General

  • Target

    linux_arm5.elf

  • Size

    5.1MB

  • Sample

    250419-xnrg2ss1gv

  • MD5

    6eefbf9dab443f26ccd8e5a958e4ecb4

  • SHA1

    e0b6efa1abb220fb7dfa353bd8b411bd92ef333e

  • SHA256

    8e12863b69f7521d07ac77ce40f5515ecd8645cb6ad16a3c14e36ca6bbc90be5

  • SHA512

    9d380f1bc839141f302834828716f41cc8f6510df4fedcf13411868a2c0a8d539d4f91852d8ffc88d220085be4c682a7db06bbb83d1120f625904243077c5c5a

  • SSDEEP

    49152:fRUSs+02w+ta7vySpuJhHmGqkC72Jps+KYfRPVxU1F1:5UST1wQa7aYuf8WV

Malware Config

Extracted

Family

kaiji

C2

2.59.151.111:8080

Targets

    • Target

      linux_arm5.elf

    • Size

      5.1MB

    • MD5

      6eefbf9dab443f26ccd8e5a958e4ecb4

    • SHA1

      e0b6efa1abb220fb7dfa353bd8b411bd92ef333e

    • SHA256

      8e12863b69f7521d07ac77ce40f5515ecd8645cb6ad16a3c14e36ca6bbc90be5

    • SHA512

      9d380f1bc839141f302834828716f41cc8f6510df4fedcf13411868a2c0a8d539d4f91852d8ffc88d220085be4c682a7db06bbb83d1120f625904243077c5c5a

    • SSDEEP

      49152:fRUSs+02w+ta7vySpuJhHmGqkC72Jps+KYfRPVxU1F1:5UST1wQa7aYuf8WV

    • Renames multiple (1004) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Executes dropped EXE

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    • Creates/modifies environment variables

      Creating/modifying environment variables is a common persistence mechanism.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Modifies init.d

      Adds/modifies system service, likely for persistence.

    • Modifies systemd

      Adds/ modifies systemd service files. Likely to achieve persistence.

    • Write file to user bin folder

    • Modifies Bash startup script

MITRE ATT&CK Enterprise v16

Tasks