ad01a843ec5fcaa5ac6bbd6a6e633adde6d3f8d7730427410a711a406b44ff7a

Analysis

max time kernel
0s
max time network
151s
platform
linux_armhf
resource
debian9-armhf-en-20211208
resource tags

arch:armhfimage:debian9-armhf-en-20211208kernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
17-03-2023 07:07

Target

b4ca701c5b421f5dc01156234fc0bd96f859394fa6f1cdfd5c71e990f3d906e8.elf
Size

116KB
MD5

1644cb4cd17f741805607d0bad38e89e
SHA1

182a92aae4684ec774ea10e8d464851f36ffefd1
SHA256

b4ca701c5b421f5dc01156234fc0bd96f859394fa6f1cdfd5c71e990f3d906e8
SHA512

de9365a6f06dcb50777edb4d0349a9a6a6d3c79b6ce76d33be77b0fe0afd0aa4f298240fa516a6caa774a5cf54c239b91d1694692fc416a4bb136a2edb60283a
SSDEEP

3072:idwracAAviNmLpMQ1xM5hKHKSrbqlAdmyDQUJ1UX4Tn:SwraFgikxM5hKHKnlAdmyDQUJ1a4Tn

Score

7^/10

Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.

System Network Configuration Discovery
T1016

Processes:

b4ca701c5b421f5dc01156234fc0bd96f859394fa6f1cdfd5c71e990f3d906e8.elf

description ioc process

/proc/net/route /proc/net/route b4ca701c5b421f5dc01156234fc0bd96f859394fa6f1cdfd5c71e990f3d906e8.elf
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery
T1016

Processes:

b4ca701c5b421f5dc01156234fc0bd96f859394fa6f1cdfd5c71e990f3d906e8.elf

description ioc process

/proc/net/route /proc/net/route b4ca701c5b421f5dc01156234fc0bd96f859394fa6f1cdfd5c71e990f3d906e8.elf

description	ioc	process
/proc/net/route	/proc/net/route	b4ca701c5b421f5dc01156234fc0bd96f859394fa6f1cdfd5c71e990f3d906e8.elf

description	ioc	process
/proc/net/route	/proc/net/route	b4ca701c5b421f5dc01156234fc0bd96f859394fa6f1cdfd5c71e990f3d906e8.elf

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact