General
- Target reaver.arm6.elf
- Size 73KB
- Sample260905-df8xksdp7z
- SHA256 758a76168bef9ed2c5c164cdfa1d8baa2937ed0ea94a3cfe7d79f576da259fa9
- MD5 3218f1ec42ef82102c7405ec227f4927
- SHA1 763e5966959ffa94f1cedf4de5a4c988cd2330fe
- SHA512 df272fdf4c7bea37573a947865457cb69cb35e60224711e0d5c7ef60c9c636e61cec60910759f4fe38a675c150ce896fc45700b0da005701e5d821e40abaf23a
- SSDEEP 1536:zzLsdFnBX77dwp8w3cc7AuDKdL/qKhNiiR7OZo/HJfK:LofX1iZnAzNiiR7m4HJC
- TLSH T1717302D0AA495DE5C23432AAE5B496422748D7710E7AB73F0590A7E8C9F4E3A79F0C0C
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
reaver.arm6.elf
Resource
debian12-armhf-20260127-en
Malware Config
Targets
-
- Target reaver.arm6.elf
- Size 73KB
- SHA256 758a76168bef9ed2c5c164cdfa1d8baa2937ed0ea94a3cfe7d79f576da259fa9
- MD5 3218f1ec42ef82102c7405ec227f4927
- SHA1 763e5966959ffa94f1cedf4de5a4c988cd2330fe
- SHA512 df272fdf4c7bea37573a947865457cb69cb35e60224711e0d5c7ef60c9c636e61cec60910759f4fe38a675c150ce896fc45700b0da005701e5d821e40abaf23a
- SSDEEP 1536:zzLsdFnBX77dwp8w3cc7AuDKdL/qKhNiiR7OZo/HJfK:LofX1iZnAzNiiR7m4HJC
- TLSH T1717302D0AA495DE5C23432AAE5B496422748D7710E7AB73F0590A7E8C9F4E3A79F0C0C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Deletes itself
-
Modifies the /etc/hosts DNS resolution file
Modifying the /etc/hosts name-resolution file changes IP routing, which can facilitate traffic hijacking or the blocking of (security update) endpoints.
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Creates/modifies environment variables
Creating/modifying environment variables is a common persistence mechanism.
-
Modifies systemd
Adds/ modifies systemd service files. Likely to achieve persistence.
-
Modifies Bash startup script
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
4XDG Autostart Entries
1Boot or Logon Initialization Scripts
2RC Scripts
2Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
4XDG Autostart Entries
1Boot or Logon Initialization Scripts
2RC Scripts
2Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1