General
- Target armv7l.elf
- Size 4.9MB
- Sample261003-v7dn7atdna
- SHA256 6067a3e0d7fcb640a32537ce4bddc3822243ab000bed4dba2c1869ece866c493
- MD5 508d1f43e937925f118f5bfa5256fa02
- SHA1 827dc19efb9e31ba74249bd34465ae3189b96901
- SHA512 6d00f359a0156008857298c9b2de8def5609272029d073a693b93615a100975c1323ca39e2aaefaa5e578eacdf0bae53f2593a12591cdfa18f52527183c148a3
- SSDEEP 24576:TYvsvwDoWYCx7whUSWKzLdsF3gofJmAKQziIltGBN7JLrOIGeVkyA2fSLa3zbiOD:0Dp5VwuUiEoatGisBVSjRyBTuD
- TLSH T13D361957B8924A82C4E43637BCBD81C433A74EB99B9712676D04FE3C3ABE5990E35314
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
armv7l.elf
Resource
debian12-armhf-20260513-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target armv7l.elf
- Size 4.9MB
- SHA256 6067a3e0d7fcb640a32537ce4bddc3822243ab000bed4dba2c1869ece866c493
- MD5 508d1f43e937925f118f5bfa5256fa02
- SHA1 827dc19efb9e31ba74249bd34465ae3189b96901
- SHA512 6d00f359a0156008857298c9b2de8def5609272029d073a693b93615a100975c1323ca39e2aaefaa5e578eacdf0bae53f2593a12591cdfa18f52527183c148a3
- SSDEEP 24576:TYvsvwDoWYCx7whUSWKzLdsF3gofJmAKQziIltGBN7JLrOIGeVkyA2fSLa3zbiOD:0Dp5VwuUiEoatGisBVSjRyBTuD
- TLSH T13D361957B8924A82C4E43637BCBD81C433A74EB99B9712676D04FE3C3ABE5990E35314
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Creates/modifies environment variables
Creating/modifying environment variables is a common persistence mechanism.
-
Write file to user bin folder
-
Modifies Bash startup script
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Privilege Escalation
Boot or Logon Autostart Execution
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1