Extracted

Extracted

• • Target
    1.sh
  • Size 5KB
  • SHA256 d751e9f3b56f8780a9c9fe089103c5520b1d398ca5f958964be2693cde596437
  • MD5 301ecb74b9c87e3280f5c4c6f38824b4
  • SHA1 bb7d8c20217e27c8749b224074fd7a4499b30471
  • SHA512 a3175a2b661ba1079941c1bf09834526bcd00d00648c9af23fea5048b5aa5c963b0a6e094180db99ec75c72575d886b4bac521fa6c6dd723a860af1d87b666e5
  • SSDEEP 96:U2sQC73wC734/jtxIAEzgsC/ofpC73gTA0zC/Jtg5/JGq:w
  • TLSH
    T163B182CA0D47D4B2929A9E2662E451ABCC8421D3D9E51505F7CCBF330B78BA4F721ED0
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetdefense_evasiondiscoveryexecutionkaijipersistenceprivilege_escalation

  • Family: Kaiji

    Kaiji is a multi-functional malware written Golang.

    botnetkaiji

  • Kaiji

    Kaiji payload

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Creates/modifies environment variables

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Write file to user bin folder

    persistence

  • Modifies Bash startup script

    persistence
  behavioral1behavioral2behavioral3behavioral4