General
- Target arm
- Size 4.9MB
- Sample261007-aqsfsshb49
- SHA256 1a72b7c1209843a124886d25d8db002e7e0a27878c43d5194910af2c229b5530
- MD5 24126eca2af0a76689d4c0dc4047e336
- SHA1 dcab2d65dbca0f8e0e6e25d8b93596c282c610cd
- SHA512 7ebcb987a3c8c8015badcae39c5bbcfd717e930e1e43ab336310cbed94140cff79b33d00aa4af704ea46da3c8e1320319e7f68a8823d61da380884d4eafef7f6
- SSDEEP 24576:Cc4SYRCL58wMKV8Vim7MEVLNuhT0FQP7YzhkaRucMLHTadVaSHH1I7idT6z34OCt:CCdi0bCm6YHKAoggU+yjZyBTDfR
- TLSH T120361A97B9914A83C4E43637BCBE81C433A74EB99B9712665D04FE3C3ABE5990E35304
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
arm
Resource
debian12-armhf-20260513-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target arm
- Size 4.9MB
- SHA256 1a72b7c1209843a124886d25d8db002e7e0a27878c43d5194910af2c229b5530
- MD5 24126eca2af0a76689d4c0dc4047e336
- SHA1 dcab2d65dbca0f8e0e6e25d8b93596c282c610cd
- SHA512 7ebcb987a3c8c8015badcae39c5bbcfd717e930e1e43ab336310cbed94140cff79b33d00aa4af704ea46da3c8e1320319e7f68a8823d61da380884d4eafef7f6
- SSDEEP 24576:Cc4SYRCL58wMKV8Vim7MEVLNuhT0FQP7YzhkaRucMLHTadVaSHH1I7idT6z34OCt:CCdi0bCm6YHKAoggU+yjZyBTDfR
- TLSH T120361A97B9914A83C4E43637BCBE81C433A74EB99B9712665D04FE3C3ABE5990E35304
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Creates/modifies environment variables
Creating/modifying environment variables is a common persistence mechanism.
-
Write file to user bin folder
-
Modifies Bash startup script
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Privilege Escalation
Boot or Logon Autostart Execution
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1