General

  • Target

    linux_arm7.elf

  • Size

    5.1MB

  • Sample

    250419-xg1gdas1at

  • MD5

    5dc8e25035f2749d4bd8dc919467486d

  • SHA1

    788a15790150958551beb6001eaaf401db7efd47

  • SHA256

    e9f39d6ba4d56c27baa6a7206d097874c0cbb996b495745a7b4358c202b16c53

  • SHA512

    7108353b66bbca7f7168cc61abdcef6db9de6d387312fc9607bce8ef75190347eb381f36cd35c3083fce428b91f9a5221037aa279def52abbb39cc19b1ce5d26

  • SSDEEP

    49152:f9MwAobUPMcOxhkpKLTk8TBGo0eZYKwrJmpBK+U1F1:VMwAoeixh+KLLTF

Malware Config

Extracted

Family

kaiji

C2

2.59.151.111:8080

Targets

    • Target

      linux_arm7.elf

    • Size

      5.1MB

    • MD5

      5dc8e25035f2749d4bd8dc919467486d

    • SHA1

      788a15790150958551beb6001eaaf401db7efd47

    • SHA256

      e9f39d6ba4d56c27baa6a7206d097874c0cbb996b495745a7b4358c202b16c53

    • SHA512

      7108353b66bbca7f7168cc61abdcef6db9de6d387312fc9607bce8ef75190347eb381f36cd35c3083fce428b91f9a5221037aa279def52abbb39cc19b1ce5d26

    • SSDEEP

      49152:f9MwAobUPMcOxhkpKLTk8TBGo0eZYKwrJmpBK+U1F1:VMwAoeixh+KLLTF

    • Renames multiple (1004) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Executes dropped EXE

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    • Creates/modifies environment variables

      Creating/modifying environment variables is a common persistence mechanism.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Modifies init.d

      Adds/modifies system service, likely for persistence.

    • Modifies systemd

      Adds/ modifies systemd service files. Likely to achieve persistence.

    • Write file to user bin folder

    • Modifies Bash startup script

MITRE ATT&CK Enterprise v16

Tasks