General
- Target arm.elf
- Size 4.6MB
- Sample260909-rr3ftswhlf
- SHA256 ff0944aa6c41f4960f3bc64c34a0a245d37fb6d665aa455c2852f4d4355b2af2
- MD5 f00e97dd800881e7d9e79cd3a0e47a9f
- SHA1 90ac7c49f5c33b5e69dec3a46683292d50b35b09
- SHA512 c3b6e273f35be05a6f04168014a72f27f30a172cf492adb75792294765e441f9098972e80dc68d96927e7951345d9f3686ca1149d7a4a0855153e248fed0a786
- SSDEEP 24576:2B3qLam87be+o9Ylfwks9hc4XSu3+eVyVPc5jYnUGvFlzYij/h8pgNExsix67E5Z:266FkUPp6P+gb82ieaoYRr4DSg
- TLSH T16D260997B8924983C4E42676BCBE80C433635EFA9B9753566D04FE3C3ABE1990E35704
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
arm.elf
Resource
debian12-armhf-20260513-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target arm.elf
- Size 4.6MB
- SHA256 ff0944aa6c41f4960f3bc64c34a0a245d37fb6d665aa455c2852f4d4355b2af2
- MD5 f00e97dd800881e7d9e79cd3a0e47a9f
- SHA1 90ac7c49f5c33b5e69dec3a46683292d50b35b09
- SHA512 c3b6e273f35be05a6f04168014a72f27f30a172cf492adb75792294765e441f9098972e80dc68d96927e7951345d9f3686ca1149d7a4a0855153e248fed0a786
- SSDEEP 24576:2B3qLam87be+o9Ylfwks9hc4XSu3+eVyVPc5jYnUGvFlzYij/h8pgNExsix67E5Z:266FkUPp6P+gb82ieaoYRr4DSg
- TLSH T16D260997B8924983C4E42676BCBE80C433635EFA9B9753566D04FE3C3ABE1990E35704
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Creates/modifies environment variables
Creating/modifying environment variables is a common persistence mechanism.
-
Write file to user bin folder
-
Modifies Bash startup script
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Privilege Escalation
Boot or Logon Autostart Execution
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1