General
- Target armv7l
- Size 4.3MB
- Sample260903-w3bvgaba52
- SHA256 8794146ebab918bf0da10ccdd843185448ccb83df46a287cc909403ed37c1f8e
- MD5 f951c93c3854eb09cfd3daeea5576f76
- SHA1 ccef61a18a353b79adc585ad443065d5cbb6ed6c
- SHA512 3e1fd683b47a9d95936ad2e91455b8e897d7e3fee484a96041a5e36e39c91a002caf5806bb3b078b095fda58239aca27020d7ad33fcbad6aa1b3ff384b8e10de
- SSDEEP 49152:mDPmrqixkgJutCxp3bWbfyI6Mw6mx2rU1F1:GPmPxkyutc3
- TLSH T125261A57B8918A43C4E4267ABCBDC1C433672EB99B9722576D00FE3D3ABE1990E35704
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
armv7l
Resource
debian12-armhf-20260513-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target armv7l
- Size 4.3MB
- SHA256 8794146ebab918bf0da10ccdd843185448ccb83df46a287cc909403ed37c1f8e
- MD5 f951c93c3854eb09cfd3daeea5576f76
- SHA1 ccef61a18a353b79adc585ad443065d5cbb6ed6c
- SHA512 3e1fd683b47a9d95936ad2e91455b8e897d7e3fee484a96041a5e36e39c91a002caf5806bb3b078b095fda58239aca27020d7ad33fcbad6aa1b3ff384b8e10de
- SSDEEP 49152:mDPmrqixkgJutCxp3bWbfyI6Mw6mx2rU1F1:GPmPxkyutc3
- TLSH T125261A57B8918A43C4E4267ABCBDC1C433672EB99B9722576D00FE3D3ABE1990E35704
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Creates/modifies environment variables
Creating/modifying environment variables is a common persistence mechanism.
-
Write file to user bin folder
-
Modifies Bash startup script
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Privilege Escalation
Boot or Logon Autostart Execution
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1