General
- Target killbotx.arm4
- Size 109KB
- Sample260807-wwggda1dpd
- SHA256 b913aed0a412dc14e3bd5570f8aa0bc2c04fdba0ab04a885e2b24638d25f2553
- MD5 c86cfcd5053349b4863b081ebceb57ce
- SHA1 95cec8d57a00eeae42fe7bbed02a85ef5e3ee28a
- SHA512 e683340a9ef347c9b131287d322bc873d81ebfdc883a6fae02942d8e253eee3b8e12b27452977ee9787175562a57a0ac11cdcca2c24ad0068141667a1b0d745d
- SSDEEP 3072:/4hJ7xmHgbjdIqU3wWqIOItn/S1z1bqhrJS8aLEP:/4hpxmudIqU33q4tn/S1z1uf0EP
- TLSH T1E7B3F855F880CB62C6D4267AFB4E428D33231B79D3ED3106CE14AF3567FA95A4B3A901
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
killbotx.arm4
Resource
debian12-armhf-20260513-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target killbotx.arm4
- Size 109KB
- SHA256 b913aed0a412dc14e3bd5570f8aa0bc2c04fdba0ab04a885e2b24638d25f2553
- MD5 c86cfcd5053349b4863b081ebceb57ce
- SHA1 95cec8d57a00eeae42fe7bbed02a85ef5e3ee28a
- SHA512 e683340a9ef347c9b131287d322bc873d81ebfdc883a6fae02942d8e253eee3b8e12b27452977ee9787175562a57a0ac11cdcca2c24ad0068141667a1b0d745d
- SSDEEP 3072:/4hJ7xmHgbjdIqU3wWqIOItn/S1z1bqhrJS8aLEP:/4hpxmudIqU33q4tn/S1z1uf0EP
- TLSH T1E7B3F855F880CB62C6D4267AFB4E428D33231B79D3ED3106CE14AF3567FA95A4B3A901
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Modifies systemd
Adds/ modifies systemd service files. Likely to achieve persistence.
-
Write file to user bin folder
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2XDG Autostart Entries
1Boot or Logon Initialization Scripts
1RC Scripts
1Create or Modify System Process
1Systemd Service
1Scheduled Task/Job
1Cron
1