Overview

overview

10

Static

static

1

eb46dfb4f1...6f.elf

debian-12-armhf

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    eb46dfb4f15000a7d4af040b68e541251fd5716d2a77958b471a17ce2960416f.zip
  • Size 49KB
  • Sample260826-mryenaxbkd
  • SHA256 3bd002b5970824e6cd4539630194327e455512f930970b84238fc03616a39eba
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
bootkitdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomware

Malware Config

Extracted

Path

  • /R3ADM3.txt

Ransom Note
  • Your data has been encrypted, and we have taken copies of certain sensitive files. This encryption was carried out for financial reasons, and a payment will be required before we can provide the tools needed to restore your data. You will not be able to restore your data without our assistance. We can ensure full recovery if we work together. To show that we are able to restore your files, we can decrypt a few non-critical files at no cost. If we reach an agreement, we will keep all discussions private and delete the data we took. Please see the contact information below for the next steps. ========================== How to Contact Us ========================== Please download Tor Browser from the URL https://www.torproject.org/ Then install and open it. Then connect to the URL below and log in with the given credentials. Contact URL: http://nsnhzysbntsqdwpys6mhml33muccsvterxewh5rkbmcab7bg2ttevjqd.onion Client ID: -QHJ09DEo_CE2VYlV5lRO Initial password: 5884cabf6334c90f606cc1f68c00df04
URLs

  • http://nsnhzysbntsqdwpys6mhml33muccsvterxewh5rkbmcab7bg2ttevjqd.onion

Targets

    • Target
      eb46dfb4f15000a7d4af040b68e541251fd5716d2a77958b471a17ce2960416f.elf
    • Size 85KB
    • SHA256 eb46dfb4f15000a7d4af040b68e541251fd5716d2a77958b471a17ce2960416f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    bootkitdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomware

    • Renames multiple (3762) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Modifies initial root filesystem image

      Overwrites initrd/ initramfs image in the /boot mountpoint.

      bootkit

    • Modifies kernel boot image

      Overwrites kernel image in the /boot mountpoint.

      bootkit

    • Deletes journal logs

      Deletes systemd journal logs. Likely to evade detection.

      defense_evasion

    • Modifies Polkit authorization policy

      Rule or action files in the Polkit framework are written to, potentially allowing a process or user to execute privileged operations without requiring authentication.

    • Renames itself

    • Reads AppArmor ptrace settings

      Discovery of allowed ptrace capabilities by AppArmor.

      discovery

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

      executionpersistenceprivilege_escalation

    • Deletes log files

      Deletes log files on the system.

      defense_evasion

    • Reads network interface configuration

      Fetches information about one or more active network interfaces.

      discovery

    • Write file to user bin folder

      persistence
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks