Overview

overview

6

Static

static

1

FKO.elf

debian-12-armhf

6

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    debian-12_armhf
  • resource
    debian12-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
  • submitted
    04/08/2026, 12:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    FKO.elf
  • Size 87KB
  • Sample260804-ptqhyaep81
  • SHA256 cc3b5315c3ea9fb7c58a4f2c6f49d5ca4f37791c2289d0ab19626dc3d7eeb50b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Creates/modifies Cron job 1 TTPs 2 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies rc script 2 TTPs 1 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/FKO.elf
    /tmp/FKO.elf
    1⤵
    • Creates/modifies Cron job
    • Modifies rc script
    • Modifies systemd
    • Reads runtime system information
    PID:790
    • /usr/local/sbin/systemctl
      systemctl daemon-reload
      2⤵
        PID:813
      • /usr/local/sbin/systemctl
        systemctl enable crond.service
        2⤵
          PID:814
        • /usr/local/bin/systemctl
          systemctl enable crond.service
          2⤵
            PID:814
          • /usr/local/bin/systemctl
            systemctl daemon-reload
            2⤵
              PID:813
            • /usr/sbin/systemctl
              systemctl daemon-reload
              2⤵
                PID:813
              • /usr/sbin/systemctl
                systemctl enable crond.service
                2⤵
                  PID:814
                • /usr/bin/systemctl
                  systemctl daemon-reload
                  2⤵
                    PID:813
                • /usr/bin/systemctl
                  systemctl enable crond.service
                  1⤵
                    PID:814

                  Network

                        MITRE ATT&CK Enterprise v16

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        crond
                        • Path /etc/cron.d/crond
                        • Size 29B
                        • SHA256 0930573e9f6fb5af0277bb064a917d456c7552af8cedb516cf0b552c04973aa1
                        • MD5 SHA1 SHA512
                        Submit Download

                        rc.local
                        • Path /etc/rc.local
                        • Size 10B
                        • SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
                        • MD5 SHA1 SHA512
                        Submit Download

                        rc.local
                        • Path /etc/rc.local
                        • Size 33B
                        • SHA256 96dc6cfd9c706d9d18d01c41697fc33997129785743f18ea401d746f3517d741
                        • MD5 SHA1 SHA512
                        Submit Download

                        crond.service
                        • Path /etc/systemd/system/crond.service
                        • Size 192B
                        • SHA256 0b1cea13d9d126ff485e42ae0e0de75d2ed5bb692fc16e2025496ecc0fd267e5
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download