Extracted

• • Target
    kworker.elf
  • Size 170KB
  • SHA256 3e724458a4b817aad81a70746f397fc4830da3ab02d465f53dcf8e6af9a8391e
  • MD5 a88e573290d9092e4af443587ad1c47b
  • SHA1 a64f8f4e57c0e092b65714058785cfd15dd494f3
  • SHA512 301c564837b771a066f4f19d06987941fb695748064e9273f5cc17e2cbb0e1ba9f0f57ee4b23be22cc78a34060ee4a4a4a36bc53de29dee56c06a57734293c7a
  • SSDEEP 3072:iI+4RfJGMPeuQ8oGM+e3+1r9PDv1ZfDE0Wq9tSoPdfacs09XEoYG5gZuiiqXxkRq:EHOXB97BuzhabQVpzIoHjFR4ZWm+Iusc
  • TLSH
    T1AE04F809E965577FC2E333FAF65A42CE33361F98A39B33255A346BB427C1B481939121
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Creates/modifies environment variables

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Modifies rc script

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence

  • Modifies systemd

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation

  • Reads system routing table

    Gets active network interfaces from /proc virtual filesystem.

    discovery

  • Schedules an At job

    Schedules a job to be run using the at command.

    executionpersistenceprivilege_escalation

  • Modifies Bash startup script

    persistence
  behavioral1