Analysis
-
max time kernel
149s -
max time network
150s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240729-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240729-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
01-11-2024 02:14
Behavioral task
behavioral1
Sample
0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf
Resource
ubuntu2204-amd64-20240729-en
General
-
Target
0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf
-
Size
5.0MB
-
MD5
248846ad88fdaccddece36b05811a576
-
SHA1
2dac57a664c60e1dbe1b51bd75b74ab7980bff30
-
SHA256
0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde
-
SHA512
0923b7b888aa9e15cff490093f2b626ed864e11cd1b31dc6e52b633dc1a054e2eb211b96a033ecbe9455ce93469ffa625037125e20ad400e619188ab766e898e
-
SSDEEP
49152:E33d0lGt6UHcFL7Rn2o03wiEhiDmzzd/9sARlBs/00Cpfx9a9uNNp9hW16klbU6V:E33GlbU8FwmzzRDZ9maqRV
Malware Config
Extracted
kaiji
78789.dns.army:808
Signatures
-
Kaiji 1 IoCs
Kaiji payload
Processes:
resource yara_rule /boot/System.img.config Kaiji -
Kaiji family
-
kaiji_chaosbot 1 IoCs
Chaos-variant payload
Processes:
resource yara_rule /boot/System.img.config kaiji_chaosbot -
Executes dropped EXE 1 IoCs
Processes:
32678ioc pid process /etc/32678 1573 32678 -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elfdescription ioc process File opened for modification /dev/watchdog 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for modification /dev/misc/watchdog 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf -
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Creates/modifies environment variables 1 TTPs 3 IoCs
Creating/modifying environment variables is a common persistence mechanism.
Processes:
0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elfdescription ioc process File opened for modification /etc/profile.d/bash_config.sh 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for modification /etc/profile.d/bash_config 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for modification /etc/profile.d/linux.sh 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Processes:
0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elfdescription ioc process File opened for modification /etc/init.d/ssh 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for modification /etc/init.d/linux_kill 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf -
Modifies systemd 2 TTPs 1 IoCs
Adds/ modifies systemd service files. Likely to achieve persistence.
Processes:
0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elfdescription ioc process File opened for modification /usr/lib/systemd/system/linux.service 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf -
Write file to user bin folder 6 IoCs
Processes:
0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elfdescription ioc process File opened for modification /usr/bin/ss 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for modification /usr/bin/ls 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for modification /usr/bin/dir 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for modification /usr/bin/find 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for modification /usr/bin/lsof 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for modification /usr/bin/ps 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf -
Modifies Bash startup script 2 TTPs 3 IoCs
Processes:
0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elfdescription ioc process File opened for modification /etc/profile.d/bash_config.sh 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for modification /etc/profile.d/bash_config 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for modification /etc/profile.d/linux.sh 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf -
Changes its process name 1 IoCs
Processes:
0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elfdescription ioc pid process Changes the process name, possibly in an attempt to hide itself ksoftirqd/0 1584 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf -
Enumerates kernel/hardware configuration 1 TTPs 2 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
Processes:
0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elfdescription ioc process File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf -
Processes:
0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elfsystemctlsystemctlmountsystemctlsystemctldescription ioc process File opened for reading /proc/991/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/1144/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/413/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/587/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/956/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/1275/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/1422/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/1488/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/1576/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/filesystems systemctl File opened for reading /proc/1128/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/1162/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/1164/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/1065/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/1809/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/225/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/721/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/746/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/836/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/1531/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/1240/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/1361/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/1379/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/665/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/687/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/1148/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/639/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/filesystems systemctl File opened for reading /proc/611/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/646/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/979/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/1171/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/1280/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/206/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/416/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/588/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/filesystems mount File opened for reading /proc/1823/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/498/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/971/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/1196/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/1741/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/1835/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/210/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/227/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/263/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/1362/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/451/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/762/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/1036/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/1740/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/1749/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/1819/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/377/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/783/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/1572/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/filesystems systemctl File opened for reading /proc/1824/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/1573/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/filesystems systemctl File opened for reading /proc/1726/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/1736/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/1739/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf File opened for reading /proc/499/stat 0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf -
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
Processes:
description flow ioc HTTP User-Agent header 7 Go-http-client/1.1
Processes
-
/tmp/0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf/tmp/0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf1⤵
- Enumerates kernel/hardware configuration
PID:1567 -
/usr/bin/shsh -c "/etc/32678&"2⤵PID:1571
-
/usr/sbin/serviceservice crond start2⤵PID:1572
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:1575
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:1577
-
/usr/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"3⤵PID:1586
-
/usr/bin/systemctlsystemctl list-unit-files --full "--type=socket"3⤵PID:1585
-
/tmp/0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf/tmp/0c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde.elf " "2⤵
- Modifies Watchdog functionality
- Creates/modifies environment variables
- Modifies init.d
- Modifies systemd
- Write file to user bin folder
- Modifies Bash startup script
- Changes its process name
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1574 -
/usr/sbin/update-rc.dupdate-rc.d linux_kill defaults3⤵PID:1594
-
/usr/local/sbin/systemctlsystemctl daemon-reload4⤵PID:1595
-
/usr/local/bin/systemctlsystemctl daemon-reload4⤵PID:1595
-
/usr/sbin/systemctlsystemctl daemon-reload4⤵PID:1595
-
/usr/bin/systemctlsystemctl daemon-reload4⤵
- Reads runtime system information
PID:1595 -
/usr/bin/shsh -c "cd /boot;systemctl daemon-reload;systemctl enable linux.service;systemctl start linux.service;journalctl -xe --no-pager"3⤵PID:1632
-
/usr/bin/systemctlsystemctl daemon-reload4⤵
- Reads runtime system information
PID:1633 -
/usr/bin/systemctlsystemctl enable linux.service4⤵
- Reads runtime system information
PID:1667 -
/usr/bin/systemctlsystemctl start linux.service4⤵PID:1705
-
/usr/bin/journalctljournalctl -xe --no-pager4⤵PID:1721
-
/usr/bin/shsh -c "cd /boot;ausearch -c 'System.img.conf' --raw | audit2allow -M my-Systemimgconf;semodule -X 300 -i my-Systemimgconf.pp"3⤵PID:1729
-
/usr/bin/bashbash -c "echo \"*/1 * * * * root /.img \" >> /etc/crontab"3⤵
- Creates/modifies Cron job
PID:1732 -
/usr/bin/renicerenice -20 15743⤵PID:1733
-
/usr/bin/mountmount -o bind /tmp/ /proc/15743⤵
- Reads runtime system information
PID:1734 -
/usr/sbin/serviceservice cron start3⤵PID:1736
-
/usr/bin/basenamebasename /usr/sbin/service4⤵PID:1737
-
/usr/bin/basenamebasename /usr/sbin/service4⤵PID:1738
-
/usr/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"4⤵PID:1741
-
/usr/bin/systemctlsystemctl list-unit-files --full "--type=socket"4⤵PID:1740
-
/usr/local/sbin/systemctlsystemctl start cron.service3⤵PID:1736
-
/usr/local/bin/systemctlsystemctl start cron.service3⤵PID:1736
-
/usr/sbin/systemctlsystemctl start cron.service3⤵PID:1736
-
/usr/bin/systemctlsystemctl start cron.service3⤵
- Reads runtime system information
PID:1736 -
/usr/bin/systemctlsystemctl start crond.service3⤵PID:1742
-
/etc/32678/etc/326781⤵
- Executes dropped EXE
PID:1573 -
/usr/bin/sleepsleep 602⤵PID:1576
-
/usr/local/sbin/systemctlsystemctl start crond.service1⤵PID:1572
-
/usr/local/bin/systemctlsystemctl start crond.service1⤵PID:1572
-
/usr/sbin/systemctlsystemctl start crond.service1⤵PID:1572
-
/usr/bin/systemctlsystemctl start crond.service1⤵PID:1572
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3XDG Autostart Entries
1Boot or Logon Initialization Scripts
1RC Scripts
1Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
3XDG Autostart Entries
1Boot or Logon Initialization Scripts
1RC Scripts
1Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33B
MD5d73d3376908ea075a939e3871ad0fabe
SHA1320ff65831247ba199515f1b94df26cc8a3e5f76
SHA256edbdabe30d8236a2c0a4eb89dfd597552130e4c1a4e93f8fe1568920442ad73a
SHA51257b83fef88620598beb5d65626bf757d0abef242d2d6a01796a61474dedc5095a4a9d0f292b6abb450cad3d4410ab8456253600f58ddb66cfe6d79e1c8415536
-
Filesize
5.0MB
MD5248846ad88fdaccddece36b05811a576
SHA12dac57a664c60e1dbe1b51bd75b74ab7980bff30
SHA2560c1c800bbbce56afc46ceccc33b8e703d6f43673c92c07a43d2e980d0e427bde
SHA5120923b7b888aa9e15cff490093f2b626ed864e11cd1b31dc6e52b633dc1a054e2eb211b96a033ecbe9455ce93469ffa625037125e20ad400e619188ab766e898e
-
Filesize
61B
MD5768eaf287796da19e1cf5e0b2fb1b161
SHA16a1ce2ee5ccc86d1f33806feb14547b35290df2a
SHA2561d22620dfb2a6715e5d745aed5cf841ede0e75e1747f12b9b925a2d346bc7ecb
SHA512e6af30c9df4f7f47696069511e64ecbc8e841629d692ee4056503df3533fb7a7a74960698826260355e1dba7b6c562482a27a39bb51a4237473ce4b68472d620
-
Filesize
189B
MD53909975f7cc0d1121c1819b800069f31
SHA13e68de708c2e6c40fab6794afdee3104e5590189
SHA2566876dac71f13a068afb863d257134275f2edba43b2acaf4924fabf97c079070b
SHA51250600cceeb03b05f45ae61d890caee9f51ff390b6776930866e527e071d65d08241fc66673fd9b99d62fbc77d3c00fc3de4d7378cbc42f5daba5d83072b0906e
-
Filesize
37B
MD5cfb4e51061485fe91169381fbdc1538e
SHA19a85b9b766a15b01737a41d680e4593b7a9bde87
SHA256897f37267d0ceaa2fbdaa09847f5d08e6f8b01a0348a0d666264b0f10acd0c90
SHA512fb154ec711d2090a7461da4db8ddad2b522649a27e74162ecb203f539b1729430288bc02d78d2071bde9c4bbc005693403a57612ef50277d52f816cb94524216