299e7acc1cad7d71657b85224898ace9a5410e97feca816822a8b01cc8210183

Analysis

max time kernel
0s
max time network
134s
platform
debian-9_armhf
resource
debian9-armhf-20221111-en
resource tags

arch:armhfimage:debian9-armhf-20221111-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
21-03-2023 14:36

Target

897be69cd16a7d84c1ad288a4d5a98c394654c44f629423af9d06e5752e812ab.elf
Size

108KB
MD5

cf42dff402928f5e331496099bc14f9d
SHA1

cd355a387c855e5cbccc31668b9b6d8d6baee2d5
SHA256

897be69cd16a7d84c1ad288a4d5a98c394654c44f629423af9d06e5752e812ab
SHA512

441926cbfaab66f8a964e7a42a95aaabc83d10dbb91e432fa7400e081d58f931f79c954d79e99801dc326033530ff58d109c8a59282546d42a05e1080a8ede91
SSDEEP

3072:b6an17WtsWhdgYJH0D6mbPbmTQOWsXAOn:Wan17WPJH0D6ibmTQOWCAOn

Score

7^/10

Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.

System Network Configuration Discovery
T1016

Processes:

897be69cd16a7d84c1ad288a4d5a98c394654c44f629423af9d06e5752e812ab.elf

description ioc process

/proc/net/route /proc/net/route 897be69cd16a7d84c1ad288a4d5a98c394654c44f629423af9d06e5752e812ab.elf
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery
T1016

Processes:

897be69cd16a7d84c1ad288a4d5a98c394654c44f629423af9d06e5752e812ab.elf

description ioc process

/proc/net/route /proc/net/route 897be69cd16a7d84c1ad288a4d5a98c394654c44f629423af9d06e5752e812ab.elf

description	ioc	process
/proc/net/route	/proc/net/route	897be69cd16a7d84c1ad288a4d5a98c394654c44f629423af9d06e5752e812ab.elf

description	ioc	process
/proc/net/route	/proc/net/route	897be69cd16a7d84c1ad288a4d5a98c394654c44f629423af9d06e5752e812ab.elf

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact