Extracted

• • Target

    ae49891720a4fa75f48a58efd4fc5dcd369f8c99add24e781191616f46149457.elf

  • Size

    5.0MB

  • MD5

    f5c59e70b89c03eb69f02a7be662ed59

  • SHA1

    f1dc3d2d6c85692a2419517d3473bb370cf86510

  • SHA256

    ae49891720a4fa75f48a58efd4fc5dcd369f8c99add24e781191616f46149457

  • SHA512

    69a1fcdc968d5b2f2706a0c6294974d2cc211910033e8bd991ec9dad01eacf93b20dfb3c72f17130b29b53a8b1add45f04a6c1c7e1f81ff9f198184493354225

  • SSDEEP

    49152:E33d0lGt6UHcFL7Rn2o03wiEhiDmzzd/9sARlBs/00Cpfx9a9uNFp9hW16klbU6V:E33GlbU8FwmzzRDZ9mWqRV

  Score

  9^/10

  defense_evasiondiscoveryexecutioninfostealerpersistenceprivilege_escalatioprivilege_escalationransomware

  • Renames multiple (1156) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Reads EFI boot settings

    Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.

    infostealer

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalatio

  • Creates/modifies environment variables

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Modifies systemd

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation

  • Write file to user bin folder

    persistence

  • Modifies Bash startup script

    persistence
  behavioral1