Analysis

  • max time kernel
    148s
  • max time network
    146s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240508-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    17/04/2025, 05:36

General

  • Target

    linux_386.elf

  • Size

    1.8MB

  • MD5

    425032ac432cb4a58481c8f2fac1a298

  • SHA1

    c7538b5ff5057f553bb7ae707e8fc98281e8a8bd

  • SHA256

    3f5d9a1535b34fa397a15162abca45f8cefc97fbab8bf52116e550b646879a7b

  • SHA512

    db5631b8499f3be061e40166b4cac9a934a22c5d726a88d6fd63c9633f435de956b740addaa5accf769a09f3cfc5f8c0b34cca1dca24439986bd78ef39f2da76

  • SSDEEP

    24576:DIww1az0HpQKMNRjiSZAwyZW82DBNbT5ppkmesFMpladOmslgBYVVWXyWz1v:/1TbVNH4plzm/BGWz1

Malware Config

Extracted

Family

kaiji

C2

103.45.68.160:888

Signatures

  • Kaiji 1 IoCs

    Kaiji payload

  • Kaiji family
  • Executes dropped EXE 5 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

  • Creates/modifies environment variables 1 TTPs 3 IoCs

    Creating/modifying environment variables is a common persistence mechanism.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d 2 TTPs 34 IoCs

    Adds/modifies system service, likely for persistence.

  • Write file to user bin folder 4 IoCs
  • Modifies Bash startup script 2 TTPs 3 IoCs
  • Enumerates kernel/hardware configuration 1 TTPs 5 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/linux_386.elf
    /tmp/linux_386.elf " "
    1⤵
    • Executes dropped EXE
    • Modifies Watchdog functionality
    • Creates/modifies Cron job
    • Creates/modifies environment variables
    • Modifies init.d
    • Write file to user bin folder
    • Modifies Bash startup script
    • Enumerates kernel/hardware configuration
    • Reads runtime system information
    PID:1512
    • /usr/bin/basename
      basename /usr/sbin/service
      2⤵
        PID:1520
      • /usr/bin/basename
        basename /usr/sbin/service
        2⤵
          PID:1521
        • /bin/systemctl
          systemctl --quiet is-active multi-user.target
          2⤵
          • Reads runtime system information
          PID:1522
        • /bin/sed
          sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
          2⤵
            PID:1525
          • /bin/systemctl
            systemctl list-unit-files --full "--type=socket"
            2⤵
            • Reads runtime system information
            PID:1524
          • /bin/systemctl
            systemctl -p Triggers show acpid.socket
            2⤵
            • Reads runtime system information
            PID:1526
          • /bin/systemctl
            systemctl -p Triggers show apport-forward.socket
            2⤵
            • Reads runtime system information
            PID:1528
          • /bin/systemctl
            systemctl -p Triggers show avahi-daemon.socket
            2⤵
              PID:1531
            • /bin/systemctl
              systemctl -p Triggers show cups.socket
              2⤵
              • Reads runtime system information
              PID:1532
            • /bin/systemctl
              systemctl -p Triggers show dbus.socket
              2⤵
              • Reads runtime system information
              PID:1533
            • /bin/systemctl
              systemctl -p Triggers show saned.socket
              2⤵
              • Reads runtime system information
              PID:1534
            • /bin/systemctl
              systemctl -p Triggers show snapd.socket
              2⤵
                PID:1535
              • /bin/systemctl
                systemctl -p Triggers show ssh.socket
                2⤵
                • Reads runtime system information
                PID:1536
              • /bin/systemctl
                systemctl -p Triggers show syslog.socket
                2⤵
                • Reads runtime system information
                PID:1537
              • /bin/systemctl
                systemctl -p Triggers show systemd-fsckd.socket
                2⤵
                • Reads runtime system information
                PID:1538
              • /bin/systemctl
                systemctl -p Triggers show systemd-initctl.socket
                2⤵
                • Reads runtime system information
                PID:1539
              • /bin/systemctl
                systemctl -p Triggers show systemd-journald-audit.socket
                2⤵
                  PID:1540
                • /bin/systemctl
                  systemctl -p Triggers show systemd-journald-dev-log.socket
                  2⤵
                  • Reads runtime system information
                  PID:1541
                • /bin/systemctl
                  systemctl -p Triggers show systemd-journald.socket
                  2⤵
                    PID:1542
                  • /bin/systemctl
                    systemctl -p Triggers show systemd-networkd.socket
                    2⤵
                      PID:1543
                    • /bin/systemctl
                      systemctl -p Triggers show systemd-rfkill.socket
                      2⤵
                      • Reads runtime system information
                      PID:1544
                    • /bin/systemctl
                      systemctl -p Triggers show systemd-udevd-control.socket
                      2⤵
                        PID:1545
                      • /bin/systemctl
                        systemctl -p Triggers show systemd-udevd-kernel.socket
                        2⤵
                        • Reads runtime system information
                        PID:1546
                      • /bin/systemctl
                        systemctl -p Triggers show uuidd.socket
                        2⤵
                        • Reads runtime system information
                        PID:1547
                      • /usr/local/sbin/systemctl
                        systemctl start crond.service
                        2⤵
                          PID:1518
                        • /usr/local/bin/systemctl
                          systemctl start crond.service
                          2⤵
                            PID:1518
                          • /usr/sbin/systemctl
                            systemctl start crond.service
                            2⤵
                              PID:1518
                            • /usr/bin/systemctl
                              systemctl start crond.service
                              2⤵
                                PID:1518
                              • /sbin/systemctl
                                systemctl start crond.service
                                2⤵
                                  PID:1518
                                • /bin/systemctl
                                  systemctl start crond.service
                                  2⤵
                                  • Reads runtime system information
                                  PID:1518
                                • /usr/bin/basename
                                  basename /usr/sbin/service
                                  2⤵
                                    PID:1553
                                  • /usr/bin/basename
                                    basename /usr/sbin/service
                                    2⤵
                                      PID:1554
                                    • /bin/systemctl
                                      systemctl --quiet is-active multi-user.target
                                      2⤵
                                        PID:1555
                                      • /bin/sed
                                        sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
                                        2⤵
                                          PID:1558
                                        • /bin/systemctl
                                          systemctl list-unit-files --full "--type=socket"
                                          2⤵
                                          • Reads runtime system information
                                          PID:1557
                                        • /bin/systemctl
                                          systemctl -p Triggers show acpid.socket
                                          2⤵
                                          • Reads runtime system information
                                          PID:1559
                                        • /bin/systemctl
                                          systemctl -p Triggers show apport-forward.socket
                                          2⤵
                                          • Reads runtime system information
                                          PID:1560
                                        • /bin/systemctl
                                          systemctl -p Triggers show avahi-daemon.socket
                                          2⤵
                                          • Reads runtime system information
                                          PID:1561
                                        • /bin/systemctl
                                          systemctl -p Triggers show cups.socket
                                          2⤵
                                          • Reads runtime system information
                                          PID:1562
                                        • /bin/systemctl
                                          systemctl -p Triggers show dbus.socket
                                          2⤵
                                            PID:1563
                                          • /bin/systemctl
                                            systemctl -p Triggers show saned.socket
                                            2⤵
                                            • Reads runtime system information
                                            PID:1564
                                          • /bin/systemctl
                                            systemctl -p Triggers show snapd.socket
                                            2⤵
                                              PID:1565
                                            • /bin/systemctl
                                              systemctl -p Triggers show ssh.socket
                                              2⤵
                                              • Reads runtime system information
                                              PID:1566
                                            • /bin/systemctl
                                              systemctl -p Triggers show syslog.socket
                                              2⤵
                                                PID:1567
                                              • /bin/systemctl
                                                systemctl -p Triggers show systemd-fsckd.socket
                                                2⤵
                                                • Reads runtime system information
                                                PID:1568
                                              • /bin/systemctl
                                                systemctl -p Triggers show systemd-initctl.socket
                                                2⤵
                                                • Reads runtime system information
                                                PID:1569
                                              • /bin/systemctl
                                                systemctl -p Triggers show systemd-journald-audit.socket
                                                2⤵
                                                • Reads runtime system information
                                                PID:1570
                                              • /bin/systemctl
                                                systemctl -p Triggers show systemd-journald-dev-log.socket
                                                2⤵
                                                • Reads runtime system information
                                                PID:1571
                                              • /bin/systemctl
                                                systemctl -p Triggers show systemd-journald.socket
                                                2⤵
                                                  PID:1572
                                                • /bin/systemctl
                                                  systemctl -p Triggers show systemd-networkd.socket
                                                  2⤵
                                                  • Reads runtime system information
                                                  PID:1573
                                                • /bin/systemctl
                                                  systemctl -p Triggers show systemd-rfkill.socket
                                                  2⤵
                                                    PID:1574
                                                  • /bin/systemctl
                                                    systemctl -p Triggers show systemd-udevd-control.socket
                                                    2⤵
                                                    • Reads runtime system information
                                                    PID:1575
                                                  • /bin/systemctl
                                                    systemctl -p Triggers show systemd-udevd-kernel.socket
                                                    2⤵
                                                    • Reads runtime system information
                                                    PID:1576
                                                  • /bin/systemctl
                                                    systemctl -p Triggers show uuidd.socket
                                                    2⤵
                                                    • Reads runtime system information
                                                    PID:1577
                                                  • /usr/local/sbin/systemctl
                                                    systemctl start cron.service
                                                    2⤵
                                                      PID:1552
                                                    • /usr/local/bin/systemctl
                                                      systemctl start cron.service
                                                      2⤵
                                                        PID:1552
                                                      • /usr/sbin/systemctl
                                                        systemctl start cron.service
                                                        2⤵
                                                          PID:1552
                                                        • /usr/bin/systemctl
                                                          systemctl start cron.service
                                                          2⤵
                                                            PID:1552
                                                          • /sbin/systemctl
                                                            systemctl start cron.service
                                                            2⤵
                                                              PID:1552
                                                            • /bin/systemctl
                                                              systemctl start cron.service
                                                              2⤵
                                                              • Reads runtime system information
                                                              PID:1552
                                                          • /etc/32676
                                                            /etc/32676
                                                            1⤵
                                                            • Executes dropped EXE
                                                            • Enumerates kernel/hardware configuration
                                                            PID:1517
                                                            • /bin/sleep
                                                              sleep 60
                                                              2⤵
                                                                PID:1519
                                                              • /etc/opt.services.cfg
                                                                /etc/opt.services.cfg " "
                                                                2⤵
                                                                • Enumerates kernel/hardware configuration
                                                                PID:1610
                                                              • /bin/sleep
                                                                sleep 60
                                                                2⤵
                                                                  PID:1611
                                                                • /etc/opt.services.cfg
                                                                  /etc/opt.services.cfg " "
                                                                  2⤵
                                                                  • Enumerates kernel/hardware configuration
                                                                  PID:1629
                                                                • /bin/sleep
                                                                  sleep 60
                                                                  2⤵
                                                                    PID:1630

                                                                Network

                                                                MITRE ATT&CK Enterprise v16

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                • /.mod

                                                                  Filesize

                                                                  34B

                                                                  MD5

                                                                  f5a3713282e43c200f30342f5ff5e2ea

                                                                  SHA1

                                                                  2b2ce1a207e2b691a074c6f78f71c4785aae426a

                                                                  SHA256

                                                                  6ab64e727571458d4884fb2fe82c27c467db0699cb8f648b3f0217c35d2b7511

                                                                  SHA512

                                                                  5bcb8cd360409147a486755f90e0cdd97183af02ce8de5135b7c6a8a010deb9ef12dcd5ee9a2a8fd2e159347f68e72d6b7fd75e943b4fcd928d7a74b97476013

                                                                • /etc/.walk

                                                                  Filesize

                                                                  49B

                                                                  MD5

                                                                  d2251bfea9a6b1de4eb296abf42c0ffc

                                                                  SHA1

                                                                  806c8013b9a2587f6d6e96017227994a204a03a7

                                                                  SHA256

                                                                  8e09954878d172dbe6fcfb11beedc902fd710cb9ef8a8c2a401022f2c10c81ec

                                                                  SHA512

                                                                  26859c09b676c4ea1054033c5eb3a137c57ecd919dc2fbc1eb6e99461082aa91f1da87b8a3534f79f0029cd8c24c026911e45182c571d5ea589d4306de08b538

                                                                • /etc/.walk

                                                                  Filesize

                                                                  98B

                                                                  MD5

                                                                  bd779dd44dd2a124b045ba61a669b7af

                                                                  SHA1

                                                                  2c2eb03fc3ca435414b4b8a8f3f722e91304e25f

                                                                  SHA256

                                                                  17d7548b0bb5ecb99f4098ccfb2a878f340279047d497cb78ce160bceca89e5b

                                                                  SHA512

                                                                  d99d842b57de82df0f65b3f33bab29b7f55a21b6a3a3c143f6f294856d9c87c52c1ef7791265d62bd572bd09a638bbba41d0fef990cd8de8ce8406234203fd53

                                                                • /etc/32676

                                                                  Filesize

                                                                  61B

                                                                  MD5

                                                                  47684525bfdf26f49fd1cf742b17c015

                                                                  SHA1

                                                                  c4ab14ba22420ff9acadfc698a38d0cd99e9fbfa

                                                                  SHA256

                                                                  b7ce294613dd2c237a4a50548bfcd5c14d166107f2d2e965499bc78695300d5b

                                                                  SHA512

                                                                  948f9c519ae9afe1c821c5d58da2e584e50356dabef597ccd408853a9038560b9fb1c5894900e2725b48977ffd49d18a439436bb4946e2164ac9fcf2a8637621

                                                                • /etc/opt.services.cfg

                                                                  Filesize

                                                                  1.8MB

                                                                  MD5

                                                                  425032ac432cb4a58481c8f2fac1a298

                                                                  SHA1

                                                                  c7538b5ff5057f553bb7ae707e8fc98281e8a8bd

                                                                  SHA256

                                                                  3f5d9a1535b34fa397a15162abca45f8cefc97fbab8bf52116e550b646879a7b

                                                                  SHA512

                                                                  db5631b8499f3be061e40166b4cac9a934a22c5d726a88d6fd63c9633f435de956b740addaa5accf769a09f3cfc5f8c0b34cca1dca24439986bd78ef39f2da76

                                                                • /etc/profile.d/gateway.sh

                                                                  Filesize

                                                                  1KB

                                                                  MD5

                                                                  90d8461db20ae89d4b793b9390d5857e

                                                                  SHA1

                                                                  413acbb9e503ad08926279286acc9e900ae8283b

                                                                  SHA256

                                                                  8b6f6c562be44b1cc9d6328020d0bac0df834d89e3742ea23cba8dd0e96972ab

                                                                  SHA512

                                                                  6382d71a041b7b698d75aa9c9ae499cc44b8ffbd09f864df1c1e04cb7e3998c4d2f677cc285235908e66f38e30b43687516a3d4f7e85c1140cbce3eeb4807f06

                                                                • /usr/bin/include/find

                                                                  Filesize

                                                                  232KB

                                                                  MD5

                                                                  f11b2b59639b1edcb46026472786c747

                                                                  SHA1

                                                                  a6fe59e11456bc7f19e28b38aa9c1f9c1a13b70d

                                                                  SHA256

                                                                  189fbf2416c8205430d8eaa85e2947bc15504ca335ad4a77ec668ff3cbf9c84a

                                                                  SHA512

                                                                  1967f43b4b274e2afbc30e8e1bad314085e488066b22233e6ec033dbae10ae111320296b9d429e94cb3079636a37e433aeac928b4ef23a56dedae1741815416b

                                                                • /usr/bin/include/lsof

                                                                  Filesize

                                                                  159KB

                                                                  MD5

                                                                  e093dc78225e2a0a25e3b137c1c1e442

                                                                  SHA1

                                                                  c29497cfaae729eb576875e4fdfa400640ab16be

                                                                  SHA256

                                                                  1190f4dbc7be174de8fd4096c9bf7a28eebfac937d308b7cc533be4a1240d26e

                                                                  SHA512

                                                                  fe1cc7a65327732eaaee89f427c10239ba822430e34177842f4681068d78d404b1830d808a2a71b1efcc5f126c6d8c053512237421173aaa150e215a672da6f0