Analysis
-
max time kernel
11409s -
max time network
152s -
platform
debian-9_armhf -
resource
debian9-armhf-20221111-en -
resource tags
-
submitted
23-03-2023 18:48
General
-
Target
9e700ff21dad4f0419bb6ed2efe576c5.elf
-
Size
146KB
-
MD5
9e700ff21dad4f0419bb6ed2efe576c5
-
SHA1
9d06927c7c5dd944fc14201bd9a1618d50104c99
-
SHA256
32945940c80b3a743799b7583521be18f29bb1ee2bafd57ebd9508bf51121235
-
SHA512
5b036cbe775c6e619066ef57700c644d5c52bc1dcd51ef5e8fb6f88af81412417e7b73dc71947aa95c0746deee9b221e8bec688081c320e72c1d5fcfd43fa3a6
-
SSDEEP
3072:fuNaNpF4uVN++dkhnx0QennF4M/9OD4bNWkE1kmpwfvRQfZn:mNaNpF4+NChnGQennCM/9ekmpwfvafZn
Score
9/10
Malware Config
Signatures
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes
-
/tmp/9e700ff21dad4f0419bb6ed2efe576c5.elf/tmp/9e700ff21dad4f0419bb6ed2efe576c5.elf1⤵
- Reads system routing table
- Reads system network configuration