KaitenMalware
According to netenrich, Kaiten is a Trojan horse that opens a back door on the compromised computer that allows it to perform other malicious activities. The trojan does not create any copies of itself. This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.From MISP Galaxy
Last reported 4 months ago, by Sekoia.io1 report
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1036Masquerading
“The downloaded file, a shell script named "2.gif," is saved in the /tmp directory, employing a typical masquerading technique to bypass filename based detection.”
- T1110Brute Force
“It then builds up lists to iterate through to attempt SSH brute force.”
- T1543.002Systemd Service
“PwnRig establishes persistence using cron jobs, and also leverages /etc/init.d/ and systemd services for maintaining persistence on infected systems even after reboots.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Hadooken and K4Spreader: The 8220 Gang's Latest Arsenal“It originated as Kaiten but evolved into Tsunami, which attackers use to launch large-scale DDoS attacks by flooding a target with traffic from infected machines.”
Indicators in its reports
named in the reports above- 77.221.151[.]174in 1 report
- hxxp://154.213.192[.]44/Ueordwfkay.pdfin 1 report
- 154.213.192[.]44in 1 report
- hxxp://154.213.192[.]44/plugin3.dllin 1 report
- 51.222.111[.]116in 1 report
- hxxp://sck-dns[.]cc/cin 1 report
- sck-dns[.]ccin 1 report
- c4k-ircd.pwndns[.]pwin 1 report
- pwn.oracleservice[.]topin 1 report
- 80.78.24[.]30in 1 report
- play.sck-dns[.]ccin 1 report
- 77.221.149[.]212in 1 report
- irc.bashgo[.]pwin 1 report
- run.on-demand[.]pwin 1 report
- 198.199.85[.]230in 1 report
- 64.227.170[.]227in 1 report
- 157.230.29[.]135in 1 report
Copy these 17 indicators · defanged
Thanks — we review every report.