General
- Target bot.armv7.elf
- Size 991KB
- Sample260930-prappswshw
- SHA256 5efca2220ee28a5ed537bda884ed3bcbd7cd5ba0428133bf0e1498bef8283d5f
- MD5 c7230c0f2a8eef90b955719d5aa893ab
- SHA1 9f37a30487a1d1403dfdae92103e6fe55dc9eaa8
- SHA512 a10cbd2782fcf2b078df76993871862e36f1a6c46e2c482f26501fca9f3ef5a3723cd0b9f00fcc4f8c24f162d3f4111a2ab60113266fa388518dc772c0364e1a
- SSDEEP 24576:+WmNVQHYP+SmAC+MqR9p4Wrii7j657yD/hGnmG:KdM4DmUj657yDAmG
- TLSH T1A0254C55F890DF63C9C46B7AFA5E82A833234778C3D7720699148B343B97A1F0B3A645
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
Behavioral task
behavioral1
Sample
bot.armv7.elf
Resource
debian12-armhf-20260513-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target bot.armv7.elf
- Size 991KB
- SHA256 5efca2220ee28a5ed537bda884ed3bcbd7cd5ba0428133bf0e1498bef8283d5f
- MD5 c7230c0f2a8eef90b955719d5aa893ab
- SHA1 9f37a30487a1d1403dfdae92103e6fe55dc9eaa8
- SHA512 a10cbd2782fcf2b078df76993871862e36f1a6c46e2c482f26501fca9f3ef5a3723cd0b9f00fcc4f8c24f162d3f4111a2ab60113266fa388518dc772c0364e1a
- SSDEEP 24576:+WmNVQHYP+SmAC+MqR9p4Wrii7j657yD/hGnmG:KdM4DmUj657yDAmG
- TLSH T1A0254C55F890DF63C9C46B7AFA5E82A833234778C3D7720699148B343B97A1F0B3A645
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
File and Directory Permissions Modification
Adversaries may modify file or directory permissions to evade defenses.
-
Checks hardware identifiers (DMI)
Checks DMI information which indicate if the system is a virtual machine.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads MAC address of network interface
Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.
MITRE ATT&CK Enterprise v16
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Virtualization/Sandbox Evasion
2System Checks
2