General
- Target f52824d120c097cbca20a105bfef128d103b9ee54c9ba9cafe38c8d79a95bfea.elf
- Size 55KB
- Sample260806-3dznkacg83
- SHA256 f52824d120c097cbca20a105bfef128d103b9ee54c9ba9cafe38c8d79a95bfea
- MD5 b7eba7e1c4fb80786d3c400dd6c8ac5f
- SHA1 457a1d49a2a1e968db3e1cc9d054b9ff6f27b601
- SHA512 913164a35713c9ed9fda6d999e181111c97f41d045d83aa02543a1d9f04586a6eab2c818ebc2d1a10cca93ede1eb7dd8405bb553f1f1e76e716544444708c571
- SSDEEP 768:bTckj2H6CqS8jo9M3sVj3bUzl7L3YXMtVaQsGfNsf3uSHY/rhP0BWUJScfa43U0u:bwM2aCv19M3k3Uz1iMDaQsGfC3uSc5fp
- TLSH T10743F259892BF576EDBF0836E63A47011432AE21C075B33B3D084244EE962DDD9FD968
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
f52824d120c097cbca20a105bfef128d103b9ee54c9ba9cafe38c8d79a95bfea.elf
Resource
debian12-armhf-20260127-en
Malware Config
Targets
-
- Target f52824d120c097cbca20a105bfef128d103b9ee54c9ba9cafe38c8d79a95bfea.elf
- Size 55KB
- SHA256 f52824d120c097cbca20a105bfef128d103b9ee54c9ba9cafe38c8d79a95bfea
- MD5 b7eba7e1c4fb80786d3c400dd6c8ac5f
- SHA1 457a1d49a2a1e968db3e1cc9d054b9ff6f27b601
- SHA512 913164a35713c9ed9fda6d999e181111c97f41d045d83aa02543a1d9f04586a6eab2c818ebc2d1a10cca93ede1eb7dd8405bb553f1f1e76e716544444708c571
- SSDEEP 768:bTckj2H6CqS8jo9M3sVj3bUzl7L3YXMtVaQsGfNsf3uSHY/rhP0BWUJScfa43U0u:bwM2aCv19M3k3Uz1iMDaQsGfC3uSc5fp
- TLSH T10743F259892BF576EDBF0836E63A47011432AE21C075B33B3D084244EE962DDD9FD968
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Deletes itself
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Creates/modifies environment variables
Creating/modifying environment variables is a common persistence mechanism.
-
Modifies systemd
Adds/ modifies systemd service files. Likely to achieve persistence.
-
Modifies Bash startup script
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
4XDG Autostart Entries
1Boot or Logon Initialization Scripts
2RC Scripts
2Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
4XDG Autostart Entries
1Boot or Logon Initialization Scripts
2RC Scripts
2Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1