Analysis
- max time kernel
150s - max time network
149s - platform
debian-12_armhf - resource
debian12-armhf-20250619-en - resource tags
- submitted
11/05/2026, 18:52
General
- Target zararli.elf
- Size 4.7MB
- Sample260511-xjcs4agy3y
- SHA256 f5a7696239b801496743753f8066775f68793e81b5d4eceb15f701950774733d
Score
6/10
Malware Config
Signatures
- Creates/modifies environment variables 1 TTPs 3 IoCs
Creating/modifying environment variables is a common persistence mechanism.
- Write file to user bin folder 2 IoCs
- Modifies Bash startup script 2 TTPs 3 IoCs
- Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
Processes
-
/tmp/zararli.elf/tmp/zararli.elf1⤵
- Creates/modifies environment variables
- Write file to user bin folder
- Modifies Bash startup script
- Enumerates kernel/hardware configuration
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Privilege Escalation
Boot or Logon Autostart Execution
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1