kaiji | 4790805c4b31a69cd9c2bae8ad62f8c3770e251aaa83bfa5104fb0034e485ba7

Analysis

max time kernel
149s
max time network
150s
platform
debian-9_mips
resource
debian9-mipsbe-20240729-en
resource tags

arch:mipsimage:debian9-mipsbe-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
16-02-2025 16:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

linux_mips_softfloat.elf
Size

5.6MB
MD5

8c2a48dbcfe7d0c76fc8aced8a34970f
SHA1

a94e7b53723fe7c97ed7ccd879f9a65fbce49d87
SHA256

4790805c4b31a69cd9c2bae8ad62f8c3770e251aaa83bfa5104fb0034e485ba7
SHA512

ac999ca96efa3eb468691bfdb532c43c3bca76bac50effde02e28f9ff043a64bbf3b28ba1386d79922ff7adcaa31c14f9bcbe59cb4842059cefe0371aac8e1b1
SSDEEP

49152:L3qbSw1zUu72RTScFnsKbyRHzPDPs4coYtJkEk2wBIxWyDp/9zUH+zOu5x83ZIqG:jqO0o22gDQ

Score

10^/10

kaiji discovery execution persistence privilege_escalation

Malware Config

Signatures

Kaiji 1 IoCs

Kaiji payload

resource	yara_rule
behavioral1/files/fstream-1.dat	Kaiji

Kaiji family
kaiji

kaiji_chaosbot 1 IoCs

Chaos-variant payload

resource	yara_rule
behavioral1/files/fstream-1.dat	kaiji_chaosbot

Executes dropped EXE 7 IoCs

ioc	pid	Process
/etc/32678	739	sh
/etc/id.services.conf	876	32678
/etc/id.services.conf	883	id.services.conf
/etc/32678	884	sh
/etc/id.services.conf	913	32678
/etc/id.services.conf	920	id.services.conf
/etc/32678	924	sh

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/crontab	bash

Enumerates running processes
Discovers information about currently running processes on the system

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	ksoftirqd/0	742	linux_mips_softfloat.elf

Reads CPU attributes 1 TTPs 2 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	linux_mips_softfloat.elf
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	id.services.conf
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	id.services.conf
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	id.services.conf
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	linux_mips_softfloat.elf
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	id.services.conf
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/13/status	pkill
File opened for reading	/proc/121/status	pkill
File opened for reading	/proc/725/cmdline	pkill
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/4/cmdline	pkill
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/72/status	pkill
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/20/status	pkill
File opened for reading	/proc/109/cmdline	pkill
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/736/status	pkill
File opened for reading	/proc/77/status	pkill
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/211/cmdline	pkill
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/11/cmdline	pkill
File opened for reading	/proc/12/status	pkill
File opened for reading	/proc/679/status	pkill
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/859/cmdline	pkill
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/360/cmdline	pkill
File opened for reading	/proc/736/cmdline	pkill
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/81/status	pkill
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/status	pkill
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/388/status	pkill
File opened for reading	/proc/851/status	pkill
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/388/cmdline	pkill
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/17/status	pkill
File opened for reading	/proc/672/status	pkill
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/360/status	pkill
File opened for reading	/proc/859/status	pkill

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
719	linux_mips_softfloat.elf
736	linux_mips_softfloat.elf

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	5	Go-http-client/1.1

/tmp/linux_mips_softfloat.elf
/tmp/linux_mips_softfloat.elf
1⤵
- Enumerates kernel/hardware configuration
- System Network Configuration Discovery
PID:719
- /bin/sh
  sh -c "/etc/32678&"
  2⤵
  - Executes dropped EXE
  PID:734
- - /etc/32678
    /etc/32678
    3⤵
    - Executes dropped EXE
    PID:739
  - - /bin/sleep
      sleep 60
      4⤵
      PID:750
  - - /etc/id.services.conf
      /etc/id.services.conf
      4⤵
      Executes dropped EXE
      Enumerates kernel/hardware configuration
      PID:876
    - - /usr/bin/pkill
        
        pkill -9 32678
        5⤵
        Reads CPU attributes
        Reads runtime system information
        
        PID:880
    - - /bin/sh
        
        sh -c "/etc/32678&"
        5⤵
        Executes dropped EXE
        
        PID:881
    - - /usr/sbin/service
        
        service crond start
        5⤵
        
        PID:882
      - /usr/bin/basename
        
        basename /usr/sbin/service
        6⤵
        
        PID:885
      - /usr/bin/basename
        
        basename /usr/sbin/service
        6⤵
        
        PID:890
      - /bin/systemctl
        
        systemctl --quiet is-active multi-user.target
        6⤵
        Enumerates kernel/hardware configuration
        
        PID:891
      - /bin/systemctl
        
        systemctl list-unit-files --full "--type=socket"
        6⤵
        
        PID:893
      - /bin/sed
        
        sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
        6⤵
        
        PID:894
      - /bin/systemctl
        
        systemctl -p Triggers show dbus.socket
        6⤵
        Enumerates kernel/hardware configuration
        Reads runtime system information
        
        PID:895
      - /bin/systemctl
        
        systemctl -p Triggers show ssh.socket
        6⤵
        Enumerates kernel/hardware configuration
        Reads runtime system information
        
        PID:896
      - /bin/systemctl
        
        systemctl -p Triggers show syslog.socket
        6⤵
        Enumerates kernel/hardware configuration
        
        PID:897
      - /bin/systemctl
        
        systemctl -p Triggers show systemd-fsckd.socket
        6⤵
        Enumerates kernel/hardware configuration
        
        PID:898
      - /bin/systemctl
        
        systemctl -p Triggers show systemd-initctl.socket
        6⤵
        Enumerates kernel/hardware configuration
        Reads runtime system information
        
        PID:899
      - /bin/systemctl
        
        systemctl -p Triggers show systemd-journald-audit.socket
        6⤵
        Enumerates kernel/hardware configuration
        
        PID:900
      - /bin/systemctl
        
        systemctl -p Triggers show systemd-journald-dev-log.socket
        6⤵
        Enumerates kernel/hardware configuration
        Reads runtime system information
        
        PID:901
      - /bin/systemctl
        
        systemctl -p Triggers show systemd-journald.socket
        6⤵
        Enumerates kernel/hardware configuration
        
        PID:902
      - /bin/systemctl
        
        systemctl -p Triggers show systemd-networkd.socket
        6⤵
        Enumerates kernel/hardware configuration
        Reads runtime system information
        
        PID:903
      - /bin/systemctl
        
        systemctl -p Triggers show systemd-rfkill.socket
        6⤵
        Enumerates kernel/hardware configuration
        
        PID:904
      - /bin/systemctl
        
        systemctl -p Triggers show systemd-udevd-control.socket
        6⤵
        Enumerates kernel/hardware configuration
        
        PID:905
      - /bin/systemctl
        
        systemctl -p Triggers show systemd-udevd-kernel.socket
        6⤵
        Enumerates kernel/hardware configuration
        Reads runtime system information
        
        PID:906
    - - /etc/id.services.conf
        
        /etc/id.services.conf " "
        5⤵
        Enumerates kernel/hardware configuration
        
        PID:883
- /usr/sbin/service
  service crond start
  2⤵
  PID:735
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:743
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:751
- - /bin/systemctl
    systemctl --quiet is-active multi-user.target
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:754
- - /bin/systemctl
    systemctl list-unit-files --full "--type=socket"
    3⤵
    - Enumerates kernel/hardware configuration
    PID:758
- - /bin/sed
    sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
    3⤵
    PID:759
- - /bin/systemctl
    systemctl -p Triggers show dbus.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:761
- - /bin/systemctl
    systemctl -p Triggers show ssh.socket
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:764
- - /bin/systemctl
    systemctl -p Triggers show syslog.socket
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:766
- - /bin/systemctl
    systemctl -p Triggers show systemd-fsckd.socket
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:784
- - /bin/systemctl
    systemctl -p Triggers show systemd-initctl.socket
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:785
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-audit.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:786
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-dev-log.socket
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:788
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald.socket
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:789
- - /bin/systemctl
    systemctl -p Triggers show systemd-networkd.socket
    3⤵
    PID:790
- - /bin/systemctl
    systemctl -p Triggers show systemd-rfkill.socket
    3⤵
    PID:792
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-control.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:796
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-kernel.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:800
- /tmp/linux_mips_softfloat.elf
  /tmp/linux_mips_softfloat.elf " "
  2⤵
  - Changes its process name
  - Enumerates kernel/hardware configuration
  - System Network Configuration Discovery
  PID:736
- - /usr/sbin/update-rc.d
    update-rc.d linux_kill defaults
    3⤵
    PID:748
  - - /usr/local/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:765
  - - /usr/local/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:765
  - - /usr/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:765
  - - /usr/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:765
  - - /sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:765
  - - /bin/systemctl
      systemctl daemon-reload
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:765
- - /bin/bash
    bash -c "echo \"*/1 * * * * root /.img \" >> /etc/crontab"
    3⤵
    - Creates/modifies Cron job
    PID:787
- - /usr/bin/renice
    renice -20 736
    3⤵
    PID:791
- - /bin/mount
    mount -o bind /tmp/ /proc/736
    3⤵
    PID:793
- - /usr/sbin/service
    service cron start
    3⤵
    PID:794
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:795
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:797
  - - /bin/systemctl
      systemctl --quiet is-active multi-user.target
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:798
  - - /bin/systemctl
      systemctl list-unit-files --full "--type=socket"
      4⤵
      Enumerates kernel/hardware configuration
      PID:802
  - - /bin/sed
      sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
      4⤵
      Reads runtime system information
      PID:803
  - - /bin/systemctl
      systemctl -p Triggers show dbus.socket
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:804
  - - /bin/systemctl
      systemctl -p Triggers show ssh.socket
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:805
  - - /bin/systemctl
      systemctl -p Triggers show syslog.socket
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:806
  - - /bin/systemctl
      systemctl -p Triggers show systemd-fsckd.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:807
  - - /bin/systemctl
      systemctl -p Triggers show systemd-initctl.socket
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:808
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald-audit.socket
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:809
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald-dev-log.socket
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:810
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:811
  - - /bin/systemctl
      systemctl -p Triggers show systemd-networkd.socket
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:812
  - - /bin/systemctl
      systemctl -p Triggers show systemd-rfkill.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:813
  - - /bin/systemctl
      systemctl -p Triggers show systemd-udevd-control.socket
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:814
  - - /bin/systemctl
      systemctl -p Triggers show systemd-udevd-kernel.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:817
- - /usr/local/sbin/systemctl
    systemctl start cron.service
    3⤵
    PID:794
- - /usr/local/bin/systemctl
    systemctl start cron.service
    3⤵
    PID:794
- - /usr/sbin/systemctl
    systemctl start cron.service
    3⤵
    PID:794
- - /usr/bin/systemctl
    systemctl start cron.service
    3⤵
    PID:794
- - /sbin/systemctl
    systemctl start cron.service
    3⤵
    PID:794
- - /bin/systemctl
    systemctl start cron.service
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:794
- - /bin/systemctl
    systemctl start crond.service
    3⤵
    - Enumerates kernel/hardware configuration
    PID:819

/usr/local/sbin/systemctl
systemctl start crond.service
1⤵
PID:735

/usr/local/bin/systemctl
systemctl start crond.service
1⤵
PID:735

/usr/sbin/systemctl
systemctl start crond.service
1⤵
PID:735

/usr/bin/systemctl
systemctl start crond.service
1⤵
PID:735

/sbin/systemctl
systemctl start crond.service
1⤵
PID:735

/bin/systemctl
systemctl start crond.service
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:735

/etc/32678
/etc/32678
1⤵
- Executes dropped EXE
PID:884
- /bin/sleep
  sleep 60
  2⤵
  PID:889
- /etc/id.services.conf
  /etc/id.services.conf
  2⤵
  - Executes dropped EXE
  - Enumerates kernel/hardware configuration
  PID:913
- - /usr/bin/pkill
    pkill -9 32678
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:917
- - /bin/sh
    sh -c "/etc/32678&"
    3⤵
    - Executes dropped EXE
    PID:918
- - /usr/sbin/service
    service crond start
    3⤵
    PID:919
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:925
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:927
  - - /bin/systemctl
      systemctl --quiet is-active multi-user.target
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:928
  - - /bin/systemctl
      systemctl list-unit-files --full "--type=socket"
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:930
  - - /bin/sed
      sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
      4⤵
      PID:931
  - - /bin/systemctl
      systemctl -p Triggers show dbus.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:932
  - - /bin/systemctl
      systemctl -p Triggers show ssh.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:933
  - - /bin/systemctl
      systemctl -p Triggers show syslog.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:934
  - - /bin/systemctl
      systemctl -p Triggers show systemd-fsckd.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:935
  - - /bin/systemctl
      systemctl -p Triggers show systemd-initctl.socket
      4⤵
      PID:936
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald-audit.socket
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:937
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald-dev-log.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:938
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:939
  - - /bin/systemctl
      systemctl -p Triggers show systemd-networkd.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:940
  - - /bin/systemctl
      systemctl -p Triggers show systemd-rfkill.socket
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:941
  - - /bin/systemctl
      systemctl -p Triggers show systemd-udevd-control.socket
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:942
  - - /bin/systemctl
      systemctl -p Triggers show systemd-udevd-kernel.socket
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:943
- - /etc/id.services.conf
    /etc/id.services.conf " "
    3⤵
    - Enumerates kernel/hardware configuration
    PID:920

/usr/local/sbin/systemctl
systemctl start crond.service
1⤵
PID:882

/usr/local/bin/systemctl
systemctl start crond.service
1⤵
PID:882

/usr/sbin/systemctl
systemctl start crond.service
1⤵
PID:882

/usr/bin/systemctl
systemctl start crond.service
1⤵
PID:882

/sbin/systemctl
systemctl start crond.service
1⤵
PID:882

/bin/systemctl
systemctl start crond.service
1⤵
- Enumerates kernel/hardware configuration
PID:882

/etc/32678
/etc/32678
1⤵
PID:924
- /bin/sleep
  sleep 60
  2⤵
  PID:926

/usr/local/sbin/systemctl
systemctl start crond.service
1⤵
PID:919

/usr/local/bin/systemctl
systemctl start crond.service
1⤵
PID:919

/usr/sbin/systemctl
systemctl start crond.service
1⤵
PID:919

/usr/bin/systemctl
systemctl start crond.service
1⤵
PID:919

/sbin/systemctl
systemctl start crond.service
1⤵
PID:919

/bin/systemctl
systemctl start crond.service
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:919

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/.img

Filesize
33B

MD5
d73d3376908ea075a939e3871ad0fabe

SHA1
320ff65831247ba199515f1b94df26cc8a3e5f76

SHA256
edbdabe30d8236a2c0a4eb89dfd597552130e4c1a4e93f8fe1568920442ad73a

SHA512
57b83fef88620598beb5d65626bf757d0abef242d2d6a01796a61474dedc5095a4a9d0f292b6abb450cad3d4410ab8456253600f58ddb66cfe6d79e1c8415536

Download Submit
/etc/32678

Filesize
61B

MD5
768eaf287796da19e1cf5e0b2fb1b161

SHA1
6a1ce2ee5ccc86d1f33806feb14547b35290df2a

SHA256
1d22620dfb2a6715e5d745aed5cf841ede0e75e1747f12b9b925a2d346bc7ecb

SHA512
e6af30c9df4f7f47696069511e64ecbc8e841629d692ee4056503df3533fb7a7a74960698826260355e1dba7b6c562482a27a39bb51a4237473ce4b68472d620

Download Submit
/etc/id.services.conf

Filesize
5.6MB

MD5
8c2a48dbcfe7d0c76fc8aced8a34970f

SHA1
a94e7b53723fe7c97ed7ccd879f9a65fbce49d87

SHA256
4790805c4b31a69cd9c2bae8ad62f8c3770e251aaa83bfa5104fb0034e485ba7

SHA512
ac999ca96efa3eb468691bfdb532c43c3bca76bac50effde02e28f9ff043a64bbf3b28ba1386d79922ff7adcaa31c14f9bcbe59cb4842059cefe0371aac8e1b1

Download Submit
/etc/init.d/linux_kill

Filesize
189B

MD5
3909975f7cc0d1121c1819b800069f31

SHA1
3e68de708c2e6c40fab6794afdee3104e5590189

SHA256
6876dac71f13a068afb863d257134275f2edba43b2acaf4924fabf97c079070b

SHA512
50600cceeb03b05f45ae61d890caee9f51ff390b6776930866e527e071d65d08241fc66673fd9b99d62fbc77d3c00fc3de4d7378cbc42f5daba5d83072b0906e

Download Submit
/etc/profile.d/bash_config.sh

Filesize
37B

MD5
cfb4e51061485fe91169381fbdc1538e

SHA1
9a85b9b766a15b01737a41d680e4593b7a9bde87

SHA256
897f37267d0ceaa2fbdaa09847f5d08e6f8b01a0348a0d666264b0f10acd0c90

SHA512
fb154ec711d2090a7461da4db8ddad2b522649a27e74162ecb203f539b1729430288bc02d78d2071bde9c4bbc005693403a57612ef50277d52f816cb94524216

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads