Extracted

• • Target
    linux_386.elf
  • Size 1.8MB
  • SHA256 4a94ce0d72ff3442ca640c28d4c5f7abd3c40fd36abebfaf9f5cdbee6ceae24e
  • MD5 f12a2c46bd0b405ce41630433138c775
  • SHA1 0518b2b2e41ee419acec1c5b6ad3d8b5c0891b84
  • SHA512 d41e0be9cf988dab194c4d76a529c0216a20ae3d46f08ee8483528e5edd565f158d091d946b8472c59b3b8357a1d24b41a15590bff7230baf2e8711dbfe10014
  • SSDEEP 24576:ae9ufJvk4gQjMNRfktnsIXvZFyD9i+MPCIxyuzNqssZXJjGbdYVVMtIwWz1v:WYMnwRO4ssPad5Wz1
  • TLSH
    T10B951711F98B54F2E9071A3104AFA26F27319D054F34EBC7EA40BB6AFD776D20932259
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetdefense_evasiondiscoveryexecutionkaijipersistenceprivilege_escalation

  • Family: Kaiji

    Kaiji is a multi-functional malware written Golang.

    botnetkaiji

  • Kaiji

    Kaiji payload

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Creates/modifies environment variables

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Write file to user bin folder

    persistence

  • Modifies Bash startup script

    persistence
  behavioral1