a03a2fe66670904431446850e72b20772a7a8e6430aa08027657d37cb55ee2fa

Analysis

max time kernel
11607s
max time network
171s
platform
debian-9_armhf
resource
debian9-armhf-20221111-en
resource tags

arch:armhfimage:debian9-armhf-20221111-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
26-03-2023 01:52

Target

2b318c6894e66a3e8f3abe92eaf92b181fbc4b41998ce6a2081b72582bf8b773.elf
Size

186KB
MD5

b90a31739039f3ed6e44f9e9c52fc6a3
SHA1

9e6966788ce00c8e39f9728809d723792755d6cb
SHA256

2b318c6894e66a3e8f3abe92eaf92b181fbc4b41998ce6a2081b72582bf8b773
SHA512

a66346d7af96da584903b7a0c0f9c1091301ddb47a9620eca76508e907f515dd495502a01a518a5eb47064ae2157ce655ded0dbc376c2526a1b9d73b89a75fb7
SSDEEP

3072:Ocdy+00aGdyk8Gr3j0TCi1SH5hbzon3nYM/92wmYwTBFqQXSn:vyl0aGdykTrqCia5hbzon3YM/92wmYwc

Score

7^/10

Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.

System Network Configuration Discovery
T1016

Processes:

2b318c6894e66a3e8f3abe92eaf92b181fbc4b41998ce6a2081b72582bf8b773.elf

description ioc process

/proc/net/route /proc/net/route 2b318c6894e66a3e8f3abe92eaf92b181fbc4b41998ce6a2081b72582bf8b773.elf
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery
T1016

Processes:

2b318c6894e66a3e8f3abe92eaf92b181fbc4b41998ce6a2081b72582bf8b773.elf

description ioc process

/proc/net/route /proc/net/route 2b318c6894e66a3e8f3abe92eaf92b181fbc4b41998ce6a2081b72582bf8b773.elf

description	ioc	process
/proc/net/route	/proc/net/route	2b318c6894e66a3e8f3abe92eaf92b181fbc4b41998ce6a2081b72582bf8b773.elf

description	ioc	process
/proc/net/route	/proc/net/route	2b318c6894e66a3e8f3abe92eaf92b181fbc4b41998ce6a2081b72582bf8b773.elf

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact