Extracted

• • Target
    linux_amd64
  • Size 1.9MB
  • SHA256 a1cdb7f8862d5ff9abd16757a60f4e1bbaa18a650de89904c94aa351174e405b
  • MD5 47c855da432e4af8c70ae39334199531
  • SHA1 d15d7a603ad8ee3f2dc6bde4f439aeb56c978c1a
  • SHA512 bf73bfe9214b5980f439eb8bb069aa6dc157a2b62973c226577a5c1e97d9acefa45dc3f30fd3afd3108443fb610f218725007b88cc94a69dae85e6de5034d7a6
  • SSDEEP 49152:XXPVKrbvGOQLeS7rb/TCvO90d7HjmAFd4A64nsfJrkaani38b4B+g2vUqHOErz1:tPXZz
  • TLSH
    T1DA952847B89156A9C0AAE234CA664252B761BC991F3163D73F10B3F82F33BD45E39358
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetdefense_evasiondiscoveryexecutionkaijipersistenceprivilege_escalation

  • Family: Kaiji

    Kaiji is a multi-functional malware written Golang.

    botnetkaiji

  • Kaiji

    Kaiji payload

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Creates/modifies environment variables

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Write file to user bin folder

    persistence

  • Modifies Bash startup script

    persistence
  behavioral1