fee8ee25f2b29e61c565db5a9d5f75a668b87793e276cb1622f59f840ee1872a

Analysis

max time kernel
0s
max time network
124s
platform
linux_armhf
resource
debian9-armhf-en-20211208
resource tags

arch:armhfimage:debian9-armhf-en-20211208kernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
18-03-2023 18:15

Target

dbed2a985fb620021ab88c326bdc098a.elf
Size

146KB
MD5

dbed2a985fb620021ab88c326bdc098a
SHA1

05ae574c1da7bf41abcd18cd1846178488d2532e
SHA256

fee8ee25f2b29e61c565db5a9d5f75a668b87793e276cb1622f59f840ee1872a
SHA512

7b7af4d59f6c29c03e7686f14a6ddc4eecc8cb9da07c108983c8223ff41ac52529ce0637aea954e3a9a001df3b92bfb84b03cd95463aa9df55eb63bad81c5e9b
SSDEEP

3072:fuNaNpF4uVN++dkhnxuQennF4M/9OD4bNWkE1kmpwfvRQfZn:mNaNpF4+NChnkQennCM/9ekmpwfvafZn

Score

7^/10

Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.

System Network Configuration Discovery
T1016

Processes:

dbed2a985fb620021ab88c326bdc098a.elf

description ioc process

/proc/net/route /proc/net/route dbed2a985fb620021ab88c326bdc098a.elf
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery
T1016

Processes:

dbed2a985fb620021ab88c326bdc098a.elf

description ioc process

/proc/net/route /proc/net/route dbed2a985fb620021ab88c326bdc098a.elf

description	ioc	process
/proc/net/route	/proc/net/route	dbed2a985fb620021ab88c326bdc098a.elf

description	ioc	process
/proc/net/route	/proc/net/route	dbed2a985fb620021ab88c326bdc098a.elf

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact