47bee2e3d9bc2c9e8e7b162e20896d15f295d095438dd4bae89efbd9fabef977

Analysis

max time kernel
12357s
max time network
151s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20221111-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20221111-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
03-04-2023 18:55

Target

x-8.6-.Hellfire.elf
Size

102KB
MD5

c2bd76e251e8bb0c23aeaddc29cc9009
SHA1

ae90fc5754e5c2913bbab2e57948fb91163de6ae
SHA256

47bee2e3d9bc2c9e8e7b162e20896d15f295d095438dd4bae89efbd9fabef977
SHA512

5ecb7864ea4b7d24fc624a0f8d11f41600358489f830c384f0e0bce095eb12da6f1bca74a53aec82f1e2fbe72cca2ecab8783dfca44b03cf47e2858fcd61714f
SSDEEP

3072:Nkzqmj28SfJ4NLLBDtCJSgDoGum/KWOXA7aZYpe:18SfJ4VxADoGum/KWOXA7aZYpe

Score

7^/10

Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.

System Network Configuration Discovery
T1016

Processes:

x-8.6-.Hellfire.elf

description ioc process

/proc/net/route /proc/net/route x-8.6-.Hellfire.elf
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery
T1016

Processes:

x-8.6-.Hellfire.elf

description ioc process

/proc/net/route /proc/net/route x-8.6-.Hellfire.elf

description	ioc	process
/proc/net/route	/proc/net/route	x-8.6-.Hellfire.elf

description	ioc	process
/proc/net/route	/proc/net/route	x-8.6-.Hellfire.elf

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact