Malware Analysis Report

2024-11-13 16:11

Sample ID 241103-ddqyzssgqg
Target 628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf
SHA256 628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6
Tags
kaiji discovery execution
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6

Threat Level: Known bad

The file 628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf was found to be: Known bad.

Malicious Activity Summary

kaiji discovery execution

Kaiji

Kaiji family

Executes dropped EXE

Enumerates running processes

Reads runtime system information

Command and Scripting Interpreter: Unix Shell

Enumerates kernel/hardware configuration

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-03 02:53

Signatures

Kaiji

Description Indicator Process Target
N/A N/A N/A N/A

Kaiji family

kaiji

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-03 02:53

Reported

2024-11-03 02:56

Platform

debian12-mipsel-20240729-en

Max time kernel

5s

Command Line

[/tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf]

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A /etc/32676 /etc/32676 N/A

Enumerates running processes

Command and Scripting Interpreter: Unix Shell

execution
Description Indicator Process Target
N/A N/A /bin/sh N/A

Enumerates kernel/hardware configuration

discovery
Description Indicator Process Target
File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A

Reads runtime system information

discovery
Description Indicator Process Target
File opened for reading /proc/715/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/380/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/718/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/32/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/45/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/59/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/325/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/376/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/5/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/42/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/112/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/379/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/723/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/118/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/203/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/1/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/2/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/8/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/22/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/27/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/48/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/136/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/732/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/16/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/23/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/26/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/31/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/35/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/filesystems /usr/bin/systemctl N/A
File opened for reading /proc/739/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/30/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/111/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/349/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/681/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/735/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/19/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/113/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/699/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/736/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/745/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/20/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/47/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/58/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/682/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/25/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/377/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/431/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/713/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/9/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/13/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/17/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/114/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/389/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/14/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/28/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/179/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/3/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/15/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/394/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/697/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/filesystems /usr/bin/sed N/A
File opened for reading /proc/6/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/29/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A
File opened for reading /proc/137/stat /tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf N/A

Processes

/tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf

[/tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf]

/tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf

[/tmp/628a4a3d5b1f134676431472700ee2240630e63e0732d3542f5c99163628f9b6.elf ]

/bin/sh

[/bin/sh -c /etc/32676&]

/etc/32676

[/etc/32676]

/usr/sbin/service

[service crond start]

/usr/bin/sleep

[sleep 60]

/usr/bin/basename

[basename /usr/sbin/service]

/usr/bin/basename

[basename /usr/sbin/service]

/usr/bin/systemctl

[systemctl list-unit-files --full --type=socket]

/usr/bin/sed

[sed -ne s/\.socket\s*[a-z]*\s*$/.socket/p]

Network

N/A

Files

/etc/.walk

MD5 7db9364ee0f77bf3c0f0745ffce6f223
SHA1 fb8480bfda304979fc908631852a09008766a354
SHA256 2ed7facc81e029a5a8fab2820e18c5400ee180c379309ff3e1713cc6e9473b96
SHA512 802decd31b2eb1bb41b902335cc9b4a24db5c2c393459cdf636e4b48f034b80514aba03ea54c84e54cb68078d9a6e68a363af028233c25e7035ff675474c4eff

/etc/.walk

MD5 99d3c8d23102dd11e4e700af556124f2
SHA1 b9ce0fb93245e5d356dec908f5cc57738fa96a48
SHA256 eff0865ccd00edcbd7488867c3a29d2bd667e8a0efaefe8c2ab86c2ec8b36be8
SHA512 d8d93a19647f3eb401a8ea128db466c5cd18c93bb7dabc4d4d0c8b3845c8baf027158b7121e2f97debd395ea47c138ee18c2032524d2df8fd13086aa504467e1

/etc/32676

MD5 47684525bfdf26f49fd1cf742b17c015
SHA1 c4ab14ba22420ff9acadfc698a38d0cd99e9fbfa
SHA256 b7ce294613dd2c237a4a50548bfcd5c14d166107f2d2e965499bc78695300d5b
SHA512 948f9c519ae9afe1c821c5d58da2e584e50356dabef597ccd408853a9038560b9fb1c5894900e2725b48977ffd49d18a439436bb4946e2164ac9fcf2a8637621