b4ca701c5b421f5dc01156234fc0bd96f859394fa6f1cdfd5c71e990f3d906e8

Analysis

max time kernel
10816s
max time network
151s
platform
debian-9_armhf
resource
debian9-armhf-20221111-en
resource tags

arch:armhfimage:debian9-armhf-20221111-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
16-03-2023 21:56

Target

1644cb4cd17f741805607d0bad38e89e.elf
Size

116KB
MD5

1644cb4cd17f741805607d0bad38e89e
SHA1

182a92aae4684ec774ea10e8d464851f36ffefd1
SHA256

b4ca701c5b421f5dc01156234fc0bd96f859394fa6f1cdfd5c71e990f3d906e8
SHA512

de9365a6f06dcb50777edb4d0349a9a6a6d3c79b6ce76d33be77b0fe0afd0aa4f298240fa516a6caa774a5cf54c239b91d1694692fc416a4bb136a2edb60283a
SSDEEP

3072:idwracAAviNmLpMQ1xM5hKHKSrbqlAdmyDQUJ1UX4Tn:SwraFgikxM5hKHKnlAdmyDQUJ1a4Tn

Score

7^/10

Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.

System Network Configuration Discovery
T1016

Processes:

1644cb4cd17f741805607d0bad38e89e.elf

description ioc process

/proc/net/route /proc/net/route 1644cb4cd17f741805607d0bad38e89e.elf
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery
T1016

Processes:

1644cb4cd17f741805607d0bad38e89e.elf

description ioc process

/proc/net/route /proc/net/route 1644cb4cd17f741805607d0bad38e89e.elf

description	ioc	process
/proc/net/route	/proc/net/route	1644cb4cd17f741805607d0bad38e89e.elf

description	ioc	process
/proc/net/route	/proc/net/route	1644cb4cd17f741805607d0bad38e89e.elf

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact