• After establishing an SSH connection, it executes a bash script to set up the environment for the malware.
• Then a /usr/bin/lib directory is created. 
• And the malware is installed under the filename ‘netstat’, ‘ps’, ‘ls’, or some other system tool name. 
• Once executed, Kaiji gets copied to /tmp/seeintlog and launches a second instance that initiates its operations. The implants’ operations consist of 13 central goroutines.
• The doLink routine, decrypts the C2 address and registers the infected server with a command server. 
• It then launches the doTask and RotKit goroutines.
• The main_doTask routine fetches commands from the C2, including:
  • DDoS instructions
  • SSH bruteforce instructions, including host range and a password to attempt login
  • Run shell command
  • Replace C2 servers
  • Delete itself and remove all persistence
• To carry out a DDoS attack, it retrieves an attack technique and a target, including:
  • Two TCPFlood implementations (one with raw sockets)
  • Two UDPFlood implementations (one with raw sockets)
  • IPSpoof attack
  • SYNACK attack
  • SYN attack
  • ACK attack
• The ddos_Rotkit routine tries to connect to known hosts via SSH RSA keys or IPs found in bash history.

The malware installs persistence through rc.d and Systemd services:

• main_runghost: Installs persistence through /etc/profile.d (/etc/profile.d/linux.sh)
• main_rundingshi: Installs persistence through crontab
• main_runganran: Backdoor for the SSH init script /etc/init.d/ssh to call the rootkit on startup
• main_runshouhu: Copies the rootkit to /etc/32679, and runs it every 30 seconds.
• main_runkaiji: Installs more persistence init.d files, e.g.: /etc/init.d/boot.local
• ddos_rdemokill: Periodically checks the CPU and kills it if it is > 85%.