General
- Target 88a1d3a4b48679023f740e25593ba6c7618b342b29a3d5a9dfd90c508b2e49c2.elf
- Size 81KB
- Sample260819-xeh5batvez
- SHA256 88a1d3a4b48679023f740e25593ba6c7618b342b29a3d5a9dfd90c508b2e49c2
- MD5 b8662f614e16e71d08c00d3b3fc9fb90
- SHA1 1cf03f7bd7ce3f5c0f72c5f4c45c7dfe5c624a20
- SHA512 d8bfbc8464e5760c61fe3d65eed00516f4758d33dc331629abb271541282f8cf45187fde2fcdc59828180c30ba86188f4d86a38ce0343fa76af99244056a0b00
- SSDEEP 1536:CnM/CYoOM1v8DbetvF5DeJYtFUXed+U5dZ2+X0Bymy5EghncGI7DTfC:X/EOM1BvbtMed+UN2+EBymXgBIPTK
- TLSH T1118302FDC88E7059E4F7E07DA8AC8B667F321FAD737520119C4047946BB42A663690D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
88a1d3a4b48679023f740e25593ba6c7618b342b29a3d5a9dfd90c508b2e49c2.elf
Resource
debian12-armhf-20260513-en
Malware Config
Targets
-
- Target 88a1d3a4b48679023f740e25593ba6c7618b342b29a3d5a9dfd90c508b2e49c2.elf
- Size 81KB
- SHA256 88a1d3a4b48679023f740e25593ba6c7618b342b29a3d5a9dfd90c508b2e49c2
- MD5 b8662f614e16e71d08c00d3b3fc9fb90
- SHA1 1cf03f7bd7ce3f5c0f72c5f4c45c7dfe5c624a20
- SHA512 d8bfbc8464e5760c61fe3d65eed00516f4758d33dc331629abb271541282f8cf45187fde2fcdc59828180c30ba86188f4d86a38ce0343fa76af99244056a0b00
- SSDEEP 1536:CnM/CYoOM1v8DbetvF5DeJYtFUXed+U5dZ2+X0Bymy5EghncGI7DTfC:X/EOM1BvbtMed+UN2+EBymXgBIPTK
- TLSH T1118302FDC88E7059E4F7E07DA8AC8B667F321FAD737520119C4047946BB42A663690D1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Deletes itself
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Creates/modifies environment variables
Creating/modifying environment variables is a common persistence mechanism.
-
Modifies systemd
Adds/ modifies systemd service files. Likely to achieve persistence.
-
Modifies Bash startup script
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
4XDG Autostart Entries
1Boot or Logon Initialization Scripts
2RC Scripts
2Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
4XDG Autostart Entries
1Boot or Logon Initialization Scripts
2RC Scripts
2Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1