799829e62c09618ba06f20a25c39a1ed6e783d957bc8c50a28141ecd48b12d9a

Analysis

max time kernel
0s
max time network
147s
platform
linux_armhf
resource
debian9-armhf-en-20211208
resource tags

arch:armhfimage:debian9-armhf-en-20211208kernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
23-11-2022 15:33

Target

frpc
Size

10.1MB
MD5

4461c0bb8fa2fd111167957269cdad83
SHA1

7db5ab286212fc855c17645fb76a177a3cfa5a34
SHA256

799829e62c09618ba06f20a25c39a1ed6e783d957bc8c50a28141ecd48b12d9a
SHA512

93536166dd3845607ca18bdbb8cc6c5409518f3eca91779a9dcc5b1a31609b7514fecaa7338a89e27633cb265da3cefa0d14cd49b2100261c0e98a8ac885590c
SSDEEP

49152:SxJpaqYRIG9/a1mI36vlrDDJvtEnZuOxCYsF7NNTTI05+jvBZrpntyEPgv+dfBrZ:MJpapRIG5a1Te3snv2xYFptyYEWHD5H

Score

5^/10

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery
T1082

Processes:

frpc

description ioc process

/sys/kernel/mm/transparent_hugepage/hpage_pmd_size /sys/kernel/mm/transparent_hugepage/hpage_pmd_size frpc

description	ioc	process
/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	frpc

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact