General
- Target reaver.arm6.elf
- Size 179KB
- Sample260904-1xxbfa1erc
- SHA256 9d91a2692f7309ad560604580751fe76e0dc88d36c2f0fc1910201277496f67e
- MD5 4cb6f99db702cb524d8acdf26d740a40
- SHA1 876a87e7ac9cc3170d72342e66729bcc7b75c3e2
- SHA512 2e47273f8009720475c39c0689bb11bbae299613ca7aca47402aea20985134dfd6a05410d7a37c08308dbac64c2bebb5f87fc8ee66bd1c1cb9ebdf73e34bfbc7
- SSDEEP 3072:avYrxzJZwKP6pp7/TXLNbsnsy3GZz8UL9TwlaL21qximfG8wP+bMB3dum1v7APnC:avYmKP6pp7/TXhbsnsyWZYiTUay1qxiP
- TLSH T179043A56BD828E12C5C216BAFF5E828D33137BB8D3DE7113DD245F60338A59A0E7A512
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
reaver.arm6.elf
Resource
debian12-armhf-20260513-en
Malware Config
Targets
-
- Target reaver.arm6.elf
- Size 179KB
- SHA256 9d91a2692f7309ad560604580751fe76e0dc88d36c2f0fc1910201277496f67e
- MD5 4cb6f99db702cb524d8acdf26d740a40
- SHA1 876a87e7ac9cc3170d72342e66729bcc7b75c3e2
- SHA512 2e47273f8009720475c39c0689bb11bbae299613ca7aca47402aea20985134dfd6a05410d7a37c08308dbac64c2bebb5f87fc8ee66bd1c1cb9ebdf73e34bfbc7
- SSDEEP 3072:avYrxzJZwKP6pp7/TXLNbsnsy3GZz8UL9TwlaL21qximfG8wP+bMB3dum1v7APnC:avYmKP6pp7/TXhbsnsyWZYiTUay1qxiP
- TLSH T179043A56BD828E12C5C216BAFF5E828D33137BB8D3DE7113DD245F60338A59A0E7A512
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Deletes itself
-
Modifies the /etc/hosts DNS resolution file
Modifying the /etc/hosts name-resolution file changes IP routing, which can facilitate traffic hijacking or the blocking of (security update) endpoints.
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Creates/modifies environment variables
Creating/modifying environment variables is a common persistence mechanism.
-
Modifies systemd
Adds/ modifies systemd service files. Likely to achieve persistence.
-
Modifies Bash startup script
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
4XDG Autostart Entries
1Boot or Logon Initialization Scripts
2RC Scripts
2Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
4XDG Autostart Entries
1Boot or Logon Initialization Scripts
2RC Scripts
2Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Defense Evasion
Hijack Execution Flow
1Path Interception by PATH Environment Variable
1