Extracted

• • Target
    nx86.elf
  • Size 152KB
  • SHA256 2bbb387226de2faa8f60eaa2988e6a9a05c6d41b191ef0f24f029b184f260677
  • MD5 0ec02e392287789c6f424831250c6be5
  • SHA1 5a2a2c89a627d25df9013c6d8e9566c51bd09a40
  • SHA512 881381929adf41ad42086a52d38d69c8a98613bcec145b5d42d7369fe188af4d03074a05047018982ba3f41a3f4021311e800bbc594aa72afcf095fb652c0299
  • SSDEEP 3072:jWI5PyDWnIhlSa9vsGJhYrBA6NWvY3yjXyHmLhE:B5PyanIhlRvvBw38COhE
  • TLSH
    T155E31781BB43DAF3E85300F011B79B314A32FC3A582BDA91E3797DA1A9515C1E61A77C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  credential_accessdefense_evasiondiscoveryexectionexecutionpersistenceprivilege_escalation

  • Modifies the dynamic linker configuration file

    Malware can modify the configuration file of the dynamic linker to preload malicous libraries with every executed process.

    exectionpersistenceprivilege_escalationdefense_evasion

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Deletes itself

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Modifies hosts file

    Adds to hosts file used for mapping hosts to IP addresses.

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Creates/modifies environment variables

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Modifies rc script

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence

  • Modifies systemd

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation

  • Write file to user bin folder

    persistence

  • Modifies Bash startup script

    persistence

  • Reads process memory

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  behavioral1