kaiten | b57efcb80a4f88099ebcdae1af74f264329418f6ab008f23774b26da71440d6b

Analysis

max time kernel
149s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20261019-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
20/10/2026, 01:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-19_d8f03d50055238ae97b10e539d0815ab_qnapcrypt
Size 2.1MB
Sample261020-ca61cssz4p
SHA256 b57efcb80a4f88099ebcdae1af74f264329418f6ab008f23774b26da71440d6b
MD5 d8f03d50055238ae97b10e539d0815ab
SHA1 a68fc75ae40ac7530bb941f84a38664210b203ba
SHA512 5d6a67b7eda97cb19527f6afe06aeb7417b3d573a0d6403899438f01a38eb892b03ac71445a9c3402daa474717ec79aa1562c0e6832156e3f489396b4ac9a61d
SSDEEP 49152:+RjaqvOtzOsHZrb/TBvO90d7HjmAFd4A64nsfJmN++g8vWn1aqZqD1CePMU2QGMj:fH7HP/g0pt
TLSH
T129A58D07BC9111AAC1EA93328DA651A27771BC990F2063D73F51B3B82F767D85E39318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

botnet discovery kaiten

Malware Config

Signatures

Family: Kaiten,Tsunami
Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.
botnet kaiten

Detects Kaiten/Tsunami payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-1.dat	family_kaiten

Runs EXE from memory 1 IoCs

Runs an executable from memory, likely to minimize footprint

ioc	pid	Process
/proc/self/fd/3	1529	2026-10-19_d8f03d50055238ae97b10e539d0815ab_qnapcrypt

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	2026-10-19_d8f03d50055238ae97b10e539d0815ab_qnapcrypt

/tmp/2026-10-19_d8f03d50055238ae97b10e539d0815ab_qnapcrypt
/tmp/2026-10-19_d8f03d50055238ae97b10e539d0815ab_qnapcrypt
1⤵
- Runs EXE from memory
- Enumerates kernel/hardware configuration
PID:1529

/proc/self/fd/3
/bin/bash
1⤵
PID:1529

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path /proc/self/fd/3
Size 106KB
SHA256 fb499a3d817237d7af76e8ae9b379d70ec25883879f5c9bc647f1ebe4227850f
MD5 c24496ace41ed58b11ff9c7f66a25e2e
SHA1 4743262157b40da37ecc7ccacd2b087153dd4448
SHA512 0311ee3673ec45231fd1effb1660842dc0e9e6aa97b8a665b7dbee413ed4de620503bf0cb92e7f8956c980e78920020dd3f92e6e18a85d0cd12a411eb1749897
SSDEEP 1536:VsnZBjjVQVubtoH8lKf7F17whaLHDaxtiGBvaLahOzr:OZBjxQcWcyfwhaqjtFW
TLSH
T1A3B36B97B75A91B2C0E6F3382CCB4771717378F4477281973608236E9BB1BD98E29642
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download