Extracted

• • Target

    linux_arm6.elf

  • Size

    5.1MB

  • MD5

    f67aa24729b37795aa19446cdbee03a2

  • SHA1

    71a70d18dd01cc86e1862f12ba72b35ee38db792

  • SHA256

    7ad9220841260a3bdb6d1dd1654e2e45bacc53ca2715852a15351f242338b687

  • SHA512

    c6cb3f269699647ce97667cb83e1bf7b369a7aa59d2421cefc5483dfef75002e6fe4a5f34c9643933ac2689eda7fef1f77b2b6cc3ab2829a7cbf03cd5c0051b2

  • SSDEEP

    98304:8cSBHdgN2a7JP97kJru8cYWPAXqNu+60:8cS03Fu+6

  Score

  9^/10

  defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomware

  • Renames multiple (1004) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Creates/modifies environment variables

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Modifies systemd

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation

  • Write file to user bin folder

    persistence

  • Modifies Bash startup script

    persistence
  behavioral1