kaiji | 558fed7a80236443c85b70f36e9452e2c33d47aceb6e126588aeeca88724297e

Analysis

max time kernel
150s
max time network
150s
platform
debian-9_mips
resource
debian9-mipsbe-20240418-en
resource tags

arch:mipsimage:debian9-mipsbe-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
21/03/2025, 02:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

558fed7a80236443c85b70f36e9452e2c33d47aceb6e126588aeeca88724297e.elf
Size

5.6MB
MD5

f50a8a599d08e80dd60455ffdef015af
SHA1

e236c6af96236e9c57b35eda10a161de0efed75e
SHA256

558fed7a80236443c85b70f36e9452e2c33d47aceb6e126588aeeca88724297e
SHA512

e8f3dc16f25f1f2fa3e2c3eb2c13af819386a5b81fbb2c237a310b7a0e8edb6484d28a0c882eca4b4ec34775dc4d33464ad44f36cae43b074aa7f6c1c65defb7
SSDEEP

49152:H2EpH9kX4nazMqH5Erob6XMv7fn3FuL9idt42uXYfTYetBDa9zrHAMnWHsLFnoeF:WEiAQTMZudhDM

Score

10^/10

kaiji discovery execution persistence privilege_escalation

Malware Config

Signatures

Kaiji 1 IoCs

Kaiji payload

resource	yara_rule
behavioral1/files/fstream-1.dat	Kaiji

Kaiji family
kaiji

kaiji_chaosbot 1 IoCs

Chaos-variant payload

resource	yara_rule
behavioral1/files/fstream-1.dat	kaiji_chaosbot

Executes dropped EXE 7 IoCs

ioc	pid	Process
/etc/32678	749	sh
/etc/id.services.conf	915	32678
/etc/id.services.conf	922	id.services.conf
/etc/32678	926	sh
/etc/id.services.conf	952	32678
/etc/id.services.conf	959	id.services.conf
/etc/32678	964	sh

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/crontab	bash

Enumerates running processes
Discovers information about currently running processes on the system

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	ksoftirqd/0	755	558fed7a80236443c85b70f36e9452e2c33d47aceb6e126588aeeca88724297e.elf

Reads CPU attributes 1 TTPs 2 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	558fed7a80236443c85b70f36e9452e2c33d47aceb6e126588aeeca88724297e.elf
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	id.services.conf
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	id.services.conf
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	id.services.conf
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	id.services.conf
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	558fed7a80236443c85b70f36e9452e2c33d47aceb6e126588aeeca88724297e.elf
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/379/status	pkill
File opened for reading	/proc/725/cmdline	pkill
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/67/status	pkill
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/17/cmdline	pkill
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/14/cmdline	pkill
File opened for reading	/proc/15/cmdline	pkill
File opened for reading	/proc/420/cmdline	pkill
File opened for reading	/proc/660/cmdline	pkill
File opened for reading	/proc/736/status	pkill
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/149/status	pkill
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/6/cmdline	pkill
File opened for reading	/proc/75/status	pkill
File opened for reading	/proc/147/status	pkill
File opened for reading	/proc/373/cmdline	pkill
File opened for reading	/proc/13/status	pkill
File opened for reading	/proc/952/status	pkill
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/24/cmdline	pkill
File opened for reading	/proc/72/status	pkill
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/373/status	pkill
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/663/cmdline	pkill
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/23/cmdline	pkill
File opened for reading	/proc/236/status	pkill
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/37/status	pkill
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/12/cmdline	pkill
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/3/status	pkill
File opened for reading	/proc/919/cmdline	pkill
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/76/cmdline	pkill
File opened for reading	/proc/666/status	pkill
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/10/status	pkill
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/self/stat	systemctl

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	9	Go-http-client/1.1

/tmp/558fed7a80236443c85b70f36e9452e2c33d47aceb6e126588aeeca88724297e.elf
/tmp/558fed7a80236443c85b70f36e9452e2c33d47aceb6e126588aeeca88724297e.elf
1⤵
- Enumerates kernel/hardware configuration
PID:728
- /bin/sh
  sh -c "/etc/32678&"
  2⤵
  - Executes dropped EXE
  PID:743
- /usr/sbin/service
  service crond start
  2⤵
  PID:744
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:750
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:757
- - /bin/systemctl
    systemctl --quiet is-active multi-user.target
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:761
- - /bin/systemctl
    systemctl list-unit-files --full "--type=socket"
    3⤵
    - Enumerates kernel/hardware configuration
    PID:766
- - /bin/sed
    sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
    3⤵
    PID:767
- - /bin/systemctl
    systemctl -p Triggers show dbus.socket
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:770
- - /bin/systemctl
    systemctl -p Triggers show ssh.socket
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:772
- - /bin/systemctl
    systemctl -p Triggers show syslog.socket
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:775
- - /bin/systemctl
    systemctl -p Triggers show systemd-fsckd.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:794
- - /bin/systemctl
    systemctl -p Triggers show systemd-initctl.socket
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:795
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-audit.socket
    3⤵
    PID:797
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-dev-log.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:798
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:799
- - /bin/systemctl
    systemctl -p Triggers show systemd-networkd.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:802
- - /bin/systemctl
    systemctl -p Triggers show systemd-rfkill.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:807
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-control.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:811
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-kernel.socket
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:813
- /tmp/558fed7a80236443c85b70f36e9452e2c33d47aceb6e126588aeeca88724297e.elf
  /tmp/558fed7a80236443c85b70f36e9452e2c33d47aceb6e126588aeeca88724297e.elf " "
  2⤵
  - Changes its process name
  - Enumerates kernel/hardware configuration
  PID:745
- - /usr/sbin/update-rc.d
    update-rc.d linux_kill defaults
    3⤵
    PID:759
  - - /usr/local/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:774
  - - /usr/local/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:774
  - - /usr/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:774
  - - /usr/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:774
  - - /sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:774
  - - /bin/systemctl
      systemctl daemon-reload
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:774
- - /bin/bash
    bash -c "echo \"*/1 * * * * root /.img \" >> /etc/crontab"
    3⤵
    - Creates/modifies Cron job
    PID:796
- - /usr/bin/renice
    renice -20 745
    3⤵
    PID:800
- - /bin/mount
    mount -o bind /tmp/ /proc/745
    3⤵
    PID:801
- - /usr/sbin/service
    service cron start
    3⤵
    PID:803
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:804
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:805
  - - /bin/systemctl
      systemctl --quiet is-active multi-user.target
      4⤵
      Enumerates kernel/hardware configuration
      PID:806
  - - /bin/systemctl
      systemctl list-unit-files --full "--type=socket"
      4⤵
      Enumerates kernel/hardware configuration
      PID:809
  - - /bin/sed
      sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
      4⤵
      PID:810
  - - /bin/systemctl
      systemctl -p Triggers show dbus.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:812
  - - /bin/systemctl
      systemctl -p Triggers show ssh.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:814
  - - /bin/systemctl
      systemctl -p Triggers show syslog.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:817
  - - /bin/systemctl
      systemctl -p Triggers show systemd-fsckd.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:820
  - - /bin/systemctl
      systemctl -p Triggers show systemd-initctl.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:821
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald-audit.socket
      4⤵
      Reads runtime system information
      PID:823
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald-dev-log.socket
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:824
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:825
  - - /bin/systemctl
      systemctl -p Triggers show systemd-networkd.socket
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:827
  - - /bin/systemctl
      systemctl -p Triggers show systemd-rfkill.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:828
  - - /bin/systemctl
      systemctl -p Triggers show systemd-udevd-control.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:829
  - - /bin/systemctl
      systemctl -p Triggers show systemd-udevd-kernel.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:830
- - /usr/local/sbin/systemctl
    systemctl start cron.service
    3⤵
    PID:803
- - /usr/local/bin/systemctl
    systemctl start cron.service
    3⤵
    PID:803
- - /usr/sbin/systemctl
    systemctl start cron.service
    3⤵
    PID:803
- - /usr/bin/systemctl
    systemctl start cron.service
    3⤵
    PID:803
- - /sbin/systemctl
    systemctl start cron.service
    3⤵
    PID:803
- - /bin/systemctl
    systemctl start cron.service
    3⤵
    - Enumerates kernel/hardware configuration
    PID:803
- - /bin/systemctl
    systemctl start crond.service
    3⤵
    - Enumerates kernel/hardware configuration
    PID:831

/etc/32678
/etc/32678
1⤵
- Executes dropped EXE
PID:749
- /bin/sleep
  sleep 60
  2⤵
  PID:753
- /etc/id.services.conf
  /etc/id.services.conf
  2⤵
  - Executes dropped EXE
  - Enumerates kernel/hardware configuration
  PID:915
- - /usr/bin/pkill
    pkill -9 32678
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:919
- - /bin/sh
    sh -c "/etc/32678&"
    3⤵
    - Executes dropped EXE
    PID:920
- - /usr/sbin/service
    service crond start
    3⤵
    PID:921
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:927
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:929
  - - /bin/systemctl
      systemctl --quiet is-active multi-user.target
      4⤵
      Enumerates kernel/hardware configuration
      PID:930
  - - /bin/sed
      sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
      4⤵
      PID:933
  - - /bin/systemctl
      systemctl list-unit-files --full "--type=socket"
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:932
  - - /bin/systemctl
      systemctl -p Triggers show dbus.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:934
  - - /bin/systemctl
      systemctl -p Triggers show ssh.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:935
  - - /bin/systemctl
      systemctl -p Triggers show syslog.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:936
  - - /bin/systemctl
      systemctl -p Triggers show systemd-fsckd.socket
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:937
  - - /bin/systemctl
      systemctl -p Triggers show systemd-initctl.socket
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:938
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald-audit.socket
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:939
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald-dev-log.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:940
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:941
  - - /bin/systemctl
      systemctl -p Triggers show systemd-networkd.socket
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:942
  - - /bin/systemctl
      systemctl -p Triggers show systemd-rfkill.socket
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:943
  - - /bin/systemctl
      systemctl -p Triggers show systemd-udevd-control.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:944
  - - /bin/systemctl
      systemctl -p Triggers show systemd-udevd-kernel.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:945
- - /etc/id.services.conf
    /etc/id.services.conf " "
    3⤵
    - Enumerates kernel/hardware configuration
    PID:922

/usr/local/sbin/systemctl
systemctl start crond.service
1⤵
PID:744

/usr/local/bin/systemctl
systemctl start crond.service
1⤵
PID:744

/usr/sbin/systemctl
systemctl start crond.service
1⤵
PID:744

/usr/bin/systemctl
systemctl start crond.service
1⤵
PID:744

/sbin/systemctl
systemctl start crond.service
1⤵
PID:744

/bin/systemctl
systemctl start crond.service
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:744

/etc/32678
/etc/32678
1⤵
- Executes dropped EXE
PID:926
- /bin/sleep
  sleep 60
  2⤵
  PID:928
- /etc/id.services.conf
  /etc/id.services.conf
  2⤵
  - Executes dropped EXE
  - Enumerates kernel/hardware configuration
  PID:952
- - /usr/bin/pkill
    pkill -9 32678
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:956
- - /bin/sh
    sh -c "/etc/32678&"
    3⤵
    - Executes dropped EXE
    PID:957
- - /usr/sbin/service
    service crond start
    3⤵
    PID:958
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:963
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:966
  - - /bin/systemctl
      systemctl --quiet is-active multi-user.target
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:967
  - - /bin/systemctl
      systemctl list-unit-files --full "--type=socket"
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:969
  - - /bin/sed
      sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
      4⤵
      PID:970
  - - /bin/systemctl
      systemctl -p Triggers show dbus.socket
      4⤵
      PID:971
  - - /bin/systemctl
      systemctl -p Triggers show ssh.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:972
  - - /bin/systemctl
      systemctl -p Triggers show syslog.socket
      4⤵
      Reads runtime system information
      PID:973
  - - /bin/systemctl
      systemctl -p Triggers show systemd-fsckd.socket
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:974
  - - /bin/systemctl
      systemctl -p Triggers show systemd-initctl.socket
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:975
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald-audit.socket
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:976
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald-dev-log.socket
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:977
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald.socket
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:978
  - - /bin/systemctl
      systemctl -p Triggers show systemd-networkd.socket
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:979
  - - /bin/systemctl
      systemctl -p Triggers show systemd-rfkill.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:980
  - - /bin/systemctl
      systemctl -p Triggers show systemd-udevd-control.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:981
  - - /bin/systemctl
      systemctl -p Triggers show systemd-udevd-kernel.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:982
- - /etc/id.services.conf
    /etc/id.services.conf " "
    3⤵
    - Enumerates kernel/hardware configuration
    PID:959

/usr/local/sbin/systemctl
systemctl start crond.service
1⤵
PID:921

/usr/local/bin/systemctl
systemctl start crond.service
1⤵
PID:921

/usr/sbin/systemctl
systemctl start crond.service
1⤵
PID:921

/usr/bin/systemctl
systemctl start crond.service
1⤵
PID:921

/sbin/systemctl
systemctl start crond.service
1⤵
PID:921

/bin/systemctl
systemctl start crond.service
1⤵
- Enumerates kernel/hardware configuration
PID:921

/etc/32678
/etc/32678
1⤵
PID:964
- /bin/sleep
  sleep 60
  2⤵
  PID:965

/usr/local/sbin/systemctl
systemctl start crond.service
1⤵
PID:958

/usr/local/bin/systemctl
systemctl start crond.service
1⤵
PID:958

/usr/sbin/systemctl
systemctl start crond.service
1⤵
PID:958

/usr/bin/systemctl
systemctl start crond.service
1⤵
PID:958

/sbin/systemctl
systemctl start crond.service
1⤵
PID:958

/bin/systemctl
systemctl start crond.service
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:958

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/.img

Filesize
33B

MD5
d73d3376908ea075a939e3871ad0fabe

SHA1
320ff65831247ba199515f1b94df26cc8a3e5f76

SHA256
edbdabe30d8236a2c0a4eb89dfd597552130e4c1a4e93f8fe1568920442ad73a

SHA512
57b83fef88620598beb5d65626bf757d0abef242d2d6a01796a61474dedc5095a4a9d0f292b6abb450cad3d4410ab8456253600f58ddb66cfe6d79e1c8415536

Download Submit
/etc/32678

Filesize
61B

MD5
768eaf287796da19e1cf5e0b2fb1b161

SHA1
6a1ce2ee5ccc86d1f33806feb14547b35290df2a

SHA256
1d22620dfb2a6715e5d745aed5cf841ede0e75e1747f12b9b925a2d346bc7ecb

SHA512
e6af30c9df4f7f47696069511e64ecbc8e841629d692ee4056503df3533fb7a7a74960698826260355e1dba7b6c562482a27a39bb51a4237473ce4b68472d620

Download Submit
/etc/id.services.conf

Filesize
5.6MB

MD5
f50a8a599d08e80dd60455ffdef015af

SHA1
e236c6af96236e9c57b35eda10a161de0efed75e

SHA256
558fed7a80236443c85b70f36e9452e2c33d47aceb6e126588aeeca88724297e

SHA512
e8f3dc16f25f1f2fa3e2c3eb2c13af819386a5b81fbb2c237a310b7a0e8edb6484d28a0c882eca4b4ec34775dc4d33464ad44f36cae43b074aa7f6c1c65defb7

Download Submit
/etc/init.d/linux_kill

Filesize
189B

MD5
3909975f7cc0d1121c1819b800069f31

SHA1
3e68de708c2e6c40fab6794afdee3104e5590189

SHA256
6876dac71f13a068afb863d257134275f2edba43b2acaf4924fabf97c079070b

SHA512
50600cceeb03b05f45ae61d890caee9f51ff390b6776930866e527e071d65d08241fc66673fd9b99d62fbc77d3c00fc3de4d7378cbc42f5daba5d83072b0906e

Download Submit
/etc/profile.d/bash_config.sh

Filesize
37B

MD5
cfb4e51061485fe91169381fbdc1538e

SHA1
9a85b9b766a15b01737a41d680e4593b7a9bde87

SHA256
897f37267d0ceaa2fbdaa09847f5d08e6f8b01a0348a0d666264b0f10acd0c90

SHA512
fb154ec711d2090a7461da4db8ddad2b522649a27e74162ecb203f539b1729430288bc02d78d2071bde9c4bbc005693403a57612ef50277d52f816cb94524216

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads