Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240418-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    17/04/2025, 05:30

General

  • Target

    linux_arm5.elf

  • Size

    2.0MB

  • MD5

    f2c0f22bccb73b34d04e53c00718b65d

  • SHA1

    9183973ad6b15e8c2230fee903dd60bf23487beb

  • SHA256

    e3bbaa4dd4acfceaaee209232a3f8f4377b97ad1835fc50d8119c8bc24e5d2d6

  • SHA512

    9c588e0af9c32696fef8331957410736e0ed304fac99fbd88289b96209ef684045df52ce1113940ef8c48cf041bd599752a444ab7c2e688c144017784a426d68

  • SSDEEP

    24576:eajMIV0QZKaSmrzMjTgmJX5ZmrzXJu+M5lVhmhXZ1smHwEN3rWCh5WVhuBPnjKqK:e6s9DMqF2T1y

Malware Config

Extracted

Family

kaiji

C2

103.45.68.160:888

Signatures

  • Kaiji 1 IoCs

    Kaiji payload

  • Kaiji family
  • Executes dropped EXE 5 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

  • Creates/modifies environment variables 1 TTPs 3 IoCs

    Creating/modifying environment variables is a common persistence mechanism.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d 2 TTPs 17 IoCs

    Adds/modifies system service, likely for persistence.

  • Write file to user bin folder 2 IoCs
  • Modifies Bash startup script 2 TTPs 3 IoCs
  • Command and Scripting Interpreter: Unix Shell 1 TTPs 2 IoCs

    Execute scripts via Unix Shell.

  • Enumerates kernel/hardware configuration 1 TTPs 37 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/linux_arm5.elf
    /tmp/linux_arm5.elf
    1⤵
    • Enumerates kernel/hardware configuration
    PID:643
    • /tmp/linux_arm5.elf
      /tmp/linux_arm5.elf " "
      2⤵
      • Modifies Watchdog functionality
      • Creates/modifies environment variables
      • Modifies init.d
      • Write file to user bin folder
      • Modifies Bash startup script
      • Enumerates kernel/hardware configuration
      • Reads runtime system information
      PID:648
      • /bin/sh
        /bin/sh -c "/etc/32676&"
        3⤵
        • Executes dropped EXE
        • Command and Scripting Interpreter: Unix Shell
        PID:659
      • /usr/sbin/service
        service crond start
        3⤵
          PID:662
          • /usr/bin/basename
            basename /usr/sbin/service
            4⤵
              PID:664
            • /usr/bin/basename
              basename /usr/sbin/service
              4⤵
                PID:668
              • /bin/systemctl
                systemctl --quiet is-active multi-user.target
                4⤵
                • Enumerates kernel/hardware configuration
                • Reads runtime system information
                PID:669
              • /bin/sed
                sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
                4⤵
                  PID:676
                • /bin/systemctl
                  systemctl list-unit-files --full "--type=socket"
                  4⤵
                  • Enumerates kernel/hardware configuration
                  • Reads runtime system information
                  PID:675
                • /bin/systemctl
                  systemctl -p Triggers show dbus.socket
                  4⤵
                  • Enumerates kernel/hardware configuration
                  • Reads runtime system information
                  PID:684
                • /bin/systemctl
                  systemctl -p Triggers show ssh.socket
                  4⤵
                  • Enumerates kernel/hardware configuration
                  • Reads runtime system information
                  PID:688
                • /bin/systemctl
                  systemctl -p Triggers show syslog.socket
                  4⤵
                  • Enumerates kernel/hardware configuration
                  • Reads runtime system information
                  PID:689
                • /bin/systemctl
                  systemctl -p Triggers show systemd-fsckd.socket
                  4⤵
                  • Enumerates kernel/hardware configuration
                  PID:691
                • /bin/systemctl
                  systemctl -p Triggers show systemd-initctl.socket
                  4⤵
                  • Enumerates kernel/hardware configuration
                  PID:693
                • /bin/systemctl
                  systemctl -p Triggers show systemd-journald-audit.socket
                  4⤵
                  • Enumerates kernel/hardware configuration
                  • Reads runtime system information
                  PID:694
                • /bin/systemctl
                  systemctl -p Triggers show systemd-journald-dev-log.socket
                  4⤵
                  • Enumerates kernel/hardware configuration
                  PID:695
                • /bin/systemctl
                  systemctl -p Triggers show systemd-journald.socket
                  4⤵
                  • Enumerates kernel/hardware configuration
                  • Reads runtime system information
                  PID:696
                • /bin/systemctl
                  systemctl -p Triggers show systemd-networkd.socket
                  4⤵
                  • Enumerates kernel/hardware configuration
                  • Reads runtime system information
                  PID:697
                • /bin/systemctl
                  systemctl -p Triggers show systemd-rfkill.socket
                  4⤵
                  • Enumerates kernel/hardware configuration
                  • Reads runtime system information
                  PID:698
                • /bin/systemctl
                  systemctl -p Triggers show systemd-udevd-control.socket
                  4⤵
                  • Enumerates kernel/hardware configuration
                  • Reads runtime system information
                  PID:699
                • /bin/systemctl
                  systemctl -p Triggers show systemd-udevd-kernel.socket
                  4⤵
                  • Enumerates kernel/hardware configuration
                  • Reads runtime system information
                  PID:700
              • /usr/local/sbin/systemctl
                systemctl start crond.service
                3⤵
                  PID:662
                • /usr/local/bin/systemctl
                  systemctl start crond.service
                  3⤵
                    PID:662
                  • /usr/sbin/systemctl
                    systemctl start crond.service
                    3⤵
                      PID:662
                    • /usr/bin/systemctl
                      systemctl start crond.service
                      3⤵
                        PID:662
                      • /sbin/systemctl
                        systemctl start crond.service
                        3⤵
                          PID:662
                        • /bin/systemctl
                          systemctl start crond.service
                          3⤵
                          • Enumerates kernel/hardware configuration
                          • Reads runtime system information
                          PID:662
                        • /bin/sh
                          /bin/sh -c "echo \"*/1 * * * * root /.mod \" >> /etc/crontab"
                          3⤵
                          • Creates/modifies Cron job
                          • Command and Scripting Interpreter: Unix Shell
                          PID:703
                        • /usr/bin/renice
                          renice -20 648
                          3⤵
                            PID:706
                          • /bin/mount
                            mount -o bind /tmp/ /proc/648
                            3⤵
                            • Reads runtime system information
                            PID:708
                          • /usr/sbin/service
                            service cron start
                            3⤵
                              PID:709
                              • /usr/bin/basename
                                basename /usr/sbin/service
                                4⤵
                                  PID:710
                                • /usr/bin/basename
                                  basename /usr/sbin/service
                                  4⤵
                                    PID:711
                                  • /bin/systemctl
                                    systemctl --quiet is-active multi-user.target
                                    4⤵
                                    • Enumerates kernel/hardware configuration
                                    • Reads runtime system information
                                    PID:712
                                  • /bin/sed
                                    sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
                                    4⤵
                                      PID:715
                                    • /bin/systemctl
                                      systemctl list-unit-files --full "--type=socket"
                                      4⤵
                                      • Enumerates kernel/hardware configuration
                                      • Reads runtime system information
                                      PID:714
                                    • /bin/systemctl
                                      systemctl -p Triggers show dbus.socket
                                      4⤵
                                      • Enumerates kernel/hardware configuration
                                      • Reads runtime system information
                                      PID:719
                                    • /bin/systemctl
                                      systemctl -p Triggers show ssh.socket
                                      4⤵
                                      • Enumerates kernel/hardware configuration
                                      • Reads runtime system information
                                      PID:720
                                    • /bin/systemctl
                                      systemctl -p Triggers show syslog.socket
                                      4⤵
                                      • Enumerates kernel/hardware configuration
                                      • Reads runtime system information
                                      PID:721
                                    • /bin/systemctl
                                      systemctl -p Triggers show systemd-fsckd.socket
                                      4⤵
                                      • Enumerates kernel/hardware configuration
                                      • Reads runtime system information
                                      PID:722
                                    • /bin/systemctl
                                      systemctl -p Triggers show systemd-initctl.socket
                                      4⤵
                                      • Enumerates kernel/hardware configuration
                                      PID:723
                                    • /bin/systemctl
                                      systemctl -p Triggers show systemd-journald-audit.socket
                                      4⤵
                                      • Enumerates kernel/hardware configuration
                                      • Reads runtime system information
                                      PID:724
                                    • /bin/systemctl
                                      systemctl -p Triggers show systemd-journald-dev-log.socket
                                      4⤵
                                      • Enumerates kernel/hardware configuration
                                      • Reads runtime system information
                                      PID:725
                                    • /bin/systemctl
                                      systemctl -p Triggers show systemd-journald.socket
                                      4⤵
                                      • Enumerates kernel/hardware configuration
                                      PID:727
                                    • /bin/systemctl
                                      systemctl -p Triggers show systemd-networkd.socket
                                      4⤵
                                      • Enumerates kernel/hardware configuration
                                      • Reads runtime system information
                                      PID:728
                                    • /bin/systemctl
                                      systemctl -p Triggers show systemd-rfkill.socket
                                      4⤵
                                      • Enumerates kernel/hardware configuration
                                      PID:729
                                    • /bin/systemctl
                                      systemctl -p Triggers show systemd-udevd-control.socket
                                      4⤵
                                      • Enumerates kernel/hardware configuration
                                      PID:730
                                    • /bin/systemctl
                                      systemctl -p Triggers show systemd-udevd-kernel.socket
                                      4⤵
                                      • Enumerates kernel/hardware configuration
                                      • Reads runtime system information
                                      PID:731
                                  • /usr/local/sbin/systemctl
                                    systemctl start cron.service
                                    3⤵
                                      PID:709
                                    • /usr/local/bin/systemctl
                                      systemctl start cron.service
                                      3⤵
                                        PID:709
                                      • /usr/sbin/systemctl
                                        systemctl start cron.service
                                        3⤵
                                          PID:709
                                        • /usr/bin/systemctl
                                          systemctl start cron.service
                                          3⤵
                                            PID:709
                                          • /sbin/systemctl
                                            systemctl start cron.service
                                            3⤵
                                              PID:709
                                            • /bin/systemctl
                                              systemctl start cron.service
                                              3⤵
                                              • Enumerates kernel/hardware configuration
                                              • Reads runtime system information
                                              PID:709
                                            • /bin/systemctl
                                              systemctl start crond.service
                                              3⤵
                                              • Enumerates kernel/hardware configuration
                                              • Reads runtime system information
                                              PID:732
                                        • /etc/32676
                                          /etc/32676
                                          1⤵
                                          • Executes dropped EXE
                                          PID:661
                                          • /bin/sleep
                                            sleep 60
                                            2⤵
                                              PID:665
                                            • /etc/opt.services.cfg
                                              /etc/opt.services.cfg
                                              2⤵
                                              • Executes dropped EXE
                                              • Enumerates kernel/hardware configuration
                                              PID:828
                                              • /etc/opt.services.cfg
                                                /etc/opt.services.cfg " "
                                                3⤵
                                                • Enumerates kernel/hardware configuration
                                                PID:832
                                            • /bin/sleep
                                              sleep 60
                                              2⤵
                                                PID:833
                                              • /etc/opt.services.cfg
                                                /etc/opt.services.cfg
                                                2⤵
                                                • Executes dropped EXE
                                                • Enumerates kernel/hardware configuration
                                                PID:860
                                                • /etc/opt.services.cfg
                                                  /etc/opt.services.cfg " "
                                                  3⤵
                                                  • Enumerates kernel/hardware configuration
                                                  PID:864
                                              • /bin/sleep
                                                sleep 60
                                                2⤵
                                                  PID:865

                                              Network

                                              MITRE ATT&CK Enterprise v16

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              • /.mod

                                                Filesize

                                                34B

                                                MD5

                                                f5a3713282e43c200f30342f5ff5e2ea

                                                SHA1

                                                2b2ce1a207e2b691a074c6f78f71c4785aae426a

                                                SHA256

                                                6ab64e727571458d4884fb2fe82c27c467db0699cb8f648b3f0217c35d2b7511

                                                SHA512

                                                5bcb8cd360409147a486755f90e0cdd97183af02ce8de5135b7c6a8a010deb9ef12dcd5ee9a2a8fd2e159347f68e72d6b7fd75e943b4fcd928d7a74b97476013

                                              • /etc/.walk

                                                Filesize

                                                41B

                                                MD5

                                                348b8a56b58f9fed460f26849e095608

                                                SHA1

                                                c7907efcbdbe1151d57d93628008b6a8b3df6aa0

                                                SHA256

                                                c6a97edd7114d983c962725cf9d9f1687176dcce1b7be10e7979c99d4ec9b53a

                                                SHA512

                                                426ed9e0424818a338974aaabfe28ce05f54ad9d2b48e81f9ca94b390d538ebf4f2e1e46fc434dcdf65274bd5d0702414df64815a247eebc13d52cecdd3e7370

                                              • /etc/.walk

                                                Filesize

                                                90B

                                                MD5

                                                67a8a672aa964a1b05521a0664040819

                                                SHA1

                                                479e9eac69bd32a9af9a46ef5480f9baef774062

                                                SHA256

                                                8785bde47641b58610db8f485726280c766ebed532cfcfa10591918f982f1f76

                                                SHA512

                                                df5004baa6c5eeb1ee75da50763a8e414bae276e796f4d8ffe6a5df38f2f6af667853c8a73fb8dfe3483e016477e8c61f7acb1ce1365f07cdcac683e3c131b6c

                                              • /etc/32676

                                                Filesize

                                                61B

                                                MD5

                                                47684525bfdf26f49fd1cf742b17c015

                                                SHA1

                                                c4ab14ba22420ff9acadfc698a38d0cd99e9fbfa

                                                SHA256

                                                b7ce294613dd2c237a4a50548bfcd5c14d166107f2d2e965499bc78695300d5b

                                                SHA512

                                                948f9c519ae9afe1c821c5d58da2e584e50356dabef597ccd408853a9038560b9fb1c5894900e2725b48977ffd49d18a439436bb4946e2164ac9fcf2a8637621

                                              • /etc/opt.services.cfg

                                                Filesize

                                                2.0MB

                                                MD5

                                                f2c0f22bccb73b34d04e53c00718b65d

                                                SHA1

                                                9183973ad6b15e8c2230fee903dd60bf23487beb

                                                SHA256

                                                e3bbaa4dd4acfceaaee209232a3f8f4377b97ad1835fc50d8119c8bc24e5d2d6

                                                SHA512

                                                9c588e0af9c32696fef8331957410736e0ed304fac99fbd88289b96209ef684045df52ce1113940ef8c48cf041bd599752a444ab7c2e688c144017784a426d68

                                              • /etc/profile.d/gateway.sh

                                                Filesize

                                                915B

                                                MD5

                                                1affabcad4e31c4ffd5edbfbca7ff64a

                                                SHA1

                                                013f0a3c631c6e721626e67c0e5c60438e290e51

                                                SHA256

                                                b11da3af029e1439a0fd9fe735907d8599700f8fc038f0627dbfce9b1232c4d1

                                                SHA512

                                                353bf467991e3b18add026c3a64d31e694f034dbebd060f60836245c79f088256acc209335dcddf7a08eba9b1650c6206b225f21ff77d090ecb121698ecb63b3

                                              • /usr/bin/include/find

                                                Filesize

                                                134KB

                                                MD5

                                                138a27d6fe52fa1132760a4fa48922e0

                                                SHA1

                                                e0250e4d7bf33a5a1064344224148b889cb15138

                                                SHA256

                                                81a10dad907b23521461bd3fc83c2cedb2218933a328d9a05e3c9f6a9a1d42aa

                                                SHA512

                                                ee0078afad63fc2aaffdebb7127d1c7d4459287fee75358f57c82d397c39b7bf64338fb6996dfb1747cd9a896d714b3c76f0948727be91550f1affa1c0298a9e