General
- Target bb7d7c7f6dd3c346fb58a182fe62e5ff4e34b02efe8b13d686d98bf9adb575ce.elf
- Size 193KB
- Sample260824-cgtcvasbpd
- SHA256 b94c5392ef73b9b3a8a930005f2d48d273e3179553131bc294562ac64c7effa1
- MD5 439cb3a82dd4251397a33d8a1269fd75
- SHA1 09cc740a50092b970428b1a7afde17687cac791b
- SHA512 728b402568f852ae4c2979d7de4fc50c037546b992aec9864585bde31ce1dcab81ef3dbaff3951f6ececded425f3eba2497e1b5f6a3f4d4277d117692377f14b
- SSDEEP 6144:sRlL8s/kMmKTUQ4g8O592I0zMp0No9MpM1J5km:2lP/kMTTUQ4g8O78UNMi15
- TLSH T1A2143A95F890DE52C6D5267AF96E518C331313B8D2DAB106CD244F38B7EB85E0F3A942
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
bb7d7c7f6dd3c346fb58a182fe62e5ff4e34b02efe8b13d686d98bf9adb575ce.elf
Resource
debian12-armhf-20260127-en
Malware Config
Targets
-
- Target bb7d7c7f6dd3c346fb58a182fe62e5ff4e34b02efe8b13d686d98bf9adb575ce.elf
- Size 193KB
- SHA256 b94c5392ef73b9b3a8a930005f2d48d273e3179553131bc294562ac64c7effa1
- MD5 439cb3a82dd4251397a33d8a1269fd75
- SHA1 09cc740a50092b970428b1a7afde17687cac791b
- SHA512 728b402568f852ae4c2979d7de4fc50c037546b992aec9864585bde31ce1dcab81ef3dbaff3951f6ececded425f3eba2497e1b5f6a3f4d4277d117692377f14b
- SSDEEP 6144:sRlL8s/kMmKTUQ4g8O592I0zMp0No9MpM1J5km:2lP/kMTTUQ4g8O78UNMi15
- TLSH T1A2143A95F890DE52C6D5267AF96E518C331313B8D2DAB106CD244F38B7EB85E0F3A942
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Deletes itself
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Creates/modifies environment variables
Creating/modifying environment variables is a common persistence mechanism.
-
Modifies systemd
Adds/ modifies systemd service files. Likely to achieve persistence.
-
Modifies Bash startup script
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
4XDG Autostart Entries
1Boot or Logon Initialization Scripts
2RC Scripts
2Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
4XDG Autostart Entries
1Boot or Logon Initialization Scripts
2RC Scripts
2Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1