General
- Target bot.arm.elf
- Size 990KB
- Sample260927-hapzqsaf26
- SHA256 3f1975a84c2596220ab35fff4627ff8f2300a36dc53d30a700addd72b00f1367
- MD5 04797521d7ffa74273f96f65a2fc7c77
- SHA1 cd0e61a1923a09c7ea59009620b7bfb234878536
- SHA512 cc26736f53ab7521adfb8094f73fcca7dcd4f9a85ba1be20b66765f56c1c992786bf7703a3c639addd9d1e7a175680b0ba94b6b8c64652eebfa6d4dfb9d34356
- SSDEEP 24576:+WmNVQHYP+SmAC+MqR9p4Wrii7j657yD/hGnmn:KdM4DmUj657yDAmn
- TLSH T176254C55F890DF63C9C46B7AFA5E82A833234778C3D7720699148B343B97A1F0B3A645
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
Behavioral task
behavioral1
Sample
bot.arm.elf
Resource
debian12-armhf-20260513-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target bot.arm.elf
- Size 990KB
- SHA256 3f1975a84c2596220ab35fff4627ff8f2300a36dc53d30a700addd72b00f1367
- MD5 04797521d7ffa74273f96f65a2fc7c77
- SHA1 cd0e61a1923a09c7ea59009620b7bfb234878536
- SHA512 cc26736f53ab7521adfb8094f73fcca7dcd4f9a85ba1be20b66765f56c1c992786bf7703a3c639addd9d1e7a175680b0ba94b6b8c64652eebfa6d4dfb9d34356
- SSDEEP 24576:+WmNVQHYP+SmAC+MqR9p4Wrii7j657yD/hGnmn:KdM4DmUj657yDAmn
- TLSH T176254C55F890DF63C9C46B7AFA5E82A833234778C3D7720699148B343B97A1F0B3A645
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10File and Directory Permissions Modification
Adversaries may modify file or directory permissions to evade defenses.
Checks hardware identifiers (DMI)
Checks DMI information which indicate if the system is a virtual machine.
Enumerates running processes
Discovers information about currently running processes on the system
Reads MAC address of network interface
Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.
MITRE ATT&CK Enterprise v16
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Virtualization/Sandbox Evasion
2System Checks
2