aff3488907b7ddc6a9bbc8819d38749e51a59a0ab798d646205690b3926fda75

Analysis

max time kernel
11594s
max time network
127s
platform
debian-9_armhf
resource
debian9-armhf-20221111-en
resource tags

arch:armhfimage:debian9-armhf-20221111-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
25-03-2023 22:10

Target

b6277f26479bccae7ddf6e920f6dfd52.elf
Size

108KB
MD5

b6277f26479bccae7ddf6e920f6dfd52
SHA1

645a6a2dc38b327ee57d7fabe756e72feeb3e15d
SHA256

aff3488907b7ddc6a9bbc8819d38749e51a59a0ab798d646205690b3926fda75
SHA512

7b651fc39acf2fbfb266af30261205521a120a81fc5a52b01ca3b5e98d15a276e83899730122a48aba4274c359bafdda8105e706e2a38c83e10ba7b500222eac
SSDEEP

3072:b6an17WtsWhdgYJ70D6mbPbmTQOWsXAOn:Wan17WPJ70D6ibmTQOWCAOn

Score

7^/10

Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.

System Network Configuration Discovery
T1016

Processes:

b6277f26479bccae7ddf6e920f6dfd52.elf

description ioc process

/proc/net/route /proc/net/route b6277f26479bccae7ddf6e920f6dfd52.elf
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery
T1016

Processes:

b6277f26479bccae7ddf6e920f6dfd52.elf

description ioc process

/proc/net/route /proc/net/route b6277f26479bccae7ddf6e920f6dfd52.elf

description	ioc	process
/proc/net/route	/proc/net/route	b6277f26479bccae7ddf6e920f6dfd52.elf

description	ioc	process
/proc/net/route	/proc/net/route	b6277f26479bccae7ddf6e920f6dfd52.elf

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact