Linux Analysis Report
linux_aarch64.elf

Overview

General Information

Sample name: linux_aarch64.elf
Analysis ID: 1562743
MD5: b64c72dccf36a9775850933de2e1b852
SHA1: 9196a018e1ee50a59256a69408b7b82dd41d4a27
SHA256: 6acdf01289672bbd8dc5e28d30b8bcf49d4a2e9f4633c8d6379005df3f154dea
Tags: elfuser-abuse_ch
Infos:

Detection

Kaiji
Score: 80
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Kaiji
Drops files in suspicious directories
Sample tries to persist itself using /etc/profile
Sample tries to persist itself using cron
Sample tries to set files in /etc globally writable
Creates hidden files and/or directories
Creates hidden files without content (potentially used as a mutex)
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
Executes the "sleep" command used to delay execution and potentially evade sandboxes
Executes the "systemctl" command used for controlling the systemd system and service manager
Reads the 'hosts' file potentially containing internal network hosts
Sample has stripped symbol table
Sample tries to set the executable flag
Sleeps for long times indicative of sandbox evasion
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)
Writes shell script file to disk with an unusual file extension
Writes shell script files to disk

Classification

Name Description Attribution Blogpost URLs Link
Kaiji Surfaced in late April 2020, Intezer describes Kaiji as a DDoS malware written in Go that spreads through SSH brute force attacks. Recovered function names are an English representation of Chinese words, hinting about the origin. The name Kaiji was given by MalwareMustDie based on strings found in samples. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.kaiji

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: linux_aarch64.elf ReversingLabs: Detection: 23%

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2044667 - Severity 1 - ET MALWARE Golang/Linux Kaiji Variant Activity : 192.168.2.23:34026 -> 103.135.101.188:1930
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:34026 -> 103.135.101.188:1930
Reads the 'hosts' file potentially containing internal network hosts
Source: /tmp/linux_aarch64.elf (PID: 6279) Reads hosts file: /etc/hosts Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: wdearas.liveya.org
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal80.spre.troj.evad.linELF@0/58@4/0
Source: ELF file section Submission: linux_aarch64.elf

Persistence and Installation Behavior
barindex
Sample tries to persist itself using /etc/profile
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/profile.d/bash_cfg.sh Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/profile.d/gateway.sh Jump to behavior
Sample tries to persist itself using cron
Source: /bin/bash (PID: 6346) File: /etc/crontab Jump to behavior
Sample tries to set files in /etc globally writable
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/opt.services.cfg (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/32676 (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/profile.d/bash_cfg (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Creates hidden files and/or directories
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/.walk Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /dev/.walk.lod Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/.walk Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /dev/.old Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /dev/.img Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /.mod Jump to behavior
Source: /.mod (PID: 6409) Directory: /.mod Jump to behavior
Source: /.mod (PID: 6475) Directory: /.mod Jump to behavior
Creates hidden files without content (potentially used as a mutex)
Source: /tmp/linux_aarch64.elf (PID: 6279) Empty hidden file: /dev/.old Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) Empty hidden file: /dev/.walk.lod Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) Empty hidden file: /dev/.img Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/1582/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/3088/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/230/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/110/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/231/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/111/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/232/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/1579/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/112/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/233/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/1699/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/113/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/234/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/1335/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/1698/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/114/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/235/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/1334/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/1576/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/2302/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/115/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/236/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/116/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/237/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/117/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/118/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/910/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/119/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/912/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/6229/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/6107/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/10/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/2307/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/11/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/918/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/12/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/13/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/14/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/15/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/16/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/17/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/18/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/1594/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/120/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/121/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/1349/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/1/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/122/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/243/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/123/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/2/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/124/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/3/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/4/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/125/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/126/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/1344/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/1465/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/1586/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/127/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/6/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/248/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/128/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/249/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/1463/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/800/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/9/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/801/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/5822/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/20/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/21/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/1900/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/22/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/23/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/24/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/25/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/26/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/27/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/28/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/6258/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/29/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/6257/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/491/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/250/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/130/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/251/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/252/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/132/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/253/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/254/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/4508/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/255/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/256/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/1599/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/257/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/1477/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/379/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/258/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/1476/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/259/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/1475/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/936/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/30/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/2208/stat Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File opened: /proc/35/stat Jump to behavior
Executes commands using a shell command-line interpreter
Source: /tmp/linux_aarch64.elf (PID: 6295) Shell command executed: /bin/bash -c /etc/32676& Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6310) Shell command executed: /bin/bash -c "cd /boot;systemctl daemon-reload;systemctl enable quotaoff.service;systemctl start quotaoff.service;journalctl -xe --no-pager" Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6341) Shell command executed: /bin/bash -c "cd /boot;ausearch -c 'System.mod' --raw | audit2allow -M my-Systemmod;semodule -X 300 -i my-Systemmod.pp" Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6346) Shell command executed: /bin/bash -c "echo \"*/1 * * * * root /.mod \" >> /etc/crontab" Jump to behavior
Source: /usr/sbin/cron (PID: 6408) Shell command executed: /bin/sh -c "/.mod " Jump to behavior
Source: /usr/sbin/cron (PID: 6474) Shell command executed: /bin/sh -c "/.mod " Jump to behavior
Executes the "systemctl" command used for controlling the systemd system and service manager
Source: /usr/sbin/service (PID: 6301) Systemctl executable: /usr/bin/systemctl -> systemctl start crond.service Jump to behavior
Source: /usr/sbin/service (PID: 6306) Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-active multi-user.target Jump to behavior
Source: /usr/sbin/service (PID: 6308) Systemctl executable: /usr/bin/systemctl -> systemctl list-unit-files --full --type=socket Jump to behavior
Source: /bin/bash (PID: 6312) Systemctl executable: /usr/bin/systemctl -> systemctl daemon-reload Jump to behavior
Source: /bin/bash (PID: 6326) Systemctl executable: /usr/bin/systemctl -> systemctl enable quotaoff.service Jump to behavior
Source: /bin/bash (PID: 6330) Systemctl executable: /usr/bin/systemctl -> systemctl start quotaoff.service Jump to behavior
Source: /usr/sbin/service (PID: 6376) Systemctl executable: /usr/bin/systemctl -> systemctl start cron.service Jump to behavior
Source: /usr/sbin/service (PID: 6380) Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-active multi-user.target Jump to behavior
Source: /usr/sbin/service (PID: 6397) Systemctl executable: /usr/bin/systemctl -> systemctl list-unit-files --full --type=socket Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6402) Systemctl executable: /usr/bin/systemctl -> systemctl start crond.service Jump to behavior
Sample tries to set the executable flag
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/opt.services.cfg (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/32676 (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /boot/System.mod (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/profile.d/bash_cfg (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /usr/lib/libgdi.so.0.8.1 (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /usr/lib/system-mark (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /usr/bin/include/ps (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /usr/bin/include/ss (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /usr/bin/include/ls (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /usr/bin/include/dir (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /usr/bin/include/netstat (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /usr/bin/include/find (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /usr/bin/include/lsof (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /usr/bin/ps (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /usr/bin/ss (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /usr/bin/ls (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /usr/bin/dir (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /usr/bin/netstat (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /usr/bin/find (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /usr/bin/lsof (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Writes shell script file to disk with an unusual file extension
Source: /tmp/linux_aarch64.elf (PID: 6279) Writes shell script file to disk with an unusual file extension: /etc/32676 Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) Writes shell script file to disk with an unusual file extension: /.mod Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) Writes shell script file to disk with an unusual file extension: /etc/init.d/acpid Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) Writes shell script file to disk with an unusual file extension: /etc/init.d/alsa-utils Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) Writes shell script file to disk with an unusual file extension: /etc/init.d/anacron Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) Writes shell script file to disk with an unusual file extension: /etc/init.d/apparmor Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) Writes shell script file to disk with an unusual file extension: /etc/init.d/apport Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) Writes shell script file to disk with an unusual file extension: /etc/init.d/avahi-daemon Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) Writes shell script file to disk with an unusual file extension: /etc/init.d/binfmt-support Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) Writes shell script file to disk with an unusual file extension: /etc/init.d/bluetooth Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) Writes shell script file to disk with an unusual file extension: /etc/init.d/cron Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) Writes shell script file to disk with an unusual file extension: /etc/init.d/cryptdisks Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) Writes shell script file to disk with an unusual file extension: /etc/init.d/cryptdisks-early Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) Writes shell script file to disk with an unusual file extension: /etc/init.d/cups Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) Writes shell script file to disk with an unusual file extension: /etc/init.d/cups-browsed Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) Writes shell script file to disk with an unusual file extension: /etc/init.d/dbus Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) Writes shell script file to disk with an unusual file extension: /etc/init.d/gdm3 Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) Writes shell script file to disk with an unusual file extension: /etc/init.d/hddtemp Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) Writes shell script file to disk with an unusual file extension: /etc/init.d/irqbalance Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) Writes shell script file to disk with an unusual file extension: /etc/init.d/iscsid Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) Writes shell script file to disk with an unusual file extension: /etc/init.d/kmod Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) Writes shell script file to disk with an unusual file extension: /etc/init.d/lightdm Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) Writes shell script file to disk with an unusual file extension: /etc/init.d/lm-sensors Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) Writes shell script file to disk with an unusual file extension: /etc/init.d/lvm2-lvmpolld Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) Writes shell script file to disk with an unusual file extension: /etc/init.d/mono-xsp4 Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) Writes shell script file to disk with an unusual file extension: /etc/init.d/multipath-tools Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) Writes shell script file to disk with an unusual file extension: /etc/init.d/open-iscsi Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) Writes shell script file to disk with an unusual file extension: /etc/init.d/open-vm-tools Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) Writes shell script file to disk with an unusual file extension: /etc/init.d/plymouth Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) Writes shell script file to disk with an unusual file extension: /etc/init.d/plymouth-log Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) Writes shell script file to disk with an unusual file extension: /etc/init.d/procps Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) Writes shell script file to disk with an unusual file extension: /etc/init.d/rsync Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) Writes shell script file to disk with an unusual file extension: /etc/init.d/rsyslog Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) Writes shell script file to disk with an unusual file extension: /etc/init.d/saned Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) Writes shell script file to disk with an unusual file extension: /etc/init.d/screen-cleanup Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) Writes shell script file to disk with an unusual file extension: /etc/init.d/spice-vdagent Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) Writes shell script file to disk with an unusual file extension: /etc/init.d/ssh Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) Writes shell script file to disk with an unusual file extension: /etc/init.d/udev Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) Writes shell script file to disk with an unusual file extension: /etc/init.d/ufw Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) Writes shell script file to disk with an unusual file extension: /etc/init.d/unattended-upgrades Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) Writes shell script file to disk with an unusual file extension: /etc/init.d/uuidd Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) Writes shell script file to disk with an unusual file extension: /etc/init.d/x11-common Jump to dropped file
Writes shell script files to disk
Source: /tmp/linux_aarch64.elf (PID: 6279) Shell script file created: /etc/profile.d/bash_cfg.sh Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) Shell script file created: /etc/init.d/console-setup.sh Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) Shell script file created: /etc/init.d/hwclock.sh Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) Shell script file created: /etc/init.d/keyboard-setup.sh Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) Shell script file created: /etc/profile.d/gateway.sh Jump to dropped file
Source: /usr/sbin/service (PID: 6309) Sed executable: /usr/bin/sed -> sed -ne s/\\.socket\\s*[a-z]*\\s*$/.socket/p Jump to behavior
Source: /usr/sbin/service (PID: 6398) Sed executable: /usr/bin/sed -> sed -ne s/\\.socket\\s*[a-z]*\\s*$/.socket/p Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Drops files in suspicious directories
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/init.d/acpid Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/init.d/alsa-utils Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/init.d/anacron Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/init.d/apparmor Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/init.d/apport Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/init.d/avahi-daemon Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/init.d/binfmt-support Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/init.d/bluetooth Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/init.d/console-setup.sh Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/init.d/cron Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/init.d/cryptdisks Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/init.d/cryptdisks-early Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/init.d/cups Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/init.d/cups-browsed Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/init.d/dbus Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/init.d/gdm3 Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/init.d/hddtemp Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/init.d/hwclock.sh Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/init.d/irqbalance Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/init.d/iscsid Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/init.d/keyboard-setup.sh Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/init.d/kmod Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/init.d/lightdm Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/init.d/lm-sensors Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/init.d/lvm2-lvmpolld Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/init.d/mono-xsp4 Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/init.d/multipath-tools Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/init.d/open-iscsi Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/init.d/open-vm-tools Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/init.d/plymouth Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/init.d/plymouth-log Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/init.d/procps Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/init.d/rsync Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/init.d/rsyslog Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/init.d/saned Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/init.d/screen-cleanup Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/init.d/spice-vdagent Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/init.d/ssh Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/init.d/udev Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/init.d/ufw Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/init.d/unattended-upgrades Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/init.d/uuidd Jump to dropped file
Source: /tmp/linux_aarch64.elf (PID: 6279) File: /etc/init.d/x11-common Jump to dropped file
Executes the "sleep" command used to delay execution and potentially evade sandboxes
Source: /etc/32676 (PID: 6304) Sleep executable: /usr/bin/sleep -> sleep 60 Jump to behavior
Source: /etc/32676 (PID: 6460) Sleep executable: /usr/bin/sleep -> sleep 60 Jump to behavior
Source: /etc/32676 (PID: 6522) Sleep executable: /usr/bin/sleep -> sleep 60 Jump to behavior
Sleeps for long times indicative of sandbox evasion
Source: /usr/bin/sleep (PID: 6304) Sleeps longer then 60s: 60.0s Jump to behavior
Source: /usr/bin/sleep (PID: 6460) Sleeps longer then 60s: 60.0s Jump to behavior
Source: /usr/bin/sleep (PID: 6522) Sleeps longer then 60s: 60.0s Jump to behavior
Source: /usr/sbin/cron (PID: 6401) Sleeps longer then 60s: 60.0s Jump to behavior
Source: /usr/sbin/cron (PID: 6417) Sleeps longer then 60s: 60.0s Jump to behavior
Source: /usr/sbin/cron (PID: 6417) Sleeps longer then 60s: 60.0s Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/linux_aarch64.elf (PID: 6274) Queries kernel information via 'uname': Jump to behavior
Source: /tmp/linux_aarch64.elf (PID: 6279) Queries kernel information via 'uname': Jump to behavior
Source: /bin/bash (PID: 6295) Queries kernel information via 'uname': Jump to behavior
Source: /etc/32676 (PID: 6300) Queries kernel information via 'uname': Jump to behavior
Source: /bin/bash (PID: 6310) Queries kernel information via 'uname': Jump to behavior
Source: /bin/bash (PID: 6341) Queries kernel information via 'uname': Jump to behavior
Source: /bin/bash (PID: 6346) Queries kernel information via 'uname': Jump to behavior
Source: /.mod (PID: 6409) Queries kernel information via 'uname': Jump to behavior
Source: /.mod (PID: 6475) Queries kernel information via 'uname': Jump to behavior
Source: open-vm-tools.14.dr Binary or memory string: # Check if we're running inside VMWare
Source: open-vm-tools.14.dr Binary or memory string: start-stop-daemon --start --quiet --pidfile /var/run/vmtoolsd.pid --exec /usr/bin/vmtoolsd --test > /dev/null || exit 1
Source: linux_aarch64.elf, 6274.1.00005604bbe3a000.00005604bc301000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/aarch64
Source: open-vm-tools.14.dr Binary or memory string: if ! ${checktool} | grep -iq vmware; then
Source: open-vm-tools.14.dr Binary or memory string: rm -f /var/run/vmtoolsd.pid
Source: linux_aarch64.elf, 6274.1.00007ffcddf4c000.00007ffcddf6d000.rw-.sdmp Binary or memory string: )x86_64/usr/bin/qemu-aarch64/tmp/linux_aarch64.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/linux_aarch64.elf
Source: linux_aarch64.elf, 6274.1.00005604bbe3a000.00005604bc301000.rw-.sdmp Binary or memory string: Vrg.qemu.gdb.arm.sys.regs">
Source: open-vm-tools.14.dr Binary or memory string: checktool='vmware-checkvm'
Source: open-vm-tools.14.dr Binary or memory string: start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile /var/run/vmtoolsd.pid --exec /usr/bin/vmtoolsd
Source: open-vm-tools.14.dr Binary or memory string: log_daemon_msg "Stopping open-vm guest daemon" "vmtoolsd"
Source: open-vm-tools.14.dr Binary or memory string: echo "open-vm-tools: not starting as this is not a VMware VM"
Source: open-vm-tools.14.dr Binary or memory string: start-stop-daemon --start --quiet --pidfile /var/run/vmtoolsd.pid --exec /usr/bin/vmtoolsd -- --background /var/run/vmtoolsd.pid || exit 2
Source: open-vm-tools.14.dr Binary or memory string: log_daemon_msg "Starting open-vm daemon" "vmtoolsd"
Source: linux_aarch64.elf, 6274.1.00005604bbe3a000.00005604bc301000.rw-.sdmp Binary or memory string: rg.qemu.gdb.arm.sys.regs">
Source: open-vm-tools.14.dr Binary or memory string: status_of_proc -p /var/run/vmtoolsd.pid /usr/bin/vmtoolsd vmtoolsd && exit 0 || exit $?
Source: linux_aarch64.elf, 6274.1.00005604bbe3a000.00005604bc301000.rw-.sdmp Binary or memory string: V1/etc/qemu-binfmt/aarch64O
Source: linux_aarch64.elf, 6274.1.00007ffcddf4c000.00007ffcddf6d000.rw-.sdmp Binary or memory string: /usr/bin/qemu-aarch64

Stealing of Sensitive Information
barindex
Yara detected Kaiji
Source: Yara match File source: linux_aarch64.elf, type: SAMPLE

Remote Access Functionality
barindex
Yara detected Kaiji
Source: Yara match File source: linux_aarch64.elf, type: SAMPLE

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
103.135.101.188
 wdearas.liveya.org Hong Kong
4842 TH-AS-APTianhaiInfoTechCN true
109.202.202.202
 unknown Switzerland
13030 INIT7CH false
91.189.91.43
 unknown United Kingdom
41231 CANONICAL-ASGB false
91.189.91.42
 unknown United Kingdom
41231 CANONICAL-ASGB false

Contacted Domains

Name IP Active
wdearas.liveya.org 103.135.101.188 true
www.google.com 172.217.21.36 true