Extracted

• • Target
    linux_arm7
  • Size 2.0MB
  • SHA256 8d7fd9b29ebb4f3f32f3e7473f336e4546d794e4ec6f1f80ca402214510657b4
  • MD5 60cb23b995dfabd4bbdac73a59b4e7f9
  • SHA1 bbf865c4e74a18594c2978ec232ef65588f6789d
  • SHA512 9649056cb683721df631e7c98b4f1636e7f501225040a4c50f5ea8dfe633ccd82f38fbc4d6363da7b7c3c35fe070173cac26b829969a8ecd9c181277851f6c60
  • SSDEEP 24576:gNwGGRggwEGpD5IaZIJzIDgliOAMUh1Rskiq1zpQHCaRU7axVL0rKSk3dVh/cviW:VrcNoLd3z82T16
  • TLSH
    T173A50857B8918582C4E42677ACBE81C833635EB99B8653266D04FE3C3EBF2D90E35354
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomware

  • Renames multiple (1004) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Creates/modifies environment variables

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion

  • Disables SELinux

    Disables SELinux security module.

    defense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Modifies systemd

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation

  • Write file to user bin folder

    persistence

  • Modifies Bash startup script

    persistence
  behavioral1