Overview

overview

10

Static

static

1

20e0e61d27...e7.elf

ubuntu-24.04-amd64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    20e0e61d27762a524f6974fb9f4995062582db351d5576e62a214d6b5e5808e7.elf
  • Size 1.7MB
  • Sample241104-rlpyjstmcm
  • SHA256 20e0e61d27762a524f6974fb9f4995062582db351d5576e62a214d6b5e5808e7
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
antivmdiscoverylinuxpersistenceprivilege_escalationransomware

Malware Config

Extracted

Path

  • /run/initramfs/RECOVERY INFO.txt

Ransom Note
  • Your data has been encrypted In order to return your files back you need decryption tool 1)Download TOR Browser 2)Open in TOR browser link below and contact with us there: http://weaxorpemwzoxg5cdvvfd77p3qczkxqii37ww4foo2n4jcft3mytbpyd.onion/lsaHqOhaJLOyrWSPvtJajdzqrftqzOlt/41E14831C73CC6D90534CB1A998382F5FE24BE48BD721F762688784C83A58861 Or email: [email protected] Limit for free decryption: 3 files up to 5mb (no database or backups)
URLs

  • http://weaxorpemwzoxg5cdvvfd77p3qczkxqii37ww4foo2n4jcft3mytbpyd.onion/lsaHqOhaJLOyrWSPvtJajdzqrftqzOlt/41E14831C73CC6D90534CB1A998382F5FE24BE48BD721F762688784C83A58861

Targets

    • Target
      20e0e61d27762a524f6974fb9f4995062582db351d5576e62a214d6b5e5808e7.elf
    • Size 1.7MB
    • SHA256 20e0e61d27762a524f6974fb9f4995062582db351d5576e62a214d6b5e5808e7
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    antivmdiscoverypersistenceprivilege_escalationransomware

    • Renames multiple (322) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Modifies systemd

      Adds/ modifies systemd service files. Likely to achieve persistence.

      persistenceprivilege_escalation
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks