General
- Target d59b4af4b28f7afdf09b74283360075f07d82f56fd91d0f66870e914c06886a6.elf
- Size 136KB
- Sample260824-cf8q5ssbnf
- SHA256 d59b4af4b28f7afdf09b74283360075f07d82f56fd91d0f66870e914c06886a6
- MD5 5383fafb2a59cb9cc9adaa9b33d955b4
- SHA1 f8c7b0d79aab5c25a2854a8ecdffc1335df51ea1
- SHA512 9a695a00ae7b73b4ed6aff88ddb8cc8111ef2ea1a2105787f740ffda5128acac9ad8343253dd9b1456533e0bb8c469f2122403a49c6780735bde483909c158e1
- SSDEEP 3072:8NwRzIOrjSf2aefnwoJFf7Fr9xThx7fmuCn/yqVh/cI3TR8fzCi2:8a5IOrjSOaGwIN9Vfmu+/ya/Byzo
- TLSH T1DDD312AC4D4A4F67FDC252B7E420C71EB06063BE1BCA4BAC5B691FC07925567E390624
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
d59b4af4b28f7afdf09b74283360075f07d82f56fd91d0f66870e914c06886a6.elf
Resource
debian9-mipsbe-20260513-en
Malware Config
Targets
-
- Target d59b4af4b28f7afdf09b74283360075f07d82f56fd91d0f66870e914c06886a6.elf
- Size 136KB
- SHA256 d59b4af4b28f7afdf09b74283360075f07d82f56fd91d0f66870e914c06886a6
- MD5 5383fafb2a59cb9cc9adaa9b33d955b4
- SHA1 f8c7b0d79aab5c25a2854a8ecdffc1335df51ea1
- SHA512 9a695a00ae7b73b4ed6aff88ddb8cc8111ef2ea1a2105787f740ffda5128acac9ad8343253dd9b1456533e0bb8c469f2122403a49c6780735bde483909c158e1
- SSDEEP 3072:8NwRzIOrjSf2aefnwoJFf7Fr9xThx7fmuCn/yqVh/cI3TR8fzCi2:8a5IOrjSOaGwIN9Vfmu+/ya/Byzo
- TLSH T1DDD312AC4D4A4F67FDC252B7E420C71EB06063BE1BCA4BAC5B691FC07925567E390624
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Deletes itself
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Creates/modifies environment variables
Creating/modifying environment variables is a common persistence mechanism.
-
Modifies systemd
Adds/ modifies systemd service files. Likely to achieve persistence.
-
Modifies Bash startup script
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
4XDG Autostart Entries
1Boot or Logon Initialization Scripts
2RC Scripts
2Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
4XDG Autostart Entries
1Boot or Logon Initialization Scripts
2RC Scripts
2Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1