MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c2c5bb4bfbfa9913ab3faf9711f9d06dba46872071971ee4adc79c8cde1647fa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Kaiji

Vendor detections: 7

Intelligence 7 IOCs YARA 21 File information Comments

SHA256 hash:	c2c5bb4bfbfa9913ab3faf9711f9d06dba46872071971ee4adc79c8cde1647fa
SHA3-384 hash:	8352d2a1c1eb0f4502496d86578ab5bcd021e41ee234e116351041a47e4b2c8b26e91e86842597d5f08f3ea41c71c243
SHA1 hash:	416bc8dee5fd35390b991e3fb3f84740adc4e3ef
MD5 hash:	8e11a9b9365974a7e578c6b2c9067d77
humanhash:	london-wolfram-five-avocado
File name:	linux_mips64el
Download:	download sample
Signature	Kaiji Create hunting rule
File size:	5'963'776 bytes
First seen:	2026-02-01 20:23:37 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	98304:Z9mVusEEQ4kVIb0IamIIkmrIGDeII8jOSPso:bu8VIb0IamIIkmrIGDeII8Hso
TLSH	T1C9560902EEC26E66C5CC037485FE979672507E085B951B2313A8EBA8397773DEF4684C
gimphash	1b609c56b0ebb36513f3d917b8726549e1688926cc8c06385102e07caffa3d74
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf kaiji

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Gathering data

Detection(s):

Sanesecurity.Malware.30444.LC.UNOFFICIAL

Unix.Trojan.Kaiji-9975495-0

Unix.Malware.Kaiji-10002376-0

Unix.Malware.Kaiji-10003612-0

Unix.Malware.Kaiji-10003670-0

Unix.Malware.Kaiji-10025522-0

Unix.Malware.Kaiji-10028086-0

Unix.Malware.Kaiji-10028719-0

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

mips

Packer:

not packed

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/c2c5bb4bfbfa9913ab3faf9711f9d06dba46872071971ee4adc79c8cde1647fa

Behaviour

no suspicious findings

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Result

Gathering data

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/ed72d92d-3672-4a78-86a0-900e4c8be7c6

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/e963fcad-ebd1-4755-af44-a4986d47fc2a

Result

Threat name:

Chaos

Detection:

malicious

Classification:

troj

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/1861291

Signature

Multi AV Scanner detection for submitted file

Yara detected Chaos

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/c2c5bb4bfbfa9913ab3faf9711f9d06dba46872071971ee4adc79c8cde1647fa

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c2c5bb4bfbfa9913ab3faf9711f9d06dba46872071971ee4adc79c8cde1647fa/

Threat name:

Linux.Trojan.Multiverze

Status:

Malicious

First seen:

2026-02-01 20:25:51 UTC

File Type:

ELF64 Little (Exe)

AV detection:

19 of 36 (52.78%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ylc3ws737kmrhkz7v6lrd6oqnw5enbzaoglr5zfny6oizxqwi75a._file

Result

Malware family:

kaiji

Score:

10/10

Tags:

family:kaiji discovery

Link:

https://tria.ge/reports/260201-y65case17g/

Behaviour

System Network Configuration Discovery

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.30

Link:

https://yomi.yoroi.company/submissions/c2c5bb4bfbfa9913ab3faf9711f9d06dba46872071971ee4adc79c8cde1647fa

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	DetectGoMethodSignatures Create hunting rule
Author:	Wyatt Tauber
Description:	Detects Go method signatures in unpacked Go binaries

Rule name:	Detect_Go_GOMAXPROCS Create hunting rule
Author:	Obscurity Labs LLC
Description:	Detects Go binaries by the presence of runtime.GOMAXPROCS in the runtime metadata

Rule name:	enterpriseapps2 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Enterprise apps

Rule name:	enterpriseunix2 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Enterprise UNIX

Rule name:	F01_s1ckrule Create hunting rule
Author:	s1ckb017

Rule name:	GoBinTest Create hunting rule

Rule name:	golang Create hunting rule

Rule name:	golang_binary_string Create hunting rule
Description:	Golang strings present

Rule name:	Golang_Find_CSC846 Create hunting rule
Author:	Ashar Siddiqui
Description:	Find Go Signatuers

Rule name:	Golang_Find_CSC846_Simple Create hunting rule
Author:	Ashar Siddiqui
Description:	Find Go Signatuers

Rule name:	identity_golang Create hunting rule
Author:	Eric Yocam
Description:	find Golang malware

Rule name:	Linux_Generic_Threat_a40aaa96 Create hunting rule
Author:	Elastic Security

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	ProgramLanguage_Golang Create hunting rule
Author:	albertzsigovits
Description:	Application written in Golang programming language

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	setsockopt Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for setsockopt() red flags

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants

Rule name:	Suspicious_Golang_Binary Create hunting rule
Author:	Tim Machac
Description:	Triage: Golang-compiled binary with suspicious OS/persistence/network strings (not family-specific)