Extracted

• • Target
    7766739193c449206ea63751d23551e2057e4de80f6befaeb7a24eaeb63a5ee1.elf
  • Size 210KB
  • SHA256 7766739193c449206ea63751d23551e2057e4de80f6befaeb7a24eaeb63a5ee1
  • MD5 f7726661cb198c2838925f0a13acda0f
  • SHA1 7266610f04630fd66b4ab1ec8db2a5776db611e3
  • SHA512 26bc20a5e884dc4a59fa5d135ee125320f4421143c034f949bef39b17f39c298d837a0b242408cb59867214f4fe6914bfe7d57fd8d93e87c08169c429c6455df
  • SSDEEP 6144:Idrnbx71Ja2Vr/tkSfUwigjIBM/9ayi9WmP3CwgUXZUF:IFrJa2Vr/tknpdm/IJ9WmP3CXUXZUF
  • TLSH
    T1F0242A08EA54576FC6E337FAF68A42CE33334B94A39732265938ABB037C6B595D31111
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Creates/modifies environment variables

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Modifies rc script

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence

  • Modifies systemd

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation

  • Reads system routing table

    Gets active network interfaces from /proc virtual filesystem.

    discovery

  • Schedules an At job

    Schedules a job to be run using the at command.

    executionpersistenceprivilege_escalation

  • Modifies Bash startup script

    persistence
  behavioral1