c6fa4048772cc44c866add859f20e2d68c9b2f4a3ccdd7bc51dc623984a0b998

Analysis

max time kernel
11088s
max time network
151s
platform
debian-9_armhf
resource
debian9-armhf-20221111-en
resource tags

arch:armhfimage:debian9-armhf-20221111-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
20-03-2023 01:43

Target

fee8ee25f2b29e61c565db5a9d5f75a668b87793e276cb1622f59f840ee1872a.elf
Size

146KB
MD5

dbed2a985fb620021ab88c326bdc098a
SHA1

05ae574c1da7bf41abcd18cd1846178488d2532e
SHA256

fee8ee25f2b29e61c565db5a9d5f75a668b87793e276cb1622f59f840ee1872a
SHA512

7b7af4d59f6c29c03e7686f14a6ddc4eecc8cb9da07c108983c8223ff41ac52529ce0637aea954e3a9a001df3b92bfb84b03cd95463aa9df55eb63bad81c5e9b
SSDEEP

3072:fuNaNpF4uVN++dkhnxuQennF4M/9OD4bNWkE1kmpwfvRQfZn:mNaNpF4+NChnkQennCM/9ekmpwfvafZn

Score

7^/10

Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.

System Network Configuration Discovery
T1016

Processes:

fee8ee25f2b29e61c565db5a9d5f75a668b87793e276cb1622f59f840ee1872a.elf

description ioc process

/proc/net/route /proc/net/route fee8ee25f2b29e61c565db5a9d5f75a668b87793e276cb1622f59f840ee1872a.elf
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery
T1016

Processes:

fee8ee25f2b29e61c565db5a9d5f75a668b87793e276cb1622f59f840ee1872a.elf

description ioc process

/proc/net/route /proc/net/route fee8ee25f2b29e61c565db5a9d5f75a668b87793e276cb1622f59f840ee1872a.elf

description	ioc	process
/proc/net/route	/proc/net/route	fee8ee25f2b29e61c565db5a9d5f75a668b87793e276cb1622f59f840ee1872a.elf

description	ioc	process
/proc/net/route	/proc/net/route	fee8ee25f2b29e61c565db5a9d5f75a668b87793e276cb1622f59f840ee1872a.elf

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact