kaiten | a1f211877e5ac29682f07d0b97d02ee936ed02f3355b68d7163b3336164d85f6 | Triage

Sharing

General

Target

a1f211877e5ac29682f07d0b97d02ee936ed02f3355b68d7163b3336164d85f6.elf
Size

510KB
Sample

241023-b182zavcrh
MD5

2aa1abc12fdf779dbe4e71ed20111bce
SHA1

fee772fa1e9c94d9b89ffa3fa89df08c4a1fe84f
SHA256

a1f211877e5ac29682f07d0b97d02ee936ed02f3355b68d7163b3336164d85f6
SHA512

e9b95f9c28e39fa3c57f921ac2e55f5ee1b22d3664b8059f53610b059e620230ff63db7d39a5a9c256f39aa99d1b1333f4bd0acefe44bd826048c60b4e5c6fc0
SSDEEP

6144:21cNQ3N/6H7bvnWGSTOk/Gsw6apMBNedo+nS2Ref6zIfcxnjL/Va+wjdIBKPO7QZ:2CQd/SVV2PsfssIfyn/U+sm7Q380/

Score

10^/10

kaiten botnet defense_evasion discovery execution persistence privilege_escalatio privilege_escalation

Malware Config

Targets

- Target
  
  a1f211877e5ac29682f07d0b97d02ee936ed02f3355b68d7163b3336164d85f6.elf
- Size
  
  510KB
- MD5
  
  2aa1abc12fdf779dbe4e71ed20111bce
- SHA1
  
  fee772fa1e9c94d9b89ffa3fa89df08c4a1fe84f
- SHA256
  
  a1f211877e5ac29682f07d0b97d02ee936ed02f3355b68d7163b3336164d85f6
- SHA512
  
  e9b95f9c28e39fa3c57f921ac2e55f5ee1b22d3664b8059f53610b059e620230ff63db7d39a5a9c256f39aa99d1b1333f4bd0acefe44bd826048c60b4e5c6fc0
- SSDEEP
  
  6144:21cNQ3N/6H7bvnWGSTOk/Gsw6apMBNedo+nS2Ref6zIfcxnjL/Va+wjdIBKPO7QZ:2CQd/SVV2PsfssIfyn/U+sm7Q380/
Score

10^/10

kaiten botnet defense_evasion discovery execution persistence privilege_escalatio privilege_escalation
- Detects Kaiten/Tsunami Payload
- Kaiten/Tsunami
  Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.
  botnet kaiten
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  Abuse sudo or cached sudo credentials to execute code.
  privilege_escalation defense_evasion
- Creates/modifies Cron job
  Cron allows running tasks on a schedule, and is commonly used for malware persistence.
  execution persistence privilege_escalatio
- Enumerates running processes
  Discovers information about currently running processes on the system
- Indicator Removal: Timestomp
  Adversaries may remove indicators of compromise from the host to evade detection.
  defense_evasion
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Cron

Persistence

Scheduled Task/Job

Cron

Privilege Escalation

Abuse Elevation Control Mechanism

Sudo and Sudo Caching

Scheduled Task/Job

Cron

Defense Evasion

Abuse Elevation Control Mechanism

Sudo and Sudo Caching

Indicator Removal

Timestomp

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

kaitenbotnetdefense_evasiondiscoveryexecutionpersistenceprivilege_escalatioprivilege_escalation