c62a539ef0b524d81b3379a21d52f1b1799f39be30c107abb80c91159c913cea

Analysis

max time kernel
149s
max time network
152s
platform
debian-12_armhf
resource
debian12-armhf-20260513-en
resource tags

arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
03/07/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ARMV7L.elf
Size 138KB
Sample260703-repdfaaw4s
SHA256 c62a539ef0b524d81b3379a21d52f1b1799f39be30c107abb80c91159c913cea
MD5 6585adaacd90b484af5489eefc83016f
SHA1 97e250e16d33e3eac0d7a7dce0bb0662878fe4f9
SHA512 3a7b0a456c590dd9698f02928af42e30e31479129294d25b1f16f3dd93b7e42729474c3ac09a34e9bc8b3cf46183595ab674abf3cad1a7f648d9e88a5e783d84
SSDEEP 3072:ZemeaaNACSajE/sCbFeUj7YOPPoO8Wf5h9p/8Zy:ZMGCSajgscFeUHY9O8Wf5hEZy
TLSH
T19AD3F84DE9106B29C6E271FBFB9D52CE32271FBDE3EB3012D9304B9123C5A964A36511
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Writes DNS configuration 1 TTPs 1 IoCs

Writes data to DNS resolver config file.

Adversary-in-the-Middle

T1557

description	ioc	Process
File opened for modification	/etc/resolv.conf	ARMV7L.elf

Changes its process name 4 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	daddyl33t's back	787	ARMV7L.elf
Changes the process name, possibly in an attempt to hide itself		787	ARMV7L.elf
Changes the process name, possibly in an attempt to hide itself		791	ARMV7L.elf
Changes the process name, possibly in an attempt to hide itself		790	ARMV7L.elf

/tmp/ARMV7L.elf
/tmp/ARMV7L.elf
1⤵
- Writes DNS configuration
- Changes its process name
PID:787

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Adversary-in-the-Middle

T1557

Discovery

Lateral Movement

Collection

Adversary-in-the-Middle

T1557

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads