Overview

overview

6

Static

static

1

kushnet.arm6.elf

debian-12-armhf

6

Analysis

  • max time kernel
    5s
  • max time network
    153s
  • platform
    debian-12_armhf
  • resource
    debian12-armhf-20260127-en
  • resource tags

    arch:armhfimage:debian12-armhf-20260127-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
  • submitted
    01/10/2026, 12:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    kushnet.arm6.elf
  • Size 197KB
  • Sample261001-prd25atfpf
  • SHA256 08593e0e9821fe991a7d706791429fc4da3b38d7581627948051edce5b69edba
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Modifies init.d 2 TTPs 1 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Changes its process name 4 IoCs
  • Reads runtime system information 1 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/kushnet.arm6.elf
    /tmp/kushnet.arm6.elf
    1⤵
    • Creates/modifies Cron job
    • Modifies init.d
    • Changes its process name
    PID:776
    • /bin/sh
      /bin/sh -c "update-rc.d S99ksync defaults 2>/dev/null || chkconfig --add S99ksync 2>/dev/null || insserv S99ksync 2>/dev/null"
      2⤵
        PID:786
        • /usr/sbin/update-rc.d
          update-rc.d S99ksync defaults
          3⤵
            PID:789
            • /bin/systemctl
              systemctl daemon-reload
              4⤵
              • Reads runtime system information
              PID:808

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            ksync
            • Path /etc/cron.d/ksync
            • Size 148B
            • SHA256 6c80fcf8df75331fe4c04efe5e1f4558bfb22159d74cfae21838c861ed17b19b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            S99ksync
            • Path /etc/init.d/S99ksync
            • Size 438B
            • SHA256 7eaa783f3f47db771efd15bb7471d1f90ba86e1eba37df872aa5c938f094af40
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            epsteins.emails
            • Path /root/epsteins.emails
            • Size 12B
            • SHA256 050bafadc0f2eb8e9a395699a0e8edf8a109476e9fdc99183fe2f99a03dd9353
            • MD5 SHA1 SHA512
            Submit Download