Extracted

• • Target
    e55a695d2530b3fb5c80256f6036de29.elf
  • Size 1.9MB
  • SHA256 ce2944509d3936280343639c38ed5240f0a35c8d1dd63a00ce0eef1052325124
  • MD5 e55a695d2530b3fb5c80256f6036de29
  • SHA1 cbf9fb21338b161a6b5ab67425e8afbcf9bbcd93
  • SHA512 a59fec7fe64abf676a4b40737eaf4b5824daf78c78324ef1e8b58114f81bbeda4edb281fab0582026dd8363314905d0259b20ac842f9016f4da8bf1dab0fc89d
  • SSDEEP 49152:XXPVKrbvGOQLeS7rb/TCvO90d7HjmAFd4A64nsfJrkaani38B4B+g2vUqHOErz1:tPXZz
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  kaijidefense_evasiondiscoveryexecutionpersistenceprivilege_escalatioprivilege_escalation

  • Kaiji

    Kaiji payload

  • Kaiji family

    kaiji

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalatio

  • Creates/modifies environment variables

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Modifies systemd

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation

  • Write file to user bin folder

    persistence

  • Modifies Bash startup script

    persistence
  behavioral1