General
- Target armv7l
- Size 5.6MB
- Sample261107-ple28seg99
- SHA256 9e6da804ae9ca0a07348e92d99416bcf3fc650ccbdf4a9b4db34f6d546ddfb10
- MD5 11076219a14ba827ee25090aba0a815e
- SHA1 0b4c7b6c993e077fefce82de438b3f9a79de81dc
- SHA512 3606e20eed34c282d5186b544c042abf5902a92a8b9269da207824eee9e705d730cecdb23afb599ef6514f1c662e71623f84e2e2c693fa30cb8946f4fdf8f509
- SSDEEP 49152:/XZ+XAbwEG843Zceve8HWRpDU2uXK1eH/aymrQMGJjoV5EK:/XuC43588XK1eH/a5rQt+rEK
- TLSH T1AA560887B8924942C4E43A77B9BE81C433634EBA9BC653566D05FE3C3ABE1D90E35314
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
armv7l
Resource
debian12-armhf-20260513-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target armv7l
- Size 5.6MB
- SHA256 9e6da804ae9ca0a07348e92d99416bcf3fc650ccbdf4a9b4db34f6d546ddfb10
- MD5 11076219a14ba827ee25090aba0a815e
- SHA1 0b4c7b6c993e077fefce82de438b3f9a79de81dc
- SHA512 3606e20eed34c282d5186b544c042abf5902a92a8b9269da207824eee9e705d730cecdb23afb599ef6514f1c662e71623f84e2e2c693fa30cb8946f4fdf8f509
- SSDEEP 49152:/XZ+XAbwEG843Zceve8HWRpDU2uXK1eH/aymrQMGJjoV5EK:/XuC43588XK1eH/a5rQt+rEK
- TLSH T1AA560887B8924942C4E43A77B9BE81C433634EBA9BC653566D05FE3C3ABE1D90E35314
- MD5 SHA1 SHA512 SSDEEP TLSH
Creates/modifies environment variables
Creating/modifying environment variables is a common persistence mechanism.
Write file to user bin folder
Modifies Bash startup script
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Privilege Escalation
Boot or Logon Autostart Execution
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1