/proc/57/stat	killall
File opened for reading	/proc/73	killall
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/20	killall
File opened for reading	/proc/24	killall
File opened for reading	/proc/790/stat	killall
File opened for reading	/proc/31/stat	killall
File opened for reading	/proc/15	killall
File opened for reading	/proc/808	killall
File opened for reading	/proc/4	killall
File opened for reading	/proc/349/stat	killall
File opened for reading	/proc/45/stat	killall
File opened for reading	/proc/820/stat	killall
File opened for reading	/proc/664	killall
File opened for reading	/proc/self/exe	irq0.elf
File opened for reading	/proc/16	killall
File opened for reading	/proc/142/stat	killall
File opened for reading	/proc/294	killall
File opened for reading	/proc/664	killall
File opened for reading	/proc/19	killall
File opened for reading	/proc/349/stat	killall
File opened for reading	/proc/6/stat	killall
File opened for reading	/proc/371/stat	killall
File opened for reading	/proc/21/stat	killall
File opened for reading	/proc/142	killall
File opened for reading	/proc/327/stat	killall
File opened for reading	/proc/51/stat	killall
File opened for reading	/proc/803	killall
File opened for reading	/proc/706	killall
File opened for reading	/proc/44	killall
File opened for reading	/proc/35/stat	killall
File opened for reading	/proc/30/stat	killall
File opened for reading	/proc/211	killall
File opened for reading	/proc/9/stat	killall
File opened for reading	/proc/56	killall
File opened for reading	/proc/759/stat	killall
File opened for reading	/proc/3/stat	killall
File opened for reading	/proc/34	killall
File opened for reading	/proc/34/stat	killall
File opened for reading	/proc/759/stat	killall
File opened for reading	/proc/143/stat	killall
File opened for reading	/proc/19/stat	killall
File opened for reading	/proc/352/stat	killall
File opened for reading	/proc/267	killall
File opened for reading	/proc/143	killall
File opened for reading	/proc/692/stat	killall
File opened for reading	/proc/25	killall
File opened for reading	/proc/28	killall
File opened for reading	/proc/51/stat	killall
File opened for reading	/proc/32	killall
File opened for reading	/proc/57	killall
File opened for reading	/proc/645	killall
File opened for reading	/proc/11	killall
File opened for reading	/proc/11/stat	killall
File opened for reading	/proc/22/stat	killall
File opened for reading	/proc/4	killall
File opened for reading	/proc/645	killall
File opened for reading	/proc/22/stat	killall
File opened for reading	/proc/36	killall
File opened for reading	/proc/806	killall
File opened for reading	/proc/317/stat	killall

/tmp/irq0.elf
/tmp/irq0.elf
1⤵
- Reads runtime system information
PID:701
- /bin/sh
  sh -c "touch -acmr /bin/ls /tmp/irq0.elf"
  2⤵
  - Indicator Removal: Timestomp
  PID:708
- - /usr/bin/touch
    touch -acmr /bin/ls /tmp/irq0.elf
    3⤵
    - Indicator Removal: Timestomp
    PID:714
- /bin/sh
  sh -c "(crontab -l | grep -v \"/tmp/irq0.elf\" | grep -v \"no cron\" | grep -v \"lesshts/run.sh\" > /var/run/.x00740882966) > /dev/null 2>&1"
  2⤵
  PID:716
- - /usr/bin/crontab
    crontab -l
    3⤵
    PID:718
- - /usr/bin/grep
    grep -v /tmp/irq0.elf
    3⤵
    PID:719
- - /usr/bin/grep
    grep -v "no cron"
    3⤵
    - Reads runtime system information
    PID:720
- - /usr/bin/grep
    grep -v lesshts/run.sh
    3⤵
    PID:721
- /bin/sh
  sh -c "echo \"* * * * * /tmp/irq0.elf > /dev/null 2>&1 &\" >> /var/run/.x00740882966"
  2⤵
  PID:724
- /bin/sh
  sh -c "crontab /var/run/.x00740882966"
  2⤵
  PID:725
- - /usr/bin/crontab
    crontab /var/run/.x00740882966
    3⤵
    - Creates/modifies Cron job
    PID:727
- /bin/sh
  sh -c "rm -rf /var/run/.x00740882966"
  2⤵
  PID:731
- - /usr/bin/rm
    rm -rf /var/run/.x00740882966
    3⤵
    PID:732
- /bin/sh
  sh -c "cat /etc/inittab | grep -v \"/tmp/irq0.elf\" > /etc/inittab2"
  2⤵
  PID:736
- - /usr/bin/cat
    cat /etc/inittab
    3⤵
    PID:738
- - /usr/bin/grep
    grep -v /tmp/irq0.elf
    3⤵
    PID:739
- /bin/sh
  sh -c "echo \"0:2345:respawn:/tmp/irq0.elf\" >> /etc/inittab2"
  2⤵
  PID:742
- /bin/sh
  sh -c "cat /etc/inittab2 > /etc/inittab"
  2⤵
  PID:744
- - /usr/bin/cat
    cat /etc/inittab2
    3⤵
    PID:747
- /bin/sh
  sh -c "rm -rf /etc/inittab2"
  2⤵
  PID:750
- - /usr/bin/rm
    rm -rf /etc/inittab2
    3⤵
    PID:753
- /bin/sh
  sh -c "touch -acmr /bin/ls /etc/inittab"
  2⤵
  - Indicator Removal: Timestomp
  PID:755
- - /usr/bin/touch
    touch -acmr /bin/ls /etc/inittab
    3⤵
    - Indicator Removal: Timestomp
    PID:757
- /bin/sh
  sh -c "/bin/uname -n"
  2⤵
  PID:761
- - /bin/uname
    /bin/uname -n
    3⤵
    PID:763
- /bin/sh
  sh -c "/bin/uname -n"
  2⤵
  PID:764
- - /bin/uname
    /bin/uname -n
    3⤵
    PID:765
- /bin/sh
  sh -c "/bin/uname -n"
  2⤵
  PID:767
- - /bin/uname
    /bin/uname -n
    3⤵
    PID:769
- /bin/sh
  sh -c "kill -9 `cat /var/run/httpd.pid` > /dev/null 2>&1 &"
  2⤵
  PID:786
- - /usr/bin/cat
    cat /var/run/httpd.pid
    3⤵
    PID:789
- /bin/sh
  sh -c "service httpd stop > /dev/null 2>&1 &"
  2⤵
  PID:788
- /bin/sh
  sh -c "killall -9 mini_httpd > /dev/null 2>&1 &"
  2⤵
  PID:791
- /bin/sh
  sh -c "killall -9 minihttpd > /dev/null 2>&1 &"
  2⤵
  PID:793
- /bin/sh
  sh -c "kill -9 `cat /var/run/thttpd.pid` > /dev/null 2>&1 &"
  2⤵
  PID:796
- - /usr/bin/cat
    cat /var/run/thttpd.pid
    3⤵
    PID:800
- /bin/sh
  sh -c "nvram set httpd_enable=0 > /dev/null 2>&1"
  2⤵
  PID:799
- /bin/sh
  sh -c "nvram set http_enable=0 > /dev/null 2>&1"
  2⤵
  PID:804
- /bin/sh
  sh -c "killall -9 httpd > /dev/null 2>&1 &"
  2⤵
  PID:805
- /bin/sh
  sh -c "service telnetd stop > /dev/null 2>&1 &"
  2⤵
  PID:807
- /bin/sh
  sh -c "service sshd stop > /dev/null 2>&1 &"
  2⤵
  PID:809
- /bin/sh
  sh -c "killall -9 telnetd > /dev/null 2>&1 &"
  2⤵
  PID:812
- /bin/sh
  sh -c "killall -9 utelnetd > /dev/null 2>&1 &"
  2⤵
  PID:815
- /bin/sh
  sh -c "killall -9 dropbear > /dev/null 2>&1 &"
  2⤵
  PID:821
- /bin/sh
  sh -c "killall -9 sshd > /dev/null 2>&1 &"
  2⤵
  PID:824
- /bin/sh
  sh -c "killall -9 lighttpd > /dev/null 2>&1 &"
  2⤵
  PID:829

/usr/sbin/service
service httpd stop
1⤵
PID:790
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:794
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:797
- /usr/bin/systemctl
  systemctl list-unit-files --full "--type=socket"
  2⤵
  - Reads runtime system information
  PID:802
- /usr/bin/sed
  sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
  2⤵
  PID:803

/usr/bin/killall
killall -9 mini_httpd
1⤵
- Reads runtime system information
PID:792

/usr/bin/killall
killall -9 minihttpd
1⤵
- Reads runtime system information
PID:795

/usr/bin/killall
killall -9 httpd
1⤵
- Reads runtime system information
PID:806

/usr/sbin/service
service telnetd stop
1⤵
PID:808
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:810
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:813
- /usr/bin/systemctl
  systemctl list-unit-files --full "--type=socket"
  2⤵
  PID:818
- /usr/bin/sed
  sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
  2⤵
  PID:819

/usr/sbin/service
service sshd stop
1⤵
PID:811
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:816
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:822
- /usr/bin/systemctl
  systemctl list-unit-files --full "--type=socket"
  2⤵
  PID:826
- /usr/bin/sed
  sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
  2⤵
  PID:828

/usr/bin/killall
killall -9 telnetd
1⤵
- Reads runtime system information
PID:814

/usr/bin/killall
killall -9 utelnetd
1⤵
- Reads runtime system information
PID:820

/usr/bin/killall
killall -9 dropbear
1⤵
- Reads runtime system information
PID:823

/usr/bin/killall
killall -9 sshd
1⤵
- Reads runtime system information
PID:827

/usr/bin/killall
killall -9 lighttpd
1⤵
- Reads runtime system information
PID:830

/usr/local/sbin/systemctl
systemctl stop httpd.service
1⤵
PID:790

/usr/local/bin/systemctl
systemctl stop httpd.service
1⤵
PID:790

/usr/sbin/systemctl
systemctl stop httpd.service
1⤵
PID:790

/usr/bin/systemctl
systemctl stop httpd.service
1⤵
PID:790

/usr/local/sbin/systemctl
systemctl stop telnetd.service
1⤵
PID:808

/usr/local/bin/systemctl
systemctl stop telnetd.service
1⤵
PID:808

/usr/sbin/systemctl
systemctl stop telnetd.service
1⤵
PID:808

/usr/bin/systemctl
systemctl stop telnetd.service
1⤵
PID:808

/usr/local/sbin/systemctl
systemctl stop sshd.service
1⤵
PID:811

/usr/local/bin/systemctl
systemctl stop sshd.service
1⤵
PID:811

/usr/sbin/systemctl
systemctl stop sshd.service
1⤵
PID:811

/usr/bin/systemctl
systemctl stop sshd.service
1⤵
PID:811

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Indicator Removal

T1070

Timestomp

T1070.006

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/inittab2

Filesize
29B

MD5
9e2faa9a5c5b8544c36f7149dd216cde

SHA1
feb39d80f8bb9f1b73cb15cdc8499c3e08cb040d

SHA256
f89412d6c95dc19031d53bbc236078eb3d49cffcddefcc91e61837ceb905dcc4

SHA512
407ae5ee1a393779659da4f46b87e828a9eead87909477b88962d5e155edd35db7be7049f542e9fad9815e113fd2929a325357b711c739ac155a72b7396e50b3

Download Submit
/run/.x00740882966

Filesize
43B

MD5
eb4a764404b3c0e9147770997a096857

SHA1
ed331f1dfd794db80e9f326b31cedeccb9f045b9

SHA256
b9c152feecbbe0f96cf6d35e10fc99d81d0b002cc25eb5d47e4c649ec6386385

SHA512
e40e51e768bfcb398355752448a7e5177a91803addce90b94340fe76602311c6f37b948c548d2ddff31d36395975a8fd18e0c8cf4e02436c72a1f44601ce59d2

Download Submit
/var/spool/cron/crontabs/tmp.xuQXdJ

Filesize
239B

MD5
83ad0cf95f298625657ef732ada1fe04

SHA1
6b1a28c7907548a114cc5659262f64c7488f5e9a

SHA256
59683a0138dd91ea29bb027fd200b7185aa187d041d574433f7835e7c4938bde

SHA512
db88a8de3f5426720716be7f6725250140eec1089af722471c708b1194e0a45c5dbc77d5510cd76278ff94ef5ffe88ab81950f84677f109c56cc267bfdfd3e97

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads