General
- Target 263af59235213c72dadea2a18881686d5bd22a3369fd59508a25061a35245438
- Size 81KB
- Sample260823-datwgaw1as
- SHA256 263af59235213c72dadea2a18881686d5bd22a3369fd59508a25061a35245438
- MD5 9d5352885582be66767ca7600f0c00ef
- SHA1 5fd4659d697b52eea3a91d9a5bc824bfe3466018
- SHA512 f3aca6cb0d835d249063bd85c54b82043eebb691cf8f74808efd4b688b3e734ebc5aabb1c993ddd0b202f8ccfdac5d7d3311fa179fb04e138446849715e7aad4
- SSDEEP 1536:0tRGqxhlusEwEV43hTbYhR0en7/WEcb91ZvgPOtcTceEbmnwYfa:0twEusEwE+3hTIeXvR1ZvgPoQceEyBi
- TLSH T1E78302F17857AE54D2E90EB3FAEB02472B9C39FCF90A30A2561C3654CF9425B153489B
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
263af59235213c72dadea2a18881686d5bd22a3369fd59508a25061a35245438
Resource
debian12-armhf-20260513-en
Malware Config
Targets
-
- Target 263af59235213c72dadea2a18881686d5bd22a3369fd59508a25061a35245438
- Size 81KB
- SHA256 263af59235213c72dadea2a18881686d5bd22a3369fd59508a25061a35245438
- MD5 9d5352885582be66767ca7600f0c00ef
- SHA1 5fd4659d697b52eea3a91d9a5bc824bfe3466018
- SHA512 f3aca6cb0d835d249063bd85c54b82043eebb691cf8f74808efd4b688b3e734ebc5aabb1c993ddd0b202f8ccfdac5d7d3311fa179fb04e138446849715e7aad4
- SSDEEP 1536:0tRGqxhlusEwEV43hTbYhR0en7/WEcb91ZvgPOtcTceEbmnwYfa:0twEusEwE+3hTIeXvR1ZvgPoQceEyBi
- TLSH T1E78302F17857AE54D2E90EB3FAEB02472B9C39FCF90A30A2561C3654CF9425B153489B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Deletes itself
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Creates/modifies environment variables
Creating/modifying environment variables is a common persistence mechanism.
-
Modifies systemd
Adds/ modifies systemd service files. Likely to achieve persistence.
-
Modifies Bash startup script
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
4XDG Autostart Entries
1Boot or Logon Initialization Scripts
2RC Scripts
2Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
4XDG Autostart Entries
1Boot or Logon Initialization Scripts
2RC Scripts
2Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1