General
- Target bot.armv6.elf
- Size 989KB
- Sample260929-3f4ejazarc
- SHA256 81d379886c5150eaa2973cbfd26e55069a2edfb65da7691f750d3a12a821484b
- MD5 0f742a6e8e5265c38b5255a8ad5ef79f
- SHA1 6efef8eb95febd85cd485c4b05a0994283c7f1b5
- SHA512 04e488b0f085f9633aa546ac036aa316b9cf7356e289bc44c2b526c37ec7f0a157c2db589f250dee8f5dbfcede66dfc702759ada335f2efd0699f05acc70a73b
- SSDEEP 24576:+WmNVQHYP+SmAC+MqR9p4Wrii7j657yD/hGnmI:KdM4DmUj657yDAmI
- TLSH T13F254C55F890DF63C9C46B7AFA5E82A833234778C3D7720699148B343B97A1F0B3A645
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
Behavioral task
behavioral1
Sample
bot.armv6.elf
Resource
debian12-armhf-20260513-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target bot.armv6.elf
- Size 989KB
- SHA256 81d379886c5150eaa2973cbfd26e55069a2edfb65da7691f750d3a12a821484b
- MD5 0f742a6e8e5265c38b5255a8ad5ef79f
- SHA1 6efef8eb95febd85cd485c4b05a0994283c7f1b5
- SHA512 04e488b0f085f9633aa546ac036aa316b9cf7356e289bc44c2b526c37ec7f0a157c2db589f250dee8f5dbfcede66dfc702759ada335f2efd0699f05acc70a73b
- SSDEEP 24576:+WmNVQHYP+SmAC+MqR9p4Wrii7j657yD/hGnmI:KdM4DmUj657yDAmI
- TLSH T13F254C55F890DF63C9C46B7AFA5E82A833234778C3D7720699148B343B97A1F0B3A645
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
File and Directory Permissions Modification
Adversaries may modify file or directory permissions to evade defenses.
-
Checks hardware identifiers (DMI)
Checks DMI information which indicate if the system is a virtual machine.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads MAC address of network interface
Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.
MITRE ATT&CK Enterprise v16
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Virtualization/Sandbox Evasion
2System Checks
2