General
- Target wife.arm7.elf
- Size 73KB
- Sample261001-str9baxzex
- SHA256 a5b40d58f388618d27af28355282629cf54f3d3cd69a1020846c36d1186a9a3e
- MD5 3f8ff8cddd7e0b0ea9f928d782c3f47f
- SHA1 0cc00bbc60db4a781a31a6f7acbdf5f21758475a
- SHA512 e526713a226d91bdfb3818a7d1ff93d13f777ec0ace450783beab19813ba11eceae5b47f1180ef9d7d2bd099181aeb6a25a2ade056be927a16cac1778f157508
- SSDEEP 1536:7fg5Q6ZQOKEZEmwni4CxZBdVDkbC7zjk+8mtvS3jIHrVp5MXZ4b6VMmk:kuLOKSEmX4UbD/7B8mAjOqZjfk
- TLSH T17E73127462498A728655BE73983BD2B093274DEF90BC7361394D6F3CB4830EF48A15E8
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
wife.arm7.elf
Resource
debian12-armhf-20260127-en
Malware Config
Targets
-
- Target wife.arm7.elf
- Size 73KB
- SHA256 a5b40d58f388618d27af28355282629cf54f3d3cd69a1020846c36d1186a9a3e
- MD5 3f8ff8cddd7e0b0ea9f928d782c3f47f
- SHA1 0cc00bbc60db4a781a31a6f7acbdf5f21758475a
- SHA512 e526713a226d91bdfb3818a7d1ff93d13f777ec0ace450783beab19813ba11eceae5b47f1180ef9d7d2bd099181aeb6a25a2ade056be927a16cac1778f157508
- SSDEEP 1536:7fg5Q6ZQOKEZEmwni4CxZBdVDkbC7zjk+8mtvS3jIHrVp5MXZ4b6VMmk:kuLOKSEmX4UbD/7B8mAjOqZjfk
- TLSH T17E73127462498A728655BE73983BD2B093274DEF90BC7361394D6F3CB4830EF48A15E8
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Deletes itself
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Creates/modifies environment variables
Creating/modifying environment variables is a common persistence mechanism.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Modifies systemd
Adds/ modifies systemd service files. Likely to achieve persistence.
-
Write file to user bin folder
-
Modifies Bash startup script
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
4XDG Autostart Entries
1Boot or Logon Initialization Scripts
2RC Scripts
2Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
4XDG Autostart Entries
1Boot or Logon Initialization Scripts
2RC Scripts
2Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1