Kiraibot

Malware Profile Updated 13 days ago
Download STIX
Preview STIX
KiraiBot is a recent and active malware, identified as part of the Mirai botnet variant family in September 2023 by NSFOCUS's global threat hunting system. It is one of several new botnet variants developed based on the Mirai source code, alongside hailBot and catDDoS. However, kiraiBot is unique in its design, incorporating personal elements that differentiate it from traditional Mirai class botnets. This significant change in code structure has allowed kiraiBot to accelerate its spread and become widely deployed, thereby posing a considerable threat to digital security. The propagation mode of kiraiBot is primarily through breaching port 23 via weak password scanning. The string "kirai" appears in the scan traffic of the botnet, with the report server set up similarly to Mirai to receive breach results. Furthermore, kiraiBot implements persistence by setting a self-starting script under the /etc/init.d/ directory, ensuring its continued operation even after system reboots. In terms of its functionality, kiraiBot supports various attack methods, as shown in the instructions it issues. It also uses a go-live data packet for communication and has designated storage sites for its propagation scripts. Given its rapid proliferation and the potential damage it can cause, ongoing monitoring and robust countermeasures are necessary to mitigate the threats posed by kiraiBot and similar botnet variants.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.
IDVotesProfile Description
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Associated Malware
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Associated Threat Actors
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Associated Vulnerabilities
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Source Document References
Information about the Kiraibot Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
SourceCreatedAtTitle
CERT-EU
7 months ago
Mirai Botnet’s New Wave: hailBot,kiraiBot, catDDoS, and Their Fierce Onslaught