kaiten | a64ddaa1e3747b10863af3b60e79bbef1295a71ffdf3dd15a390d5926a6c3c13

Analysis

max time kernel
149s
max time network
154s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
23-10-2024 01:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a64ddaa1e3747b10863af3b60e79bbef1295a71ffdf3dd15a390d5926a6c3c13.elf
Size

605KB
MD5

8d4a6b005fe1b8b6ab08ac9501a13110
SHA1

ac3449f4ff85338a4cc99581070f358fb30ce1a1
SHA256

a64ddaa1e3747b10863af3b60e79bbef1295a71ffdf3dd15a390d5926a6c3c13
SHA512

7214699e67d101a6fb15e9a7571de1541480818bd399a6e26d018dd22ba33e8d8ebc42c2e7ba62b5268e595658eb57a7be744dee790cbeff71b7f18f9704bb84
SSDEEP

12288:To2aovPAC2u24h68Qugl3qCiJ7o6xt95DujbUjWWkGHnon3MYNBEEx9IRXa:8IvPAC2utTQug7iJ7oOtO3UjLkConLfx

Score

10^/10

kaiten botnet defense_evasion discovery execution persistence privilege_escalatio privilege_escalation

Malware Config

Signatures

Detects Kaiten/Tsunami Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/667-1-0x00010000-0x00170b4c-memory.dmp	family_kaiten2

Kaiten/Tsunami
Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.
botnet kaiten
Contacts a large (1016) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 3 IoCs
Abuse sudo or cached sudo credentials to execute code.
privilege_escalation defense_evasion

Sudo and Sudo Caching
T1548.003

Processes:

shsudosudo

pid process

886 sh
895 sudo
887 sudo
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
execution persistence privilege_escalatio

Cron
T1053.003

Processes:

crontab

description ioc process

File opened for modification /var/spool/cron/crontabs/tmp.qzT6hR crontab
Enumerates running processes
Discovers information about currently running processes on the system
Indicator Removal: Timestomp 1 TTPs 4 IoCs
Adversaries may remove indicators of compromise from the host to evade detection.
defense_evasion

Timestomp
T1070.006

Processes:

shtouchshtouch

pid process

677 sh
678 touch
713 sh
715 touch

pid	process
886	sh
895	sudo
887	sudo

description	ioc	process
File opened for modification	/var/spool/cron/crontabs/tmp.qzT6hR	crontab

pid	process
677	sh
678	touch
713	sh
715	touch

Enumerates kernel/hardware configuration 1 TTPs 12 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

Processes:

systemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctl

description	ioc	process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

killallkillallkillallkillallkillallkillallkillallkillallsystemctlsystemctlkillallsudo

description	ioc	process
File opened for reading	/proc/679/cmdline	killall
File opened for reading	/proc/15/stat	killall
File opened for reading	/proc/21/stat	killall
File opened for reading	/proc/27/stat	killall
File opened for reading	/proc/108/stat	killall
File opened for reading	/proc/141/stat	killall
File opened for reading	/proc/671/stat	killall
File opened for reading	/proc/3/stat	killall
File opened for reading	/proc/8/stat	killall
File opened for reading	/proc/24/stat	killall
File opened for reading	/proc/9/stat	killall
File opened for reading	/proc/275/stat	killall
File opened for reading	/proc/108/cmdline	killall
File opened for reading	/proc/659/stat	killall
File opened for reading	/proc/660/stat	killall
File opened for reading	/proc/18/stat	killall
File opened for reading	/proc/5/stat	killall
File opened for reading	/proc/732/stat	killall
File opened for reading	/proc/28/stat	killall
File opened for reading	/proc/14/stat	killall
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/42/stat	killall
File opened for reading	/proc/308/stat	killall
File opened for reading	/proc/665/stat	killall
File opened for reading	/proc/26/stat	killall
File opened for reading	/proc/105/stat	killall
File opened for reading	/proc/666/stat	killall
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/136/stat	killall
File opened for reading	/proc/279/stat	killall
File opened for reading	/proc/679/stat	killall
File opened for reading	/proc/24/stat	killall
File opened for reading	/proc/29/stat	killall
File opened for reading	/proc/105/stat	killall
File opened for reading	/proc/878/stat	killall
File opened for reading	/proc/107/stat	killall
File opened for reading	/proc/18/stat	killall
File opened for reading	/proc/136/stat	killall
File opened for reading	/proc/26/stat	killall
File opened for reading	/proc/763/stat	killall
File opened for reading	/proc/724/stat	killall
File opened for reading	/proc/669/stat	killall
File opened for reading	/proc/665/stat	killall
File opened for reading	/proc/622/stat	killall
File opened for reading	/proc/23/stat	killall
File opened for reading	/proc/147/stat	killall
File opened for reading	/proc/15/stat	killall
File opened for reading	/proc/740/stat	killall
File opened for reading	/proc/141/cmdline	killall
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/3/stat	killall
File opened for reading	/proc/724/stat	killall
File opened for reading	/proc/26/stat	killall
File opened for reading	/proc/337/stat	killall
File opened for reading	/proc/665/stat	killall
File opened for reading	/proc/14/stat	killall
File opened for reading	/proc/17/stat	killall
File opened for reading	/proc/24/stat	killall
File opened for reading	/proc/750/stat	killall
File opened for reading	/proc/404/stat	killall
File opened for reading	/proc/165/stat	killall
File opened for reading	/proc/278/stat	killall
File opened for reading	/proc/660/cmdline	killall
File opened for reading	/proc/23/stat	killall

/tmp/a64ddaa1e3747b10863af3b60e79bbef1295a71ffdf3dd15a390d5926a6c3c13.elf
/tmp/a64ddaa1e3747b10863af3b60e79bbef1295a71ffdf3dd15a390d5926a6c3c13.elf
1⤵
PID:667
- /bin/sh
  sh -c "touch -acmr /bin/ls /tmp/a64ddaa1e3747b10863af3b60e79bbef1295a71ffdf3dd15a390d5926a6c3c13.elf"
  2⤵
  - Indicator Removal: Timestomp
  PID:677
- - /usr/bin/touch
    touch -acmr /bin/ls /tmp/a64ddaa1e3747b10863af3b60e79bbef1295a71ffdf3dd15a390d5926a6c3c13.elf
    3⤵
    - Indicator Removal: Timestomp
    PID:678
- /bin/sh
  sh -c "(crontab -l | grep -v \"/tmp/a64ddaa1e3747b10863af3b60e79bbef1295a71ffdf3dd15a390d5926a6c3c13.elf\" | grep -v \"no cron\" | grep -v \"lesshts/run.sh\" > /var/run/.x00740882966) > /dev/null 2>&1"
  2⤵
  PID:680
- - /usr/bin/crontab
    crontab -l
    3⤵
    PID:683
- - /bin/grep
    grep -v /tmp/a64ddaa1e3747b10863af3b60e79bbef1295a71ffdf3dd15a390d5926a6c3c13.elf
    3⤵
    PID:685
- - /bin/grep
    grep -v "no cron"
    3⤵
    PID:686
- - /bin/grep
    grep -v lesshts/run.sh
    3⤵
    PID:687
- /bin/sh
  sh -c "echo \"* * * * * /tmp/a64ddaa1e3747b10863af3b60e79bbef1295a71ffdf3dd15a390d5926a6c3c13.elf > /dev/null 2>&1 &\" >> /var/run/.x00740882966"
  2⤵
  PID:690
- /bin/sh
  sh -c "crontab /var/run/.x00740882966"
  2⤵
  PID:692
- - /usr/bin/crontab
    crontab /var/run/.x00740882966
    3⤵
    - Creates/modifies Cron job
    PID:694
- /bin/sh
  sh -c "rm -rf /var/run/.x00740882966"
  2⤵
  PID:697
- - /bin/rm
    rm -rf /var/run/.x00740882966
    3⤵
    PID:699
- /bin/sh
  sh -c "cat /etc/inittab | grep -v \"/tmp/a64ddaa1e3747b10863af3b60e79bbef1295a71ffdf3dd15a390d5926a6c3c13.elf\" > /etc/inittab2"
  2⤵
  PID:701
- - /bin/cat
    cat /etc/inittab
    3⤵
    PID:703
- - /bin/grep
    grep -v /tmp/a64ddaa1e3747b10863af3b60e79bbef1295a71ffdf3dd15a390d5926a6c3c13.elf
    3⤵
    PID:704
- /bin/sh
  sh -c "echo \"0:2345:respawn:/tmp/a64ddaa1e3747b10863af3b60e79bbef1295a71ffdf3dd15a390d5926a6c3c13.elf\" >> /etc/inittab2"
  2⤵
  PID:707
- /bin/sh
  sh -c "cat /etc/inittab2 > /etc/inittab"
  2⤵
  PID:708
- - /bin/cat
    cat /etc/inittab2
    3⤵
    PID:709
- /bin/sh
  sh -c "rm -rf /etc/inittab2"
  2⤵
  PID:710
- - /bin/rm
    rm -rf /etc/inittab2
    3⤵
    PID:712
- /bin/sh
  sh -c "touch -acmr /bin/ls /etc/inittab"
  2⤵
  - Indicator Removal: Timestomp
  PID:713
- - /usr/bin/touch
    touch -acmr /bin/ls /etc/inittab
    3⤵
    - Indicator Removal: Timestomp
    PID:715
- /bin/sh
  sh -c "/bin/uname -n"
  2⤵
  PID:717
- - /bin/uname
    /bin/uname -n
    3⤵
    PID:718
- /bin/sh
  sh -c "/bin/uname -n"
  2⤵
  PID:720
- - /bin/uname
    /bin/uname -n
    3⤵
    PID:721
- /bin/sh
  sh -c "/bin/uname -n"
  2⤵
  PID:723
- - /bin/uname
    /bin/uname -n
    3⤵
    PID:725
- /bin/sh
  sh -c "kill -9 `cat /var/run/httpd.pid` > /dev/null 2>&1 &"
  2⤵
  PID:728
- - /bin/cat
    cat /var/run/httpd.pid
    3⤵
    PID:731
- /bin/sh
  sh -c "service httpd stop > /dev/null 2>&1 &"
  2⤵
  PID:730
- /bin/sh
  sh -c "killall -9 mini_httpd > /dev/null 2>&1 &"
  2⤵
  PID:733
- /bin/sh
  sh -c "killall -9 minihttpd > /dev/null 2>&1 &"
  2⤵
  PID:735
- /bin/sh
  sh -c "kill -9 `cat /var/run/thttpd.pid` > /dev/null 2>&1 &"
  2⤵
  PID:739
- - /bin/cat
    cat /var/run/thttpd.pid
    3⤵
    PID:742
- /bin/sh
  sh -c "nvram set httpd_enable=0 > /dev/null 2>&1"
  2⤵
  PID:741
- /bin/sh
  sh -c "nvram set http_enable=0 > /dev/null 2>&1"
  2⤵
  PID:744
- /bin/sh
  sh -c "killall -9 httpd > /dev/null 2>&1 &"
  2⤵
  PID:745
- /bin/sh
  sh -c "service telnetd stop > /dev/null 2>&1 &"
  2⤵
  PID:747
- /bin/sh
  sh -c "service sshd stop > /dev/null 2>&1 &"
  2⤵
  PID:752
- /bin/sh
  sh -c "killall -9 telnetd > /dev/null 2>&1 &"
  2⤵
  PID:754
- /bin/sh
  sh -c "killall -9 utelnetd > /dev/null 2>&1 &"
  2⤵
  PID:757
- /bin/sh
  sh -c "killall -9 dropbear > /dev/null 2>&1 &"
  2⤵
  PID:762
- /bin/sh
  sh -c "killall -9 sshd > /dev/null 2>&1 &"
  2⤵
  PID:765
- /bin/sh
  sh -c "killall -9 lighttpd > /dev/null 2>&1 &"
  2⤵
  PID:768
- /bin/sh
  sh -c "export PATH=/bin:/sbin:/usr/bin:/usr/local/bin:/usr/sbin;( kill -9 `cat /var/run/dropbear.pid` `cat /var/run/sshd.pid` ; killall -9 sshd dropbear ; /etc/init.d/dropbear stop )>/dev/null 2>&1 & "
  2⤵
  PID:872
- - /bin/cat
    cat /var/run/dropbear.pid
    3⤵
    PID:874
- - /bin/cat
    cat /var/run/sshd.pid
    3⤵
    PID:875
- - /usr/bin/killall
    killall -9 sshd dropbear
    3⤵
    - Reads runtime system information
    PID:876
- /bin/sh
  sh -c "export PATH=/bin:/sbin:/usr/bin:/usr/local/bin:/usr/sbin;(service dropbear stop ; sudo service sshd stop ; sudo systemctl stop ssh )>/dev/null 2>&1 & "
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:886
- - /usr/sbin/service
    service dropbear stop
    3⤵
    PID:888
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:889
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:890
  - - /bin/systemctl
      systemctl --quiet is-active multi-user.target
      4⤵
      Enumerates kernel/hardware configuration
      PID:891
  - - /bin/sed
      sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
      4⤵
      PID:894
  - - /bin/systemctl
      systemctl list-unit-files --full "--type=socket"
      4⤵
      Enumerates kernel/hardware configuration
      PID:893
- - /bin/systemctl
    systemctl "--job-mode=ignore-dependencies" stop dropbear.service
    3⤵
    - Enumerates kernel/hardware configuration
    PID:888
- - /usr/bin/sudo
    sudo service sshd stop
    3⤵
    - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
    - Reads runtime system information
    PID:895

/usr/sbin/service
service httpd stop
1⤵
PID:732
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:736
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:737
- /bin/systemctl
  systemctl --quiet is-active multi-user.target
  2⤵
  - Enumerates kernel/hardware configuration
  PID:743
- /bin/sed
  sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
  2⤵
  PID:750
- /bin/systemctl
  systemctl list-unit-files --full "--type=socket"
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:749

/usr/bin/killall
killall -9 mini_httpd
1⤵
- Reads runtime system information
PID:734

/usr/bin/killall
killall -9 minihttpd
1⤵
- Reads runtime system information
PID:738

/usr/bin/killall
killall -9 httpd
1⤵
- Reads runtime system information
PID:746

/usr/sbin/service
service telnetd stop
1⤵
PID:751
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:755
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:760
- /bin/systemctl
  systemctl --quiet is-active multi-user.target
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:766
- /bin/systemctl
  systemctl list-unit-files --full "--type=socket"
  2⤵
  - Enumerates kernel/hardware configuration
  PID:776
- /bin/sed
  sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
  2⤵
  PID:777

/usr/sbin/service
service sshd stop
1⤵
PID:753
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:759
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:763
- /bin/systemctl
  systemctl --quiet is-active multi-user.target
  2⤵
  - Enumerates kernel/hardware configuration
  PID:770
- /bin/systemctl
  systemctl list-unit-files --full "--type=socket"
  2⤵
  - Enumerates kernel/hardware configuration
  PID:781
- /bin/sed
  sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
  2⤵
  PID:782

/usr/bin/killall
killall -9 telnetd
1⤵
- Reads runtime system information
PID:756

/usr/bin/killall
killall -9 utelnetd
1⤵
- Reads runtime system information
PID:761

/usr/local/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop httpd.service
1⤵
PID:732

/usr/local/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop httpd.service
1⤵
PID:732

/usr/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop httpd.service
1⤵
PID:732

/usr/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop httpd.service
1⤵
PID:732

/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop httpd.service
1⤵
PID:732

/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop httpd.service
1⤵
- Enumerates kernel/hardware configuration
PID:732

/usr/bin/killall
killall -9 dropbear
1⤵
- Reads runtime system information
PID:764

/usr/bin/killall
killall -9 sshd
1⤵
- Reads runtime system information
PID:767

/usr/bin/killall
killall -9 lighttpd
1⤵
- Reads runtime system information
PID:771

/usr/local/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop telnetd.service
1⤵
PID:751

/usr/local/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop telnetd.service
1⤵
PID:751

/usr/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop telnetd.service
1⤵
PID:751

/usr/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop telnetd.service
1⤵
PID:751

/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop telnetd.service
1⤵
PID:751

/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop telnetd.service
1⤵
- Enumerates kernel/hardware configuration
PID:751

/usr/local/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop sshd.service
1⤵
PID:753

/usr/local/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop sshd.service
1⤵
PID:753

/usr/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop sshd.service
1⤵
PID:753

/usr/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop sshd.service
1⤵
PID:753

/sbin/systemctl
systemctl "--job-mode=ignore-dependencies" stop sshd.service
1⤵
PID:753

/bin/systemctl
systemctl "--job-mode=ignore-dependencies" stop sshd.service
1⤵
- Enumerates kernel/hardware configuration
PID:753

/etc/init.d/dropbear
/etc/init.d/dropbear stop
1⤵
PID:873

/usr/bin/sudo
sudo systemctl stop ssh
1⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
PID:887

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Indicator Removal

T1070

Timestomp

T1070.006

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/inittab2

Filesize
89B

MD5
fbf8241f54ea2341e9c856f67d3973b0

SHA1
2ad33aff157f8f6a07b5905063224ba9274c6185

SHA256
bbd4d75d7d1205b8f9e9c46b3924f1410e2eef4e82aa4395f6a851c7af0cd8d7

SHA512
153711dbce2bde6cca0a002cecc496f045d701f1ee0ee8f9e94cdfd2ec32fe5310db84d88afb8800d5d5c5bfb3522eacdd4f393db17ecdb47ff15dad6cd54738

Download Submit
/run/.x00740882966

Filesize
103B

MD5
a358c78f080b730d3bf47b771784d00c

SHA1
5f1b4a075f6a083f57c4cd958118ad3918fd26bb

SHA256
619f89d6f34ff3484833c177d6fda9f7d94aa06ff2e00c73e5495a57828883ad

SHA512
a0414d133059f29a66049aecd5fcf011302e3470180feb78482c50ee8023cbdeb2ebfc021c1221f111480b59df0801ffc88398cacbb16716a1545bb464d2744e

Download Submit
/var/spool/cron/crontabs/tmp.qzT6hR

Filesize
299B

MD5
3c1948358c9af8219e0d6b1bddf8b288

SHA1
1c65937fca025ed410c4a2cbbfba2747fc483337

SHA256
77a76879fd3176daf358cc652a6861a89099ffde7956dcc8ffb671affcfc153f

SHA512
82e89e7bcd2dfe836c840cdfa0cd332df219cd0f52a81d0ea3c13f3bbbd407bdaf43409a88c1687ccce66a39d90de4aaad94d57998cc44c73dedf14e54be2070

Download Submit
memory/667-1-0x00010000-0x00170b4c-memory.dmp

Download