General
- Target 02cafc015e53bcb91415ed85b53728b0da6b07a2900339c50f309e26d0ec281b.elf
- Size 117KB
- Sample260806-227teasemh
- SHA256 ce974705354785948578000ff6a139dffd8bdda4cd24a1b18bc04df2a71733b4
- MD5 5d76a7edf7955021acebf24768c1c080
- SHA1 176efc6e98a6dcbd66d1e161865fb934d1f600b1
- SHA512 8ceba8321afa42bf3377769455fd4206fc0904a9db8f499da97259347b91719d873edc5ebe031a745b6a81798eb83b60cd1c4aeaa673e10e13a7a9c45f179a2c
- SSDEEP 3072:ZVJW0PobiEUGHtUQ4g8ObC+qE5HqvfDh6dso4f1Dlu:ZXWHJHtUQ4g8O2+qEIDh6N495
- TLSH T1CBC32B99F890DE52C6D52675FA5E018C332357B8C3EA7206CD209F34B7E7D5A0E3A942
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
02cafc015e53bcb91415ed85b53728b0da6b07a2900339c50f309e26d0ec281b.elf
Resource
debian12-armhf-20260513-en
Malware Config
Targets
-
- Target 02cafc015e53bcb91415ed85b53728b0da6b07a2900339c50f309e26d0ec281b.elf
- Size 117KB
- SHA256 ce974705354785948578000ff6a139dffd8bdda4cd24a1b18bc04df2a71733b4
- MD5 5d76a7edf7955021acebf24768c1c080
- SHA1 176efc6e98a6dcbd66d1e161865fb934d1f600b1
- SHA512 8ceba8321afa42bf3377769455fd4206fc0904a9db8f499da97259347b91719d873edc5ebe031a745b6a81798eb83b60cd1c4aeaa673e10e13a7a9c45f179a2c
- SSDEEP 3072:ZVJW0PobiEUGHtUQ4g8ObC+qE5HqvfDh6dso4f1Dlu:ZXWHJHtUQ4g8O2+qEIDh6N495
- TLSH T1CBC32B99F890DE52C6D52675FA5E018C332357B8C3EA7206CD209F34B7E7D5A0E3A942
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Deletes itself
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Creates/modifies environment variables
Creating/modifying environment variables is a common persistence mechanism.
-
Modifies systemd
Adds/ modifies systemd service files. Likely to achieve persistence.
-
Modifies Bash startup script
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
4XDG Autostart Entries
1Boot or Logon Initialization Scripts
2RC Scripts
2Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
4XDG Autostart Entries
1Boot or Logon Initialization Scripts
2RC Scripts
2Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1