General
- Target bot.armv6.elf
- Size 990KB
- Sample260930-e6mmpss13r
- SHA256 a8ec3432b30979327e26ef804d8014565240a5e3490690f305a0e4c9e15aa559
- MD5 25db836b235bd02ecd6f8fbce6c20ded
- SHA1 73815fb45162ab100168ee03737723f76d2e782c
- SHA512 8543367f775260208cfd726a14026c8671ffccb64a4ab175224e880eb0e45a44bd570d81f97352b39d2c9fb0f3079030e59b65ec2661bb9facaae1738b2c499f
- SSDEEP 24576:+WmNVQHYP+SmAC+MqR9p4Wrii7j657yD/hGnmh:KdM4DmUj657yDAmh
- TLSH T129254C55F890DF63C9C46B7AFA5E82A833234778C3D7720699148B343B97A1F0B3A645
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
Behavioral task
behavioral1
Sample
bot.armv6.elf
Resource
debian12-armhf-20260127-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target bot.armv6.elf
- Size 990KB
- SHA256 a8ec3432b30979327e26ef804d8014565240a5e3490690f305a0e4c9e15aa559
- MD5 25db836b235bd02ecd6f8fbce6c20ded
- SHA1 73815fb45162ab100168ee03737723f76d2e782c
- SHA512 8543367f775260208cfd726a14026c8671ffccb64a4ab175224e880eb0e45a44bd570d81f97352b39d2c9fb0f3079030e59b65ec2661bb9facaae1738b2c499f
- SSDEEP 24576:+WmNVQHYP+SmAC+MqR9p4Wrii7j657yD/hGnmh:KdM4DmUj657yDAmh
- TLSH T129254C55F890DF63C9C46B7AFA5E82A833234778C3D7720699148B343B97A1F0B3A645
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
File and Directory Permissions Modification
Adversaries may modify file or directory permissions to evade defenses.
-
Checks hardware identifiers (DMI)
Checks DMI information which indicate if the system is a virtual machine.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads MAC address of network interface
Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.
MITRE ATT&CK Enterprise v16
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Virtualization/Sandbox Evasion
2System Checks
2