d10e417a5e8c61a4a9c3e72b1779a88e2e08de78b0b0bccad2e0c77b030a5277

Analysis

max time kernel
0s
max time network
151s
platform
debian-9_armhf
resource
debian9-armhf-20221111-en
resource tags

arch:armhfimage:debian9-armhf-20221111-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
19-03-2023 10:57

Target

57425317483f680d06eeeaee0fb63410.elf
Size

116KB
MD5

57425317483f680d06eeeaee0fb63410
SHA1

17014c3f79a2906efd3ebc99e0a6ea8492d95724
SHA256

d10e417a5e8c61a4a9c3e72b1779a88e2e08de78b0b0bccad2e0c77b030a5277
SHA512

c63465719bc6dbf32cc87158177e4da30bc13925cf1a62e826f3d96e13811421c9b0b8ff8e9a4305b171b9430e27eedd280add58f173cd35d0ff0228307324ec
SSDEEP

3072:ed3Da04A7iNmLJMQJBO5hd5Kynz2FAdmyDQUJ1UX4Tn:G3Da1ciABO5hd5K3FAdmyDQUJ1a4Tn

Score

7^/10

Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.

System Network Configuration Discovery
T1016

Processes:

57425317483f680d06eeeaee0fb63410.elf

description ioc process

/proc/net/route /proc/net/route 57425317483f680d06eeeaee0fb63410.elf
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery
T1016

Processes:

57425317483f680d06eeeaee0fb63410.elf

description ioc process

/proc/net/route /proc/net/route 57425317483f680d06eeeaee0fb63410.elf

description	ioc	process
/proc/net/route	/proc/net/route	57425317483f680d06eeeaee0fb63410.elf

description	ioc	process
/proc/net/route	/proc/net/route	57425317483f680d06eeeaee0fb63410.elf

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact