Extracted

• • Target
    1dbbef4edc96ac1ff39061b49f51716200100d76cc3df7337ad5b876e07d2d30.elf
  • Size 1.9MB
  • SHA256 1dbbef4edc96ac1ff39061b49f51716200100d76cc3df7337ad5b876e07d2d30
  • MD5 e12307995ed9ce4239ae49577fa5c922
  • SHA1 00d37e7b3f08de5ac7c95998df1d232800b0e803
  • SHA512 76adebff1332feb14fb3fcb8fd34a62161f695c42080c84eddf1c68dab33ccb195d3c14a229a5beaa9ed05f64941e2975c0fb173a7115c50840f34e926b9c85d
  • SSDEEP 49152:PTcFMvG6RMCg9orb/T9vO90d7HjmAFd4A64nsfJcFaJysrWftB+g2vUqHY/Wz1:wKbocwr
  • MD5 SHA1 SHA512 SSDEEP

  Score

  9^/10

  infostealerpersistenceransomware

  • Renames multiple (1156) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Reads EFI boot settings

    Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.

    infostealer

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Creates/modifies environment variables

    Creating/modifying environment variables is a common persistence mechanism.

    persistence

  • Disables SELinux

    Disables SELinux security module.

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Modifies systemd

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistence

  • Write file to user bin folder

  • Modifies Bash startup script

    persistence
  behavioral1