Extracted

• • Target
    07c0a0af63dde8dc2e36dc58b630dcad6563263e992877aaa704530afb8a5656.elf
  • Size 127KB
  • SHA256 07c0a0af63dde8dc2e36dc58b630dcad6563263e992877aaa704530afb8a5656
  • MD5 e4ae6a78e83cc685fbe6c7a95a476302
  • SHA1 965801aad155fbf4bc1c5026ee65173cb5a5661d
  • SHA512 ed70551683090a5e7223f5f5c9c9f5ee50db13537cc1eaee37bd396313d348014903a6fe25b40e4404c0d15761b3274ef698352857edc893be72b4950fa7216d
  • SSDEEP 3072:YiyLFeGtAgT6akMibb+a7BR8hPkILWm+WkNQTktc5y2:Q7AW6akL9BGhPVWm+WkNQTky5y2
  • TLSH
    T112D33A05F5508767C2D2237AFB9A825D37332B6497DB33219A24BFB42BC279D1E39121
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Creates/modifies environment variables

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Modifies rc script

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence

  • Modifies systemd

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation

  • Reads system routing table

    Gets active network interfaces from /proc virtual filesystem.

    discovery

  • Schedules an At job

    Schedules a job to be run using the at command.

    executionpersistenceprivilege_escalation

  • Modifies Bash startup script

    persistence
  behavioral1