General
- Target armv7l.elf
- Size 5.6MB
- Sample260723-ddjvnsff32
- SHA256 0fb7ad5dc6c2c8bac1dce94687f553c244159ecd079459d53e64a001f94586f9
- MD5 8a9dbaf089c6bbf45219667ae24f51b0
- SHA1 9ab68bca749d35abccb0ef7c9d2670918a407bf1
- SHA512 37f2b4abb42969faa589e2258fb107aef0bca397317d37d38c3d6bb5754a9f8bb9ccd94b70c7a6824d5ce99797a538c62c5fb2db43698b061ef20365538faded
- SSDEEP 49152:9R1xO2GBCf1NE08ObR7e+9BzDZ9eOjLMmggxUyT5E2:1xO2GWnE0BP9BjLQgxNE2
- TLSH T1BE461897BDD25983C4E4367BA8BE80C433634EF99B8652565D08FE383ABE1D90E35314
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
armv7l.elf
Resource
debian12-armhf-20260513-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target armv7l.elf
- Size 5.6MB
- SHA256 0fb7ad5dc6c2c8bac1dce94687f553c244159ecd079459d53e64a001f94586f9
- MD5 8a9dbaf089c6bbf45219667ae24f51b0
- SHA1 9ab68bca749d35abccb0ef7c9d2670918a407bf1
- SHA512 37f2b4abb42969faa589e2258fb107aef0bca397317d37d38c3d6bb5754a9f8bb9ccd94b70c7a6824d5ce99797a538c62c5fb2db43698b061ef20365538faded
- SSDEEP 49152:9R1xO2GBCf1NE08ObR7e+9BzDZ9eOjLMmggxUyT5E2:1xO2GWnE0BP9BjLQgxNE2
- TLSH T1BE461897BDD25983C4E4367BA8BE80C433634EF99B8652565D08FE383ABE1D90E35314
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Creates/modifies environment variables
Creating/modifying environment variables is a common persistence mechanism.
-
Write file to user bin folder
-
Modifies Bash startup script
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Privilege Escalation
Boot or Logon Autostart Execution
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1