General
- Target bb7d7c7f6dd3c346fb58a182fe62e5ff4e34b02efe8b13d686d98bf9adb575ce.elf
- Size 86KB
- Sample260824-cf8q5ssbng
- SHA256 bb7d7c7f6dd3c346fb58a182fe62e5ff4e34b02efe8b13d686d98bf9adb575ce
- MD5 7732c5edaf32ce1f4527a54712a8c43a
- SHA1 292dc0088344c3afe6fd07ee2baec744d2c50825
- SHA512 9f59937815386a7d41a9a98b16a0bb9570da8a2a56b55ed3567c5a34d9004bc14f642f510e2af28d8f35e98539c4121baaa3511beac63ece80fc6ad612eabd35
- SSDEEP 1536:D7JFmTfIiqP4nhugNxJOKp071RHQpTb7FSNxrpJA9ECspB4Ef7:D77kIiY8hugwQubwpRSNxrcqtpB4ED
- TLSH T1D88302810A19DCF4C0FB753BFE5656919B049FB4A33370F0652AA9807E618FB17B609A
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
bb7d7c7f6dd3c346fb58a182fe62e5ff4e34b02efe8b13d686d98bf9adb575ce.elf
Resource
debian12-armhf-20260513-en
Malware Config
Targets
-
- Target bb7d7c7f6dd3c346fb58a182fe62e5ff4e34b02efe8b13d686d98bf9adb575ce.elf
- Size 86KB
- SHA256 bb7d7c7f6dd3c346fb58a182fe62e5ff4e34b02efe8b13d686d98bf9adb575ce
- MD5 7732c5edaf32ce1f4527a54712a8c43a
- SHA1 292dc0088344c3afe6fd07ee2baec744d2c50825
- SHA512 9f59937815386a7d41a9a98b16a0bb9570da8a2a56b55ed3567c5a34d9004bc14f642f510e2af28d8f35e98539c4121baaa3511beac63ece80fc6ad612eabd35
- SSDEEP 1536:D7JFmTfIiqP4nhugNxJOKp071RHQpTb7FSNxrpJA9ECspB4Ef7:D77kIiY8hugwQubwpRSNxrcqtpB4ED
- TLSH T1D88302810A19DCF4C0FB753BFE5656919B049FB4A33370F0652AA9807E618FB17B609A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Deletes itself
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Creates/modifies environment variables
Creating/modifying environment variables is a common persistence mechanism.
-
Modifies systemd
Adds/ modifies systemd service files. Likely to achieve persistence.
-
Modifies Bash startup script
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
4XDG Autostart Entries
1Boot or Logon Initialization Scripts
2RC Scripts
2Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
4XDG Autostart Entries
1Boot or Logon Initialization Scripts
2RC Scripts
2Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1