General
- Target 942844d9cf50881a76041b28dad1d53c34790863c0f6e8d93c62688559ac848a.elf
- Size 81KB
- Sample260819-xcl37aha66
- SHA256 942844d9cf50881a76041b28dad1d53c34790863c0f6e8d93c62688559ac848a
- MD5 71a51e3403f1cb3e09a448afe26a12fc
- SHA1 1a6ef01acbe32cea5d72d6cb9f06380a364f1a4f
- SHA512 48ed17a272e9192ad8d0537daa52726ed36555c5e5d4a9f2a89ada995ed1759d2ad0aba047d568ad622babbe777daa4eeac2450697c8d433d79ea8024e7658d7
- SSDEEP 1536:4C4LA5bImYty3GW3fbZBgM6DqGg5TVRtajirAsAPPWbnDjT16PGfIv:4DLA58mp3D3cMCqGAxRtawA9ul6PGwv
- TLSH T1F78302B4FF05A9BEE7AE11BCD8B442807B279F3892E17B2105308E09865D809FDF61D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
942844d9cf50881a76041b28dad1d53c34790863c0f6e8d93c62688559ac848a.elf
Resource
debian12-armhf-20260513-en
Malware Config
Targets
-
- Target 942844d9cf50881a76041b28dad1d53c34790863c0f6e8d93c62688559ac848a.elf
- Size 81KB
- SHA256 942844d9cf50881a76041b28dad1d53c34790863c0f6e8d93c62688559ac848a
- MD5 71a51e3403f1cb3e09a448afe26a12fc
- SHA1 1a6ef01acbe32cea5d72d6cb9f06380a364f1a4f
- SHA512 48ed17a272e9192ad8d0537daa52726ed36555c5e5d4a9f2a89ada995ed1759d2ad0aba047d568ad622babbe777daa4eeac2450697c8d433d79ea8024e7658d7
- SSDEEP 1536:4C4LA5bImYty3GW3fbZBgM6DqGg5TVRtajirAsAPPWbnDjT16PGfIv:4DLA58mp3D3cMCqGAxRtawA9ul6PGwv
- TLSH T1F78302B4FF05A9BEE7AE11BCD8B442807B279F3892E17B2105308E09865D809FDF61D1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Deletes itself
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Creates/modifies environment variables
Creating/modifying environment variables is a common persistence mechanism.
-
Modifies systemd
Adds/ modifies systemd service files. Likely to achieve persistence.
-
Modifies Bash startup script
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
4XDG Autostart Entries
1Boot or Logon Initialization Scripts
2RC Scripts
2Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
4XDG Autostart Entries
1Boot or Logon Initialization Scripts
2RC Scripts
2Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1