General
- Target vulcan_arm7
- Size 1.9MB
- Sample260529-ah2phaey2s
- SHA256 2a74ce196e98b97fdcf59c76c469612ea8f9db184006a27a11fa181d73497f79
- MD5 92bdfaadc4bc9195166007ec1ca61e38
- SHA1 d51ed053aac788100dce06afaab7a5da688db670
- SHA512 c5a92a3d0ab8a606a27ad9384a9abd47f393c06456cae9653f14512f4d82fa8ecb6212f082968d3e32ea7dd058c766a1b25e37c5ac44de7bccd1a7d3f4fdbf91
- SSDEEP 49152:Rk54qPWTfdRRb4u9WUY5jBuZGxVhKc49EkmIz41UAjFv:R64qsXZZ9nYX7xVhKD9EkiqQFv
- TLSH T1EC95331F3F7DD4F8584608126E819591D0CE8CE4BAA53F8188181F986E60A7AFED7D37
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
vulcan_arm7
Resource
debian12-armhf-20260513-en
Malware Config
Targets
-
- Target vulcan_arm7
- Size 1.9MB
- SHA256 2a74ce196e98b97fdcf59c76c469612ea8f9db184006a27a11fa181d73497f79
- MD5 92bdfaadc4bc9195166007ec1ca61e38
- SHA1 d51ed053aac788100dce06afaab7a5da688db670
- SHA512 c5a92a3d0ab8a606a27ad9384a9abd47f393c06456cae9653f14512f4d82fa8ecb6212f082968d3e32ea7dd058c766a1b25e37c5ac44de7bccd1a7d3f4fdbf91
- SSDEEP 49152:Rk54qPWTfdRRb4u9WUY5jBuZGxVhKc49EkmIz41UAjFv:R64qsXZZ9nYX7xVhKD9EkiqQFv
- TLSH T1EC95331F3F7DD4F8584608126E819591D0CE8CE4BAA53F8188181F986E60A7AFED7D37
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Contacts a large (7597) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Creates/modifies environment variables
Creating/modifying environment variables is a common persistence mechanism.
-
Modifies systemd
Adds/ modifies systemd service files. Likely to achieve persistence.
-
Write file to user bin folder
-
Modifies Bash startup script
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
3XDG Autostart Entries
1Boot or Logon Initialization Scripts
1RC Scripts
1Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
3XDG Autostart Entries
1Boot or Logon Initialization Scripts
1RC Scripts
1Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1