8a7dc9e82c8d24fe5c62c9dfac5dfbfa9fd5a514bcbdc8cb0e3fe4a1e4ee746f

Analysis

max time kernel
149s
max time network
152s
platform
debian-12_armhf
resource
debian12-armhf-20260126-en
resource tags

arch:armhfimage:debian12-armhf-20260126-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
20/04/2026, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FBI.arm7
Size 126KB
Sample260420-plc8msh13n
SHA256 8a7dc9e82c8d24fe5c62c9dfac5dfbfa9fd5a514bcbdc8cb0e3fe4a1e4ee746f
MD5 bf01c7e1785cdcb48a4b862fa040a33c
SHA1 d5d93d3cbd3e3fb05f7f151233d24c58e45ea78a
SHA512 32c94499894228067c99ab47104a1aa03e4d4d005986a4c8621461a95e776442135df19171d0e3134db1bb0b1b56b3767bf4c68d66fe9e443f98921504c2f6c3
SSDEEP 3072:i6nP6nlJosoawDh6iNwaVBgqO7sCk3Xr5h/pc1n:iSP6nlesoawF6iNwaLgYCk375ha1n
TLSH
T1E3C32917F9419F41C1C325BAFB8E964933136FF8E3EB7102D9249F60278699B0E76941
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Writes DNS configuration 1 TTPs 1 IoCs

Writes data to DNS resolver config file.

Adversary-in-the-Middle

T1557

description	ioc	Process
File opened for modification	/etc/resolv.conf	FBI.arm7

Changes its process name 4 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	daddyl33t's back	783	FBI.arm7
Changes the process name, possibly in an attempt to hide itself		783	FBI.arm7
Changes the process name, possibly in an attempt to hide itself		789	FBI.arm7
Changes the process name, possibly in an attempt to hide itself		788	FBI.arm7

/tmp/FBI.arm7
/tmp/FBI.arm7
1⤵
- Writes DNS configuration
- Changes its process name
PID:783

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Adversary-in-the-Middle

T1557

Discovery

Lateral Movement

Collection

Adversary-in-the-Middle

T1557

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads