General
- Target 2026-06-27-17.zip
- Size 10.0MB
- Sample260702-w15prsb121
- SHA256 f4c595a107b277f901da24dd2a8f1d08036a45303f473e7b7b2713e625fc91d9
Malware Config
Targets
-
- Target 125e9eecc725a29649a8adba3feea2fcb2d5077d1ab2f57fc8e6a2c82d4bda1e.elf
- Size 272KB
- SHA256 125e9eecc725a29649a8adba3feea2fcb2d5077d1ab2f57fc8e6a2c82d4bda1e
Score1/10 -
- Target 2623f6dc0b4d56f7aaf634bd25d0baec6f14bf5d902bc2b75534b731667d7646.elf
- Size 394KB
- SHA256 2623f6dc0b4d56f7aaf634bd25d0baec6f14bf5d902bc2b75534b731667d7646
Score1/10 -
- Target 2c3416d10a67021fa236a254bf397ece6789b921af0ef5f33b9ca69c63f6e6c2.elf
- Size 394KB
- SHA256 2c3416d10a67021fa236a254bf397ece6789b921af0ef5f33b9ca69c63f6e6c2
Score7/10Executes dropped EXE
-
- Target 304e7db1072c78f322297554b1c8b7c8f40b017cebf2d5f009e04674e633d92a.elf
- Size 236KB
- SHA256 304e7db1072c78f322297554b1c8b7c8f40b017cebf2d5f009e04674e633d92a
Score1/10 -
- Target 49061a4ad78f4891c747acff4fbb75b816635069625ea654f22f41810e2be45a.elf
- Size 377KB
- SHA256 49061a4ad78f4891c747acff4fbb75b816635069625ea654f22f41810e2be45a
Score1/10 -
- Target 547e1c8e530fc32219070e50c482870e87b452a50854ccc491cf5ab157527b44.elf
- Size 272KB
- SHA256 547e1c8e530fc32219070e50c482870e87b452a50854ccc491cf5ab157527b44
Score1/10 -
- Target 61b82406637f811d7f7191859f6ad1fe2be2af06370d1f1dcf9b500d45689a7d.elf
- Size 104KB
- SHA256 61b82406637f811d7f7191859f6ad1fe2be2af06370d1f1dcf9b500d45689a7d
Score7/10Deletes itself
Modifies Watchdog functionality
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
Enumerates active TCP sockets
Gets active TCP sockets from /proc virtual filesystem.
Enumerates running processes
Discovers information about currently running processes on the system
Modifies systemd
Adds/ modifies systemd service files. Likely to achieve persistence.
Reads MAC address of network interface
Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.
-
- Target 6dec293665c624ca094b8d312697a50d0e757deef68f3e5bd71bb80cf994036e.elf
- Size 268KB
- SHA256 6dec293665c624ca094b8d312697a50d0e757deef68f3e5bd71bb80cf994036e
Score1/10 -
- Target 71b203ab29d830edec1f478d7a4d9bd9dd6bbdf410ff70daf5b73d5cb1b26523.exe
- Size 3.4MB
- SHA256 71b203ab29d830edec1f478d7a4d9bd9dd6bbdf410ff70daf5b73d5cb1b26523
Score10/10Suspicious use of NtCreateProcessExOtherParentProcess
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target b38d466dbb28feb20f4f8cc9d9a3b2204bf38e487e7cc5f057a756dd5f40b7c6.apk
- Size 4.4MB
- SHA256 b38d466dbb28feb20f4f8cc9d9a3b2204bf38e487e7cc5f057a756dd5f40b7c6
Score7/10Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
Acquires the wake lock
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
- Target b3f96ec768b213ab4a61d0286491ba48a667b3a6746c6a662b6a16705162f8ca.elf
- Size 265KB
- SHA256 b3f96ec768b213ab4a61d0286491ba48a667b3a6746c6a662b6a16705162f8ca
Score1/10 -
- Target b7df3e2020c12c1359090dca42a5b341ce3609778711864ad79c19aafbe9487d.elf
- Size 280KB
- SHA256 b7df3e2020c12c1359090dca42a5b341ce3609778711864ad79c19aafbe9487d
Score1/10 -
- Target bf23faf4440b3ecf07ebc99d4961bae4274a68c0ee8bb35f1936fcb80284ef47.elf
- Size 259KB
- SHA256 bf23faf4440b3ecf07ebc99d4961bae4274a68c0ee8bb35f1936fcb80284ef47
Score7/10Deletes itself
Modifies Watchdog functionality
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
Enumerates active TCP sockets
Gets active TCP sockets from /proc virtual filesystem.
Enumerates running processes
Discovers information about currently running processes on the system
Modifies systemd
Adds/ modifies systemd service files. Likely to achieve persistence.
Reads MAC address of network interface
Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.
-
- Target caa9408fdf9272b4a2c02061218f78c96124608dd23694cfc19ab0747ec1a43c.elf
- Size 5.6MB
- SHA256 caa9408fdf9272b4a2c02061218f78c96124608dd23694cfc19ab0747ec1a43c
Score6/10Creates/modifies environment variables
Creating/modifying environment variables is a common persistence mechanism.
Write file to user bin folder
Modifies Bash startup script
-
- Target cb573c8f6aaddb1c9ca8c77e996c01128b452ecc66518c5e24a01046925fb3ad.elf
- Size 94KB
- SHA256 cb573c8f6aaddb1c9ca8c77e996c01128b452ecc66518c5e24a01046925fb3ad
Score7/10Deletes itself
Modifies Watchdog functionality
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
Enumerates active TCP sockets
Gets active TCP sockets from /proc virtual filesystem.
Enumerates running processes
Discovers information about currently running processes on the system
Modifies systemd
Adds/ modifies systemd service files. Likely to achieve persistence.
Reads MAC address of network interface
Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.
-
- Target f4abb11473d61da7c065a13069f797d4441d9718f5a218a5d6b5d00f2bf10682.elf
- Size 280KB
- SHA256 f4abb11473d61da7c065a13069f797d4441d9718f5a218a5d6b5d00f2bf10682
Score1/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Unix Shell
1Scheduled Task/Job
1Cron
1Persistence
Boot or Logon Autostart Execution
2XDG Autostart Entries
1Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
2XDG Autostart Entries
1Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Defense Evasion
Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Impair Defenses
1Virtualization/Sandbox Evasion
1System Checks
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1Discovery
Browser Information Discovery
1Query Registry
3System Information Discovery
3System Network Configuration Discovery
2Internet Connection Discovery
1Wi-Fi Discovery
1System Network Connections Discovery
2System Time Discovery
1Virtualization/Sandbox Evasion
1System Checks
1