ech0raix | dd7d268298c694c2222d089856e710caa42454c27bdc00b6495b1c502e8a2423

General

Target
dd7d268298c694c2222d089856e710caa42454c27bdc00b6495b1c502e8a2423.elf
Size 4.1MB
Sample251230-c2klfa1kcy
SHA256 dd7d268298c694c2222d089856e710caa42454c27bdc00b6495b1c502e8a2423
MD5 587a3cb88d8f139e6263bf3a7fb88d95
SHA1 9a4a12bb28333e9c5579d2d4194bc30e3be75617
SHA512 5bb9ab4ae0a197c6da65ce2dd1cf99b706fbd48884127fe9ef9741c94ceea5f81f65612d736141b1fe7ed18cf39880df5127227f9b33336c41f75944b06bd5a0
SSDEEP 49152:ccFqYcFnwrxf6zls6pQa5ErdSHEe/TcMRrhG9XmZF1:bFqHnQxfQls6pQa5ErdSHEYG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  dd7d268298c694c2222d089856e710caa42454c27bdc00b6495b1c502e8a2423.elf
- Size 4.1MB
- SHA256 dd7d268298c694c2222d089856e710caa42454c27bdc00b6495b1c502e8a2423
- MD5 587a3cb88d8f139e6263bf3a7fb88d95
- SHA1 9a4a12bb28333e9c5579d2d4194bc30e3be75617
- SHA512 5bb9ab4ae0a197c6da65ce2dd1cf99b706fbd48884127fe9ef9741c94ceea5f81f65612d736141b1fe7ed18cf39880df5127227f9b33336c41f75944b06bd5a0
- SSDEEP 49152:ccFqYcFnwrxf6zls6pQa5ErdSHEe/TcMRrhG9XmZF1:bFqHnQxfQls6pQa5ErdSHEYG
- MD5 SHA1 SHA512 SSDEEP
Score

9^/10

defense_evasion discovery execution persistence privilege_escalation ransomware
- Renames multiple (21504) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes journal logs
  Deletes systemd journal logs. Likely to evade detection.
  defense_evasion
- Modifies Polkit authorization policy
  Modifies rule/ action files in Polkit, possibly to grant additional privileges.
- Reads AppArmor ptrace settings
  Discovery of allowed ptrace capabilities by AppArmor.
  discovery
- Creates/modifies Cron job
  Cron allows running tasks on a schedule, and is commonly used for malware persistence.
  execution persistence privilege_escalation
- Deletes log files
  Deletes log files on the system.
  defense_evasion
- Enumerates running processes
  Discovers information about currently running processes on the system
- Reads network interface configuration
  Fetches information about one or more active network interfaces.
  discovery
- Write file to user bin folder
  persistence
behavioral1