General

  • Target

    linux_mipsel.elf

  • Size

    2.2MB

  • Sample

    250412-w7fdfszvgx

  • MD5

    ef972be05ac48b0f309c2d22cb49fe14

  • SHA1

    9dd533098e4e8bbfd211d18cdb8c4de0a0f1a752

  • SHA256

    09b94b56a9442e8198444d3b2fefbb930fb1861fd0be101ea89036448ce1549e

  • SHA512

    d75f5e9ea8f4ee1de5e4a50bfa55405c71d00e7555013a3960d22a3161942d10a746a54a78910666c40bf6e99cd528cce56107ac5b4f6ca9edb21273e489c6d7

  • SSDEEP

    24576:kO+PuaNFZRml7/I1n0FOakVXFYd+lCQYWz1v:9eN2xd+lCWz1

Malware Config

Targets

    • Target

      linux_mipsel.elf

    • Size

      2.2MB

    • MD5

      ef972be05ac48b0f309c2d22cb49fe14

    • SHA1

      9dd533098e4e8bbfd211d18cdb8c4de0a0f1a752

    • SHA256

      09b94b56a9442e8198444d3b2fefbb930fb1861fd0be101ea89036448ce1549e

    • SHA512

      d75f5e9ea8f4ee1de5e4a50bfa55405c71d00e7555013a3960d22a3161942d10a746a54a78910666c40bf6e99cd528cce56107ac5b4f6ca9edb21273e489c6d7

    • SSDEEP

      24576:kO+PuaNFZRml7/I1n0FOakVXFYd+lCQYWz1v:9eN2xd+lCWz1

    • Renames multiple (1004) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Executes dropped EXE

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    • Creates/modifies environment variables

      Creating/modifying environment variables is a common persistence mechanism.

    • Disables SELinux

      Disables SELinux security module.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Modifies init.d

      Adds/modifies system service, likely for persistence.

    • Modifies systemd

      Adds/ modifies systemd service files. Likely to achieve persistence.

    • Write file to user bin folder

    • Modifies Bash startup script

MITRE ATT&CK Enterprise v16

Tasks