Kiraibot

Malware updated 5 months ago (2024-05-04T20:44:34.905Z)
Download STIX
Preview STIX
KiraiBot is a recent and active malware, identified as part of the Mirai botnet variant family in September 2023 by NSFOCUS's global threat hunting system. It is one of several new botnet variants developed based on the Mirai source code, alongside hailBot and catDDoS. However, kiraiBot is unique in its design, incorporating personal elements that differentiate it from traditional Mirai class botnets. This significant change in code structure has allowed kiraiBot to accelerate its spread and become widely deployed, thereby posing a considerable threat to digital security. The propagation mode of kiraiBot is primarily through breaching port 23 via weak password scanning. The string "kirai" appears in the scan traffic of the botnet, with the report server set up similarly to Mirai to receive breach results. Furthermore, kiraiBot implements persistence by setting a self-starting script under the /etc/init.d/ directory, ensuring its continued operation even after system reboots. In terms of its functionality, kiraiBot supports various attack methods, as shown in the instructions it issues. It also uses a go-live data packet for communication and has designated storage sites for its propagation scripts. Given its rapid proliferation and the potential damage it can cause, ongoing monitoring and robust countermeasures are necessary to mitigate the threats posed by kiraiBot and similar botnet variants.
Description last updated: 2024-05-04T17:11:11.168Z
What's your take? (Question 1 of 0)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Aliases We are not currently tracking any aliases
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Analyst Notes & Discussion
Be the first to leave your mark here! Log in to share your views and vote.
Associated Malware
To see the evidence that has resulted in these malware associations, create a free account
Alias DescriptionAssociation TypeVotes
The Mirai Malware is associated with Kiraibot. Mirai is a type of malware that primarily targets Internet of Things (IoT) devices to form botnets, networks of compromised machines that can be controlled remotely for malicious purposes. It first made significant impact in 2022, with over 7 million detections in the early part of the year. Howeveris related to
2
Source Document References
Information about the Kiraibot Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more