Analysis Overview
SHA256
63bfb2501a4607933ba3bdbbdfeca57a80017215006877b52638fd8ad126788c
Threat Level: Known bad
The file linux_mips.elf was found to be: Known bad.
Malicious Activity Summary
Kaiji
Kaiji family
Executes dropped EXE
Creates/modifies Cron job
Command and Scripting Interpreter: Unix Shell
Enumerates kernel/hardware configuration
Reads runtime system information
System Network Configuration Discovery
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-02 03:35
Signatures
Kaiji
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Kaiji family
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-02 03:34
Reported
2024-11-02 03:38
Platform
debian9-mipsbe-20240611-en
Max time kernel
149s
Max time network
156s
Command Line
Signatures
Kaiji
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Kaiji family
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | /etc/32676 | /etc/32676 | N/A |
| N/A | /etc/opt.services.cfg | /etc/opt.services.cfg | N/A |
| N/A | /etc/opt.services.cfg | /etc/opt.services.cfg | N/A |
| N/A | /etc/opt.services.cfg | /etc/opt.services.cfg | N/A |
| N/A | /etc/opt.services.cfg | /etc/opt.services.cfg | N/A |
Creates/modifies Cron job
| Description | Indicator | Process | Target |
| File opened for modification | /etc/crontab | /bin/sh | N/A |
Command and Scripting Interpreter: Unix Shell
| Description | Indicator | Process | Target |
| N/A | N/A | /bin/sh | N/A |
| N/A | N/A | /bin/sh | N/A |
Enumerates kernel/hardware configuration
| Description | Indicator | Process | Target |
| File opened for reading | /sys/fs/kdbus/0-system/bus | /bin/systemctl | N/A |
| File opened for reading | /sys/fs/kdbus/0-system/bus | /bin/systemctl | N/A |
| File opened for reading | /sys/fs/kdbus/0-system/bus | /bin/systemctl | N/A |
| File opened for reading | /sys/kernel/mm/transparent_hugepage/hpage_pmd_size | /etc/opt.services.cfg | N/A |
| File opened for reading | /sys/kernel/mm/transparent_hugepage/hpage_pmd_size | /etc/opt.services.cfg | N/A |
| File opened for reading | /sys/fs/kdbus/0-system/bus | /bin/systemctl | N/A |
| File opened for reading | /sys/kernel/mm/transparent_hugepage/hpage_pmd_size | /etc/opt.services.cfg | N/A |
| File opened for reading | /sys/kernel/mm/transparent_hugepage/hpage_pmd_size | /etc/opt.services.cfg | N/A |
| File opened for reading | /sys/kernel/mm/transparent_hugepage/hpage_pmd_size | /tmp/linux_mips.elf | N/A |
| File opened for reading | /sys/kernel/mm/transparent_hugepage/hpage_pmd_size | /tmp/linux_mips.elf | N/A |
| File opened for reading | /sys/fs/kdbus/0-system/bus | /bin/systemctl | N/A |
| File opened for reading | /sys/fs/kdbus/0-system/bus | /bin/systemctl | N/A |
| File opened for reading | /sys/fs/kdbus/0-system/bus | /bin/systemctl | N/A |
Reads runtime system information
| Description | Indicator | Process | Target |
| File opened for reading | /proc/1/environ | /bin/systemctl | N/A |
| File opened for reading | /proc/1/environ | /bin/systemctl | N/A |
| File opened for reading | /proc/cmdline | /bin/systemctl | N/A |
| File opened for reading | /proc/filesystems | /bin/systemctl | N/A |
| File opened for reading | /proc/filesystems | /bin/sed | N/A |
| File opened for reading | /proc/filesystems | /bin/systemctl | N/A |
| File opened for reading | /proc/self/stat | /bin/systemctl | N/A |
| File opened for reading | /proc/cmdline | /bin/systemctl | N/A |
| File opened for reading | /proc/1/environ | /bin/systemctl | N/A |
| File opened for reading | /proc/self/stat | /bin/systemctl | N/A |
| File opened for reading | /proc/cmdline | /bin/systemctl | N/A |
| File opened for reading | /proc/filesystems | /bin/systemctl | N/A |
| File opened for reading | /proc/filesystems | /bin/systemctl | N/A |
| File opened for reading | /proc/cmdline | /bin/systemctl | N/A |
| File opened for reading | /proc/1/environ | /bin/systemctl | N/A |
| File opened for reading | /proc/self/stat | /bin/systemctl | N/A |
| File opened for reading | /proc/filesystems | /bin/sed | N/A |
| File opened for reading | /proc/cmdline | /bin/systemctl | N/A |
| File opened for reading | /proc/1/environ | /bin/systemctl | N/A |
| File opened for reading | /proc/self/stat | /bin/systemctl | N/A |
| File opened for reading | /proc/self/stat | /bin/systemctl | N/A |
| File opened for reading | /proc/filesystems | /bin/systemctl | N/A |
| File opened for reading | /proc/filesystems | /bin/systemctl | N/A |
| File opened for reading | /proc/1/environ | /bin/systemctl | N/A |
| File opened for reading | /proc/self/stat | /bin/systemctl | N/A |
| File opened for reading | /proc/self/stat | /bin/systemctl | N/A |
| File opened for reading | /proc/filesystems | /bin/systemctl | N/A |
| File opened for reading | /proc/filesystems | /bin/mount | N/A |
| File opened for reading | /proc/cmdline | /bin/systemctl | N/A |
| File opened for reading | /proc/cmdline | /bin/systemctl | N/A |
| File opened for reading | /proc/1/environ | /bin/systemctl | N/A |
System Network Configuration Discovery
| Description | Indicator | Process | Target |
| N/A | N/A | /tmp/linux_mips.elf | N/A |
| N/A | N/A | /tmp/linux_mips.elf | N/A |
Processes
/tmp/linux_mips.elf
[/tmp/linux_mips.elf]
/tmp/linux_mips.elf
[/tmp/linux_mips.elf ]
/bin/sh
[/bin/sh -c /etc/32676&]
/etc/32676
[/etc/32676]
/usr/sbin/service
[service crond start]
/bin/sleep
[sleep 60]
/usr/bin/basename
[basename /usr/sbin/service]
/usr/bin/basename
[basename /usr/sbin/service]
/bin/systemctl
[systemctl --quiet is-active multi-user.target]
/bin/systemctl
[systemctl list-unit-files --full --type=socket]
/bin/sed
[sed -ne s/\.socket\s*[a-z]*\s*$/.socket/p]
/usr/local/sbin/systemctl
[systemctl --job-mode=ignore-dependencies start crond.service]
/usr/local/bin/systemctl
[systemctl --job-mode=ignore-dependencies start crond.service]
/usr/sbin/systemctl
[systemctl --job-mode=ignore-dependencies start crond.service]
/usr/bin/systemctl
[systemctl --job-mode=ignore-dependencies start crond.service]
/sbin/systemctl
[systemctl --job-mode=ignore-dependencies start crond.service]
/bin/systemctl
[systemctl --job-mode=ignore-dependencies start crond.service]
/bin/sh
[/bin/sh -c echo "*/1 * * * * root /.mod " >> /etc/crontab]
/usr/bin/renice
[renice -20 715]
/bin/mount
[mount -o bind /tmp/ /proc/715]
/usr/sbin/service
[service cron start]
/usr/bin/basename
[basename /usr/sbin/service]
/usr/bin/basename
[basename /usr/sbin/service]
/bin/systemctl
[systemctl --quiet is-active multi-user.target]
/bin/sed
[sed -ne s/\.socket\s*[a-z]*\s*$/.socket/p]
/bin/systemctl
[systemctl list-unit-files --full --type=socket]
/usr/local/sbin/systemctl
[systemctl --job-mode=ignore-dependencies start cron.service]
/usr/local/bin/systemctl
[systemctl --job-mode=ignore-dependencies start cron.service]
/usr/sbin/systemctl
[systemctl --job-mode=ignore-dependencies start cron.service]
/usr/bin/systemctl
[systemctl --job-mode=ignore-dependencies start cron.service]
/sbin/systemctl
[systemctl --job-mode=ignore-dependencies start cron.service]
/bin/systemctl
[systemctl --job-mode=ignore-dependencies start cron.service]
/bin/systemctl
[systemctl start crond.service]
/etc/opt.services.cfg
[/etc/opt.services.cfg]
/etc/opt.services.cfg
[/etc/opt.services.cfg ]
/bin/sleep
[sleep 60]
/etc/opt.services.cfg
[/etc/opt.services.cfg]
/etc/opt.services.cfg
[/etc/opt.services.cfg ]
/bin/sleep
[sleep 60]
Network
| Country | Destination | Domain | Proto |
| US | 1.1.1.1:53 | www.google.com | udp |
| US | 1.1.1.1:53 | www.google.com | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
| US | 1.1.1.1:53 | ss.us-tv.top | udp |
Files
/etc/.walk
| MD5 | 969c8cca63e0a222c5e57f44b34a0924 |
| SHA1 | ab4c40d0cacdd15edc895bbbe54c5ae57e2e8f9f |
| SHA256 | 7c55d9d92ed75324ce414dc67a4a66ef31c9de0f3e51667034254b10f4281ccd |
| SHA512 | 29fbda92565de3f7fc8143e59603f5af508e3ff0303905100ee61f9e56aa0df2468db1bad5e563869b6368854989cbb0858859946bc59cf81f40260ba388e8f8 |
/etc/.walk
| MD5 | 6440d7093429aa4d47f92fbf5922e640 |
| SHA1 | 8d5b0ea134206bd7cd62bc509b0e9bdf77bcbba9 |
| SHA256 | 3fdfe2279dfd5cb2168a74af4251de8818609bcd2c9dddbceeaf2d70ae5a762c |
| SHA512 | d294d5292c36c0632f20c7830102ea7e07e0930473b62c664d8d8916be6bcd0480588f29257d3b7233c5b74413e6e2de5f2d87729a80283f41fdfe9956211ac9 |
/etc/opt.services.cfg
| MD5 | b5a8f29c137a214ffef83b0bc5daad97 |
| SHA1 | 90fc46188e7bc83a423a3ea8fe0392660f594eb0 |
| SHA256 | 63bfb2501a4607933ba3bdbbdfeca57a80017215006877b52638fd8ad126788c |
| SHA512 | ed372ee7f59c15b9dbf005f20d660223b23c04a0d3f660efdcfb9fc1bd9a0d5aca836befecc6a155104607883520f8da0ff911534dd330ade448f52c9d52e544 |
/etc/32676
| MD5 | 47684525bfdf26f49fd1cf742b17c015 |
| SHA1 | c4ab14ba22420ff9acadfc698a38d0cd99e9fbfa |
| SHA256 | b7ce294613dd2c237a4a50548bfcd5c14d166107f2d2e965499bc78695300d5b |
| SHA512 | 948f9c519ae9afe1c821c5d58da2e584e50356dabef597ccd408853a9038560b9fb1c5894900e2725b48977ffd49d18a439436bb4946e2164ac9fcf2a8637621 |
/.mod
| MD5 | f5a3713282e43c200f30342f5ff5e2ea |
| SHA1 | 2b2ce1a207e2b691a074c6f78f71c4785aae426a |
| SHA256 | 6ab64e727571458d4884fb2fe82c27c467db0699cb8f648b3f0217c35d2b7511 |
| SHA512 | 5bcb8cd360409147a486755f90e0cdd97183af02ce8de5135b7c6a8a010deb9ef12dcd5ee9a2a8fd2e159347f68e72d6b7fd75e943b4fcd928d7a74b97476013 |
/usr/bin/include/find
| MD5 | 97b5c6c1b307114efc38193175a343c3 |
| SHA1 | 24015d4f95c6878ea5027c134eddebb7126b610f |
| SHA256 | b1a89f313023b476fc826d8fac689679504e61ae8e650681fb966e810ed34970 |
| SHA512 | e5359f3e082f54f5cfd7afa7771d8724d161d48d09372f203bdca222a47a63919fdfb76b6db7fb8ff61e92f8fd04fdec962e94331ff12705cf53ce5e23d33180 |
/etc/profile.d/gateway.sh
| MD5 | 217d1865cb2770d7650ead8960539181 |
| SHA1 | 5f0f39bd441fa71c36306386d8a81f59480d4e53 |
| SHA256 | fff6d267ac34e86916b0f08ff177c854a20f9353ecd1c3d0250c18fd0b375fa3 |
| SHA512 | f3442829f25e60dc17504619798da502922ea3ab2d92355316e67bd236423e28ed0af8f3d2270b52fe3e7108f5280ea113ec9a03cc1abdc8d6360ecece455d31 |