General
- Target putita.arm6.elf
- Size 121KB
- Sample260716-bfannsds7x
- SHA256 41e3673069a4c07ee11f566d6bba1523255b6d9cc0fceabe42da04d7f0d944cb
- MD5 3bf6c523dfa2475d24b13552c57a8789
- SHA1 f7e0bc2251ec2616af7e5e1bbb51da71786e53f5
- SHA512 ea99bf21df2416334a57d3a4f4e4cb651b550bdf34ac2b3aab5e03b5be28277e09f4ee79b4ef8ff5f9752b0efdb20b31f99de6cb9e53ea6668bfa941dddb16c3
- SSDEEP 3072:3KkAGfJqpUqVL45zcQrT25YcYEEU1aK2x2SPpkh+ip8RNaY7AAf1Dl:3K80qrGYcYEEU1aKM2eCh+/r0A95
- TLSH T115C329A9F880DE52C6D1267AF75E118C33231778D3DE7109CE249E3467EB95E0E3A942
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
putita.arm6.elf
Resource
debian12-armhf-20260127-en
Malware Config
Targets
-
- Target putita.arm6.elf
- Size 121KB
- SHA256 41e3673069a4c07ee11f566d6bba1523255b6d9cc0fceabe42da04d7f0d944cb
- MD5 3bf6c523dfa2475d24b13552c57a8789
- SHA1 f7e0bc2251ec2616af7e5e1bbb51da71786e53f5
- SHA512 ea99bf21df2416334a57d3a4f4e4cb651b550bdf34ac2b3aab5e03b5be28277e09f4ee79b4ef8ff5f9752b0efdb20b31f99de6cb9e53ea6668bfa941dddb16c3
- SSDEEP 3072:3KkAGfJqpUqVL45zcQrT25YcYEEU1aK2x2SPpkh+ip8RNaY7AAf1Dl:3K80qrGYcYEEU1aKM2eCh+/r0A95
- TLSH T115C329A9F880DE52C6D1267AF75E118C33231778D3DE7109CE249E3467EB95E0E3A942
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Deletes itself
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Creates/modifies environment variables
Creating/modifying environment variables is a common persistence mechanism.
-
Modifies systemd
Adds/ modifies systemd service files. Likely to achieve persistence.
-
Modifies Bash startup script
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
4XDG Autostart Entries
1Boot or Logon Initialization Scripts
2RC Scripts
2Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
4XDG Autostart Entries
1Boot or Logon Initialization Scripts
2RC Scripts
2Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1