kaiten | d6f7fa3acf502d0b6e11197d80d305748999225be6f4eaf28e05a7c94facd432 | Triage

Resubmissions

12/02/2025, 23:17

250212-291easzkdq 10

Analysis

max time kernel
0s
max time network
128s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
12/02/2025, 23:17

Sharing

Report Analysis Logs

General

Target

pty
Size

43KB
MD5

f92f2b6c2e7a924d864906b702f8ee88
SHA1

4f93d33a4da9c35c44fbdab3e819ca10f42ee3d3
SHA256

d6f7fa3acf502d0b6e11197d80d305748999225be6f4eaf28e05a7c94facd432
SHA512

91b20febb2c83ca0be99abf6aae58f0415005e22a3e93247fc7711b900bea6d2380f7c10000f3c8d22e46302acae8af99454b9e873658ace12494efeb043f721
SSDEEP

768:AStrEaF1mquHO0PPCIh+cgTi/7Qv6CKnbcuyD7UYctikLZDg:AQEERt0n6cgTi/7Qv6dnouy8YctikLG

Score

10^/10

kaiten botnet discovery

Malware Config

Signatures

Detects Kaiten/Tsunami Payload 1 IoCs

resource	yara_rule
behavioral2/memory/1508-1-0x0000000008048000-0x000000000805ff04-memory.dmp	family_kaiten2

Kaiten family
kaiten
Kaiten/Tsunami
Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.
botnet kaiten

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

description	ioc
File opened for reading	/proc/1496/cmdline

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads