General
- Target killbotx.arm7.elf
- Size 109KB
- Sample260806-c81k8ssanb
- SHA256 ffb0668a571ad16e671d71ee480fa292e94357c6cfc794dfa38be1a37779e431
- MD5 4bb19cb9e89759128972dd8d803ab4c2
- SHA1 59ad2caea7b2d07d5101d4a72e3d198001f4be49
- SHA512 3155d3d9f27fc53fc2c57a9943ef2c0b4840f0d7d6862ed3a8ea8a4808912210ef2009fd966c9cc698adf2ac26ff6dbdbd99e3c5c39778d43b912726f35c4945
- SSDEEP 3072:n4hqvUA4hakSXEd504awTVix8ezDvKeBEPg:n4h8UAcakQ4awTVix8yDBEP
- TLSH T1EBB3F959F880CA52C6D5267AFB4E428D33231B78D3D97102CE24AE3577FE95A4B3B901
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
killbotx.arm7.elf
Resource
debian12-armhf-20260127-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target killbotx.arm7.elf
- Size 109KB
- SHA256 ffb0668a571ad16e671d71ee480fa292e94357c6cfc794dfa38be1a37779e431
- MD5 4bb19cb9e89759128972dd8d803ab4c2
- SHA1 59ad2caea7b2d07d5101d4a72e3d198001f4be49
- SHA512 3155d3d9f27fc53fc2c57a9943ef2c0b4840f0d7d6862ed3a8ea8a4808912210ef2009fd966c9cc698adf2ac26ff6dbdbd99e3c5c39778d43b912726f35c4945
- SSDEEP 3072:n4hqvUA4hakSXEd504awTVix8ezDvKeBEPg:n4h8UAcakQ4awTVix8yDBEP
- TLSH T1EBB3F959F880CA52C6D5267AFB4E428D33231B78D3D97102CE24AE3577FE95A4B3B901
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Modifies systemd
Adds/ modifies systemd service files. Likely to achieve persistence.
-
Write file to user bin folder
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2XDG Autostart Entries
1Boot or Logon Initialization Scripts
1RC Scripts
1Create or Modify System Process
1Systemd Service
1Scheduled Task/Job
1Cron
1