General
- Target 3be6c1fe87016852d78e42b68b8a9bb0b6f3101ad2642db0686dfff1b1fb7d1d.elf
- Size 51KB
- Sample260720-ltvk4sdx3n
- SHA256 3be6c1fe87016852d78e42b68b8a9bb0b6f3101ad2642db0686dfff1b1fb7d1d
- MD5 1850a73062029f05e6489a6d7a6a3bed
- SHA1 89b21ef963c690da175f433aee5beceeaf9f9197
- SHA512 47fd599eac0b4c061b8a5b95ebd9d16b2f36b79557b90df5d1038c75cdb3d922cb6abd457b37e1a4be5bf2a8729ac56d5e6b389e035571cb21265586b035239e
- SSDEEP 768:OAwo2YmG93+0MhGD9dOMAnsP8Fkl8NTpS8oi4sYuSmx4JQRO8QQzFULIu83U03wq:VyOdPeGDrOzr54Vi4sYpmyLQzFULJfS
- TLSH T16933F25DCEA0BD72C39D493FE8190EE7D013C17DB9A135E25104CA2B2FC215A68BE6D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
3be6c1fe87016852d78e42b68b8a9bb0b6f3101ad2642db0686dfff1b1fb7d1d.elf
Resource
debian12-armhf-20260513-en
Malware Config
Targets
-
- Target 3be6c1fe87016852d78e42b68b8a9bb0b6f3101ad2642db0686dfff1b1fb7d1d.elf
- Size 51KB
- SHA256 3be6c1fe87016852d78e42b68b8a9bb0b6f3101ad2642db0686dfff1b1fb7d1d
- MD5 1850a73062029f05e6489a6d7a6a3bed
- SHA1 89b21ef963c690da175f433aee5beceeaf9f9197
- SHA512 47fd599eac0b4c061b8a5b95ebd9d16b2f36b79557b90df5d1038c75cdb3d922cb6abd457b37e1a4be5bf2a8729ac56d5e6b389e035571cb21265586b035239e
- SSDEEP 768:OAwo2YmG93+0MhGD9dOMAnsP8Fkl8NTpS8oi4sYuSmx4JQRO8QQzFULIu83U03wq:VyOdPeGDrOzr54Vi4sYpmyLQzFULJfS
- TLSH T16933F25DCEA0BD72C39D493FE8190EE7D013C17DB9A135E25104CA2B2FC215A68BE6D6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Deletes itself
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Creates/modifies environment variables
Creating/modifying environment variables is a common persistence mechanism.
-
Modifies systemd
Adds/ modifies systemd service files. Likely to achieve persistence.
-
Modifies Bash startup script
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
4XDG Autostart Entries
1Boot or Logon Initialization Scripts
2RC Scripts
2Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
4XDG Autostart Entries
1Boot or Logon Initialization Scripts
2RC Scripts
2Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1