Extracted

• • Target
    9066394b24a05f71b1908c6761ea0a37e91a4cb9ab1f718e7ed06f2ff72e79cb.elf
  • Size 5.1MB
  • SHA256 9066394b24a05f71b1908c6761ea0a37e91a4cb9ab1f718e7ed06f2ff72e79cb
  • MD5 eaf55c11dd7e17b897ed38a90fc72903
  • SHA1 ead1fae474cd69ace9ec8d6d66cb276e4cfb1880
  • SHA512 5a362c92fbae54eebfcb0687f3d44cda90002a9901ed898f9847ea025d9e562fed7df525672ca0c6a25d53aa723e5b068fb904cf235b16b9972ad765597242ca
  • SSDEEP 49152:8mTtqFdLBZsYQ8rb/T0vO90d7HjmAFd4A64nsfJWpltZ4GhhAl6e9d1SVq82T8xu:Qobp+GhSXAEo
  • MD5 SHA1 SHA512 SSDEEP

  Score

  9^/10

  defense_evasiondiscoveryexecutioninfostealerpersistenceprivilege_escalatioprivilege_escalationransomware

  • Renames multiple (1156) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Reads EFI boot settings

    Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.

    infostealer

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalatio

  • Creates/modifies environment variables

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion

  • Disables SELinux

    Disables SELinux security module.

    defense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Modifies systemd

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation

  • Write file to user bin folder

    persistence

  • Modifies Bash startup script

    persistence
  behavioral1