kaiten | 8e9cd77c31ba14b925208fa5e3d9f5675909f0a5ebc2399bdd9e36279314abd1

Analysis

max time kernel
36s
max time network
12s
platform
debian-12_mipsel
resource
debian12-mipsel-20240221-en
resource tags

arch:mipselimage:debian12-mipsel-20240221-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem
submitted
27-10-2024 11:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

irq2
Size

515KB
MD5

2ad737fb9e6ce08a164ddb8386f19b16
SHA1

86e87501edbdb8b6ee6ada9497ba2b62d741decc
SHA256

8e9cd77c31ba14b925208fa5e3d9f5675909f0a5ebc2399bdd9e36279314abd1
SHA512

068f4f7659c1d29ac0a6510e591100fba7fa1ffc445db21ce6487d77c8b34370fce3a24b4e9ff18b8910757123f593342dd80e473c0e337e7fa504eb3a13754f
SSDEEP

12288:v/J7M48SdpPK0RkLbZLn4nQdVV05tXqozEpwK9:HplxmLbJ4sY5tlzuv

Score

10^/10

kaiten botnet defense_evasion discovery execution persistence privilege_escalatio

Malware Config

Signatures

Detects Kaiten/Tsunami Payload 1 IoCs

resource	yara_rule
behavioral1/memory/743-1-0x00400000-0x005777e8-memory.dmp	family_kaiten2

Kaiten family
kaiten
Kaiten/Tsunami
Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.
botnet kaiten

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalatio

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.EzCKHu	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Indicator Removal: Timestomp 1 TTPs 4 IoCs

Adversaries may remove indicators of compromise from the host to evade detection.

defense_evasion

Timestomp

T1070.006

pid	Process
752	touch
789	sh
791	touch
749	sh

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/33	killall
File opened for reading	/proc/30/stat	killall
File opened for reading	/proc/829	killall
File opened for reading	/proc/6	killall
File opened for reading	/proc/341	killall
File opened for reading	/proc/33	killall
File opened for reading	/proc/42	killall
File opened for reading	/proc/6	killall
File opened for reading	/proc/29	killall
File opened for reading	/proc/22	killall
File opened for reading	/proc/831	killall
File opened for reading	/proc/26	killall
File opened for reading	/proc/679/stat	killall
File opened for reading	/proc/47/stat	killall
File opened for reading	/proc/115	killall
File opened for reading	/proc/354/stat	killall
File opened for reading	/proc/18	killall
File opened for reading	/proc/698	killall
File opened for reading	/proc/841/stat	killall
File opened for reading	/proc/24	killall
File opened for reading	/proc/341	killall
File opened for reading	/proc/137/cmdline	killall
File opened for reading	/proc/851	killall
File opened for reading	/proc/19/stat	killall
File opened for reading	/proc/3/stat	killall
File opened for reading	/proc/10	killall
File opened for reading	/proc/24	killall
File opened for reading	/proc/27/stat	killall
File opened for reading	/proc/19/stat	killall
File opened for reading	/proc/180	killall
File opened for reading	/proc/10/stat	killall
File opened for reading	/proc/34/stat	killall
File opened for reading	/proc/450/stat	killall
File opened for reading	/proc/4	killall
File opened for reading	/proc/6/stat	killall
File opened for reading	/proc/4	killall
File opened for reading	/proc/1/stat	killall
File opened for reading	/proc/31/stat	killall
File opened for reading	/proc/6/stat	killall
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/813	killall
File opened for reading	/proc/37	killall
File opened for reading	/proc/732/stat	killall
File opened for reading	/proc/11	killall
File opened for reading	/proc/44/stat	killall
File opened for reading	/proc/59/stat	killall
File opened for reading	/proc/13	killall
File opened for reading	/proc/42/stat	killall
File opened for reading	/proc/114	killall
File opened for reading	/proc/809	killall
File opened for reading	/proc/5	killall
File opened for reading	/proc/818	killall
File opened for reading	/proc/114	killall
File opened for reading	/proc/26	killall
File opened for reading	/proc/818/stat	killall
File opened for reading	/proc/47	killall
File opened for reading	/proc/2	killall
File opened for reading	/proc/114	killall
File opened for reading	/proc/710/stat	killall
File opened for reading	/proc/710/stat	killall
File opened for reading	/proc/1/stat	killall
File opened for reading	/proc/4	killall
File opened for reading	/proc/28/stat	killall
File opened for reading	/proc/30/stat	killall

/tmp/irq2
/tmp/irq2
1⤵
PID:743
- /bin/sh
  sh -c "touch -acmr /bin/ls /tmp/irq2"
  2⤵
  - Indicator Removal: Timestomp
  PID:749
- - /usr/bin/touch
    touch -acmr /bin/ls /tmp/irq2
    3⤵
    - Indicator Removal: Timestomp
    PID:752
- /bin/sh
  sh -c "(crontab -l | grep -v \"/tmp/irq2\" | grep -v \"no cron\" | grep -v \"lesshts/run.sh\" > /var/run/.x00740882966) > /dev/null 2>&1"
  2⤵
  PID:755
- - /usr/bin/crontab
    crontab -l
    3⤵
    PID:758
- - /usr/bin/grep
    grep -v /tmp/irq2
    3⤵
    PID:759
- - /usr/bin/grep
    grep -v "no cron"
    3⤵
    PID:760
- - /usr/bin/grep
    grep -v lesshts/run.sh
    3⤵
    PID:761
- /bin/sh
  sh -c "echo \"* * * * * /tmp/irq2 > /dev/null 2>&1 &\" >> /var/run/.x00740882966"
  2⤵
  PID:766
- /bin/sh
  sh -c "crontab /var/run/.x00740882966"
  2⤵
  PID:768
- - /usr/bin/crontab
    crontab /var/run/.x00740882966
    3⤵
    - Creates/modifies Cron job
    PID:770
- /bin/sh
  sh -c "rm -rf /var/run/.x00740882966"
  2⤵
  PID:774
- - /usr/bin/rm
    rm -rf /var/run/.x00740882966
    3⤵
    PID:776
- /bin/sh
  sh -c "cat /etc/inittab | grep -v \"/tmp/irq2\" > /etc/inittab2"
  2⤵
  PID:778
- - /usr/bin/cat
    cat /etc/inittab
    3⤵
    PID:780
- - /usr/bin/grep
    grep -v /tmp/irq2
    3⤵
    PID:781
- /bin/sh
  sh -c "echo \"0:2345:respawn:/tmp/irq2\" >> /etc/inittab2"
  2⤵
  PID:783
- /bin/sh
  sh -c "cat /etc/inittab2 > /etc/inittab"
  2⤵
  PID:784
- /bin/sh
  sh -c "rm -rf /etc/inittab2"
  2⤵
  PID:786
- - /usr/bin/rm
    rm -rf /etc/inittab2
    3⤵
    PID:788
- /bin/sh
  sh -c "touch -acmr /bin/ls /etc/inittab"
  2⤵
  - Indicator Removal: Timestomp
  PID:789
- - /usr/bin/touch
    touch -acmr /bin/ls /etc/inittab
    3⤵
    - Indicator Removal: Timestomp
    PID:791
- /bin/sh
  sh -c "/bin/uname -n"
  2⤵
  PID:795
- - /bin/uname
    /bin/uname -n
    3⤵
    PID:797
- /bin/sh
  sh -c "/bin/uname -n"
  2⤵
  PID:800
- - /bin/uname
    /bin/uname -n
    3⤵
    PID:801
- /bin/sh
  sh -c "/bin/uname -n"
  2⤵
  PID:803
- - /bin/uname
    /bin/uname -n
    3⤵
    PID:805
- /bin/sh
  sh -c "kill -9 `cat /var/run/httpd.pid` > /dev/null 2>&1 &"
  2⤵
  PID:814
- - /usr/bin/cat
    cat /var/run/httpd.pid
    3⤵
    PID:817
- /bin/sh
  sh -c "service httpd stop > /dev/null 2>&1 &"
  2⤵
  PID:816
- /bin/sh
  sh -c "killall -9 mini_httpd > /dev/null 2>&1 &"
  2⤵
  PID:819
- /bin/sh
  sh -c "killall -9 minihttpd > /dev/null 2>&1 &"
  2⤵
  PID:821
- /bin/sh
  sh -c "kill -9 `cat /var/run/thttpd.pid` > /dev/null 2>&1 &"
  2⤵
  PID:824
- - /usr/bin/cat
    cat /var/run/thttpd.pid
    3⤵
    PID:828
- /bin/sh
  sh -c "nvram set httpd_enable=0 > /dev/null 2>&1"
  2⤵
  PID:827
- /bin/sh
  sh -c "nvram set http_enable=0 > /dev/null 2>&1"
  2⤵
  PID:832
- /bin/sh
  sh -c "killall -9 httpd > /dev/null 2>&1 &"
  2⤵
  PID:833
- /bin/sh
  sh -c "service telnetd stop > /dev/null 2>&1 &"
  2⤵
  PID:835
- /bin/sh
  sh -c "service sshd stop > /dev/null 2>&1 &"
  2⤵
  PID:837
- /bin/sh
  sh -c "killall -9 telnetd > /dev/null 2>&1 &"
  2⤵
  PID:839
- /bin/sh
  sh -c "killall -9 utelnetd > /dev/null 2>&1 &"
  2⤵
  PID:843
- /bin/sh
  sh -c "killall -9 dropbear > /dev/null 2>&1 &"
  2⤵
  PID:847
- /bin/sh
  sh -c "killall -9 sshd > /dev/null 2>&1 &"
  2⤵
  PID:850
- /bin/sh
  sh -c "killall -9 lighttpd > /dev/null 2>&1 &"
  2⤵
  PID:857

/usr/sbin/service
service httpd stop
1⤵
PID:818
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:822
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:825
- /usr/bin/systemctl
  systemctl list-unit-files --full "--type=socket"
  2⤵
  PID:830
- /usr/bin/sed
  sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
  2⤵
  PID:831

/usr/bin/killall
killall -9 mini_httpd
1⤵
- Reads runtime system information
PID:820

/usr/bin/killall
killall -9 minihttpd
1⤵
- Reads runtime system information
PID:823

/usr/bin/killall
killall -9 httpd
1⤵
- Reads runtime system information
PID:834

/usr/sbin/service
service telnetd stop
1⤵
PID:836
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:840
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:845
- /usr/bin/sed
  sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
  2⤵
  PID:853
- /usr/bin/systemctl
  systemctl list-unit-files --full "--type=socket"
  2⤵
  PID:852

/usr/sbin/service
service sshd stop
1⤵
PID:838
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:842
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:844
- /usr/bin/sed
  sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
  2⤵
  PID:855
- /usr/bin/systemctl
  systemctl list-unit-files --full "--type=socket"
  2⤵
  PID:854

/usr/bin/killall
killall -9 telnetd
1⤵
- Reads runtime system information
PID:841

/usr/bin/killall
killall -9 utelnetd
1⤵
- Reads runtime system information
PID:846

/usr/bin/killall
killall -9 dropbear
1⤵
- Reads runtime system information
PID:848

/usr/bin/killall
killall -9 sshd
1⤵
- Reads runtime system information
PID:856

/usr/bin/killall
killall -9 lighttpd
1⤵
- Reads runtime system information
PID:858

/usr/local/sbin/systemctl
systemctl stop httpd.service
1⤵
PID:818

/usr/local/bin/systemctl
systemctl stop httpd.service
1⤵
PID:818

/usr/sbin/systemctl
systemctl stop httpd.service
1⤵
PID:818

/usr/bin/systemctl
systemctl stop httpd.service
1⤵
PID:818

/usr/local/sbin/systemctl
systemctl stop telnetd.service
1⤵
PID:836

/usr/local/bin/systemctl
systemctl stop telnetd.service
1⤵
PID:836

/usr/sbin/systemctl
systemctl stop telnetd.service
1⤵
PID:836

/usr/bin/systemctl
systemctl stop telnetd.service
1⤵
PID:836

/usr/local/sbin/systemctl
systemctl stop sshd.service
1⤵
PID:838

/usr/local/bin/systemctl
systemctl stop sshd.service
1⤵
PID:838

/usr/sbin/systemctl
systemctl stop sshd.service
1⤵
PID:838

/usr/bin/systemctl
systemctl stop sshd.service
1⤵
- Reads runtime system information
PID:838

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Indicator Removal

T1070

Timestomp

T1070.006

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/inittab2

Filesize
25B

MD5
23a6588a2dbaf98c20dd9ad548f99576

SHA1
1d4504154b3abcef8b652f4832de895669737941

SHA256
6c7a9e9b6883cbcff02f673e5fb8bcdbe0b23459f0e063b80cba76ad22b1aff0

SHA512
de52be0bb66cc880f2cdd0cfc9d47949cbfa161a286d48d22fc22b42f484fcdb4317f34ee05194ab8f61b54e444d04c69459c5bb2fa4ebf8542194949fbc4837

Download Submit
/run/.x00740882966

Filesize
39B

MD5
65c1bbfcb74ec6f5c0efb513ebf1e69d

SHA1
a7a758354c25c91d88d9da83f90552bd9f973e9b

SHA256
5ca8963c17b0b8ff4dc3d6ac469b22eed780405b6574ab26b7da3074cc089001

SHA512
b86ac43a202e47d1ec305904b7227f9c5b32389b7702f9fa0856674812ae7c33f9a410901b14f6e9428fc14428c5adfaac20690d4d74c8755582566890e06abc

Download Submit
/var/spool/cron/crontabs/tmp.EzCKHu

Filesize
235B

MD5
86914499bb6f61e546b730041a1f6ed9

SHA1
984e52fa12f9fda8c27d801a350158e1a3345d7b

SHA256
c69f56374b512e816ad31ea035f4ae2f16127096a52e359457982b0ddf3fa1c1

SHA512
129913a5dbe6e6bb5fabab4e5a76291af0cf8f457f820dba725bf569411902df82a54ccb16978aa1f0b8d2caa27b8511a2ec6c2c637a59d4b4822947207499b9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads