Extracted

• • Target
    linux_arm5.elf
  • Size 2.0MB
  • SHA256 c8e4bb12b21dfd1259fc86c104583bf13df0aa9099ac3d50d9bb5d937b65756b
  • MD5 823c13442e3780023fb8213362de446e
  • SHA1 51d2a95d0a2796977ceb1b979e2a6c73891aa3c8
  • SHA512 51a00d7a168988af2d1227e1abe9236209da9c0d54ee0665842a42039d3cc4a70b85e7eeaf4ac912f41156cf13f717e9db34c20257960ab787f5d4342758c0a2
  • SSDEEP 24576:J1rMILphWsdRm6vM7lUVJtq8wfe9OqbVgYQ3k48jtIMoG34rJnWVh1BPnjKqZdtX:JVfjmPMo2T1
  • TLSH
    T1F2A5F857B8918552C4E42637BCBE81C833635EB99B8663666D04FE3C3ABF2D90E35314
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomware

  • Renames multiple (1004) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Creates/modifies environment variables

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion

  • Disables SELinux

    Disables SELinux security module.

    defense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Modifies systemd

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation

  • Write file to user bin folder

    persistence

  • Modifies Bash startup script

    persistence
  behavioral1