Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20250410-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20250410-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    17/04/2025, 05:35

General

  • Target

    linux_mips.elf

  • Size

    2.2MB

  • MD5

    177200b0a67f809a1b8364a6cab3da3b

  • SHA1

    04acdc698453106942a55be34ad9cc2da042f20f

  • SHA256

    af6b7d2303e41e97b25d9c22c60e6fbee0c053671307cf2eeb81f85729231e4b

  • SHA512

    6c4e71159517f3e0f0a079ddd297d5714852341755ffa392dd314bc8b174b9cfdc293a8f8999bb52d473551e1eee076efddffa8ab2011b7364c594031c493a93

  • SSDEEP

    24576:T+aH1HyiHIg84gD5ZhcyOt62bKLR+RVXawqel9R47cR:QKt7nqel87u

Malware Config

Signatures

  • Kaiji 1 IoCs

    Kaiji payload

  • Kaiji family
  • Executes dropped EXE 5 IoCs
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

  • Command and Scripting Interpreter: Unix Shell 1 TTPs 2 IoCs

    Execute scripts via Unix Shell.

  • Enumerates kernel/hardware configuration 1 TTPs 37 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • System Network Configuration Discovery 1 TTPs 2 IoCs

    Adversaries may gather information about the network configuration of a system.

Processes

  • /tmp/linux_mips.elf
    /tmp/linux_mips.elf
    1⤵
    • Enumerates kernel/hardware configuration
    • System Network Configuration Discovery
    PID:714
    • /tmp/linux_mips.elf
      /tmp/linux_mips.elf " "
      2⤵
      • Enumerates kernel/hardware configuration
      • System Network Configuration Discovery
      PID:721
      • /bin/sh
        /bin/sh -c "/etc/32676&"
        3⤵
        • Executes dropped EXE
        • Command and Scripting Interpreter: Unix Shell
        PID:731
      • /usr/sbin/service
        service crond start
        3⤵
          PID:734
          • /usr/bin/basename
            basename /usr/sbin/service
            4⤵
              PID:736
            • /usr/bin/basename
              basename /usr/sbin/service
              4⤵
                PID:739
              • /bin/systemctl
                systemctl --quiet is-active multi-user.target
                4⤵
                • Enumerates kernel/hardware configuration
                • Reads runtime system information
                PID:741
              • /bin/systemctl
                systemctl list-unit-files --full "--type=socket"
                4⤵
                • Enumerates kernel/hardware configuration
                • Reads runtime system information
                PID:746
              • /bin/sed
                sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
                4⤵
                  PID:747
                • /bin/systemctl
                  systemctl -p Triggers show dbus.socket
                  4⤵
                  • Enumerates kernel/hardware configuration
                  • Reads runtime system information
                  PID:750
                • /bin/systemctl
                  systemctl -p Triggers show ssh.socket
                  4⤵
                  • Enumerates kernel/hardware configuration
                  • Reads runtime system information
                  PID:752
                • /bin/systemctl
                  systemctl -p Triggers show syslog.socket
                  4⤵
                  • Enumerates kernel/hardware configuration
                  • Reads runtime system information
                  PID:754
                • /bin/systemctl
                  systemctl -p Triggers show systemd-fsckd.socket
                  4⤵
                  • Enumerates kernel/hardware configuration
                  • Reads runtime system information
                  PID:757
                • /bin/systemctl
                  systemctl -p Triggers show systemd-initctl.socket
                  4⤵
                  • Enumerates kernel/hardware configuration
                  • Reads runtime system information
                  PID:759
                • /bin/systemctl
                  systemctl -p Triggers show systemd-journald-audit.socket
                  4⤵
                  • Enumerates kernel/hardware configuration
                  • Reads runtime system information
                  PID:761
                • /bin/systemctl
                  systemctl -p Triggers show systemd-journald-dev-log.socket
                  4⤵
                  • Enumerates kernel/hardware configuration
                  • Reads runtime system information
                  PID:762
                • /bin/systemctl
                  systemctl -p Triggers show systemd-journald.socket
                  4⤵
                  • Enumerates kernel/hardware configuration
                  • Reads runtime system information
                  PID:764
                • /bin/systemctl
                  systemctl -p Triggers show systemd-networkd.socket
                  4⤵
                  • Enumerates kernel/hardware configuration
                  • Reads runtime system information
                  PID:765
                • /bin/systemctl
                  systemctl -p Triggers show systemd-rfkill.socket
                  4⤵
                  • Enumerates kernel/hardware configuration
                  • Reads runtime system information
                  PID:766
                • /bin/systemctl
                  systemctl -p Triggers show systemd-udevd-control.socket
                  4⤵
                  • Enumerates kernel/hardware configuration
                  • Reads runtime system information
                  PID:767
                • /bin/systemctl
                  systemctl -p Triggers show systemd-udevd-kernel.socket
                  4⤵
                  • Enumerates kernel/hardware configuration
                  • Reads runtime system information
                  PID:768
              • /usr/local/sbin/systemctl
                systemctl start crond.service
                3⤵
                  PID:734
                • /usr/local/bin/systemctl
                  systemctl start crond.service
                  3⤵
                    PID:734
                  • /usr/sbin/systemctl
                    systemctl start crond.service
                    3⤵
                      PID:734
                    • /usr/bin/systemctl
                      systemctl start crond.service
                      3⤵
                        PID:734
                      • /sbin/systemctl
                        systemctl start crond.service
                        3⤵
                          PID:734
                        • /bin/systemctl
                          systemctl start crond.service
                          3⤵
                          • Enumerates kernel/hardware configuration
                          PID:734
                        • /bin/sh
                          /bin/sh -c "echo \"*/1 * * * * root /.mod \" >> /etc/crontab"
                          3⤵
                          • Creates/modifies Cron job
                          • Command and Scripting Interpreter: Unix Shell
                          PID:769
                        • /usr/bin/renice
                          renice -20 721
                          3⤵
                            PID:770
                          • /bin/mount
                            mount -o bind /tmp/ /proc/721
                            3⤵
                            • Reads runtime system information
                            PID:771
                          • /usr/sbin/service
                            service cron start
                            3⤵
                              PID:772
                              • /usr/bin/basename
                                basename /usr/sbin/service
                                4⤵
                                  PID:773
                                • /usr/bin/basename
                                  basename /usr/sbin/service
                                  4⤵
                                    PID:774
                                  • /bin/systemctl
                                    systemctl --quiet is-active multi-user.target
                                    4⤵
                                    • Enumerates kernel/hardware configuration
                                    • Reads runtime system information
                                    PID:775
                                  • /bin/systemctl
                                    systemctl list-unit-files --full "--type=socket"
                                    4⤵
                                    • Enumerates kernel/hardware configuration
                                    • Reads runtime system information
                                    PID:777
                                  • /bin/sed
                                    sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
                                    4⤵
                                    • Reads runtime system information
                                    PID:778
                                  • /bin/systemctl
                                    systemctl -p Triggers show dbus.socket
                                    4⤵
                                    • Enumerates kernel/hardware configuration
                                    • Reads runtime system information
                                    PID:779
                                  • /bin/systemctl
                                    systemctl -p Triggers show ssh.socket
                                    4⤵
                                    • Enumerates kernel/hardware configuration
                                    • Reads runtime system information
                                    PID:780
                                  • /bin/systemctl
                                    systemctl -p Triggers show syslog.socket
                                    4⤵
                                    • Enumerates kernel/hardware configuration
                                    • Reads runtime system information
                                    PID:781
                                  • /bin/systemctl
                                    systemctl -p Triggers show systemd-fsckd.socket
                                    4⤵
                                    • Enumerates kernel/hardware configuration
                                    • Reads runtime system information
                                    PID:782
                                  • /bin/systemctl
                                    systemctl -p Triggers show systemd-initctl.socket
                                    4⤵
                                    • Enumerates kernel/hardware configuration
                                    • Reads runtime system information
                                    PID:783
                                  • /bin/systemctl
                                    systemctl -p Triggers show systemd-journald-audit.socket
                                    4⤵
                                    • Enumerates kernel/hardware configuration
                                    • Reads runtime system information
                                    PID:784
                                  • /bin/systemctl
                                    systemctl -p Triggers show systemd-journald-dev-log.socket
                                    4⤵
                                    • Enumerates kernel/hardware configuration
                                    • Reads runtime system information
                                    PID:785
                                  • /bin/systemctl
                                    systemctl -p Triggers show systemd-journald.socket
                                    4⤵
                                    • Enumerates kernel/hardware configuration
                                    • Reads runtime system information
                                    PID:786
                                  • /bin/systemctl
                                    systemctl -p Triggers show systemd-networkd.socket
                                    4⤵
                                    • Enumerates kernel/hardware configuration
                                    • Reads runtime system information
                                    PID:787
                                  • /bin/systemctl
                                    systemctl -p Triggers show systemd-rfkill.socket
                                    4⤵
                                    • Enumerates kernel/hardware configuration
                                    • Reads runtime system information
                                    PID:788
                                  • /bin/systemctl
                                    systemctl -p Triggers show systemd-udevd-control.socket
                                    4⤵
                                    • Enumerates kernel/hardware configuration
                                    • Reads runtime system information
                                    PID:790
                                  • /bin/systemctl
                                    systemctl -p Triggers show systemd-udevd-kernel.socket
                                    4⤵
                                    • Enumerates kernel/hardware configuration
                                    • Reads runtime system information
                                    PID:792
                                • /usr/local/sbin/systemctl
                                  systemctl start cron.service
                                  3⤵
                                    PID:772
                                  • /usr/local/bin/systemctl
                                    systemctl start cron.service
                                    3⤵
                                      PID:772
                                    • /usr/sbin/systemctl
                                      systemctl start cron.service
                                      3⤵
                                        PID:772
                                      • /usr/bin/systemctl
                                        systemctl start cron.service
                                        3⤵
                                          PID:772
                                        • /sbin/systemctl
                                          systemctl start cron.service
                                          3⤵
                                            PID:772
                                          • /bin/systemctl
                                            systemctl start cron.service
                                            3⤵
                                            • Enumerates kernel/hardware configuration
                                            PID:772
                                          • /bin/systemctl
                                            systemctl start crond.service
                                            3⤵
                                            • Enumerates kernel/hardware configuration
                                            • Reads runtime system information
                                            PID:795
                                      • /etc/32676
                                        /etc/32676
                                        1⤵
                                        • Executes dropped EXE
                                        PID:733
                                        • /bin/sleep
                                          sleep 60
                                          2⤵
                                            PID:737
                                          • /etc/opt.services.cfg
                                            /etc/opt.services.cfg
                                            2⤵
                                            • Executes dropped EXE
                                            • Enumerates kernel/hardware configuration
                                            PID:884
                                            • /etc/opt.services.cfg
                                              /etc/opt.services.cfg " "
                                              3⤵
                                              • Enumerates kernel/hardware configuration
                                              PID:888
                                          • /bin/sleep
                                            sleep 60
                                            2⤵
                                              PID:889
                                            • /etc/opt.services.cfg
                                              /etc/opt.services.cfg
                                              2⤵
                                              • Executes dropped EXE
                                              • Enumerates kernel/hardware configuration
                                              PID:903
                                              • /etc/opt.services.cfg
                                                /etc/opt.services.cfg " "
                                                3⤵
                                                • Enumerates kernel/hardware configuration
                                                PID:907
                                            • /bin/sleep
                                              sleep 60
                                              2⤵
                                                PID:908

                                            Network

                                            MITRE ATT&CK Enterprise v16

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • /.mod

                                              Filesize

                                              34B

                                              MD5

                                              f5a3713282e43c200f30342f5ff5e2ea

                                              SHA1

                                              2b2ce1a207e2b691a074c6f78f71c4785aae426a

                                              SHA256

                                              6ab64e727571458d4884fb2fe82c27c467db0699cb8f648b3f0217c35d2b7511

                                              SHA512

                                              5bcb8cd360409147a486755f90e0cdd97183af02ce8de5135b7c6a8a010deb9ef12dcd5ee9a2a8fd2e159347f68e72d6b7fd75e943b4fcd928d7a74b97476013

                                            • /etc/.walk

                                              Filesize

                                              41B

                                              MD5

                                              405ea7aa9ebe3c5f397ee6da9784cd92

                                              SHA1

                                              e4b3de80bf97d97c9194de35d63e8fdfd37823c7

                                              SHA256

                                              8176caa5023d1e0f5719220777ecd7b9b3901c68ecb0ad1f6e802df80d90a4bf

                                              SHA512

                                              833f045507160bc2b7374e0f2748de72b9605374d4a0df5482edbc799729f8328f4753f6495a134b46f2beafaa6dbbe4c21966b785ecf160f7b47146492cfe93

                                            • /etc/.walk

                                              Filesize

                                              90B

                                              MD5

                                              487aaa2d9e8103de54e74f708a988a25

                                              SHA1

                                              8cd396d5c6bc7d057275736c0b59086bbd8a4169

                                              SHA256

                                              ab15959587e0a32350ad92777b3ae32af599f5630b65002d924f686c4a30a827

                                              SHA512

                                              0187cecafaefbffc2546b4d7f27f06b555daa003b4591a282040808eb2719820e89673013546818b4ad9472d81c8135611c25d8b6b85b03e4d62854655ea96fd

                                            • /etc/32676

                                              Filesize

                                              61B

                                              MD5

                                              47684525bfdf26f49fd1cf742b17c015

                                              SHA1

                                              c4ab14ba22420ff9acadfc698a38d0cd99e9fbfa

                                              SHA256

                                              b7ce294613dd2c237a4a50548bfcd5c14d166107f2d2e965499bc78695300d5b

                                              SHA512

                                              948f9c519ae9afe1c821c5d58da2e584e50356dabef597ccd408853a9038560b9fb1c5894900e2725b48977ffd49d18a439436bb4946e2164ac9fcf2a8637621

                                            • /etc/opt.services.cfg

                                              Filesize

                                              2.2MB

                                              MD5

                                              177200b0a67f809a1b8364a6cab3da3b

                                              SHA1

                                              04acdc698453106942a55be34ad9cc2da042f20f

                                              SHA256

                                              af6b7d2303e41e97b25d9c22c60e6fbee0c053671307cf2eeb81f85729231e4b

                                              SHA512

                                              6c4e71159517f3e0f0a079ddd297d5714852341755ffa392dd314bc8b174b9cfdc293a8f8999bb52d473551e1eee076efddffa8ab2011b7364c594031c493a93

                                            • /etc/profile.d/gateway.sh

                                              Filesize

                                              915B

                                              MD5

                                              217d1865cb2770d7650ead8960539181

                                              SHA1

                                              5f0f39bd441fa71c36306386d8a81f59480d4e53

                                              SHA256

                                              fff6d267ac34e86916b0f08ff177c854a20f9353ecd1c3d0250c18fd0b375fa3

                                              SHA512

                                              f3442829f25e60dc17504619798da502922ea3ab2d92355316e67bd236423e28ed0af8f3d2270b52fe3e7108f5280ea113ec9a03cc1abdc8d6360ecece455d31

                                            • /usr/bin/include/find

                                              Filesize

                                              240KB

                                              MD5

                                              97b5c6c1b307114efc38193175a343c3

                                              SHA1

                                              24015d4f95c6878ea5027c134eddebb7126b610f

                                              SHA256

                                              b1a89f313023b476fc826d8fac689679504e61ae8e650681fb966e810ed34970

                                              SHA512

                                              e5359f3e082f54f5cfd7afa7771d8724d161d48d09372f203bdca222a47a63919fdfb76b6db7fb8ff61e92f8fd04fdec962e94331ff12705cf53ce5e23d33180