552ca1811b37d5021e5359c886a8d7b2d637663e5152c5a688db89f3ea0a7383

Analysis

max time kernel
123s
max time network
142s
platform
debian-9_armhf
resource
debian9-armhf-20231215-en
resource tags

arch:armhfimage:debian9-armhf-20231215-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
19/12/2023, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

07e40500a3644190cfc1a6a4579af30d
Size

135KB
MD5

07e40500a3644190cfc1a6a4579af30d
SHA1

636cdc721e00da4668fd1228431f9afe6eab69dc
SHA256

552ca1811b37d5021e5359c886a8d7b2d637663e5152c5a688db89f3ea0a7383
SHA512

73fa724cc7cfa62e7244ab9217bccc90750116ae63f679b853e2998b8b5f765b7cef54927543e38fd8997d5cd44ea19280e342bf5d496a29c9f030e37abf7e0a
SSDEEP

3072:yGQxoHQIuTBhmSJmUAaHhHtn0rlHplgVP5hjH2Y2QotzgmyhQaS+pg7J:yHmUAaHhHFVP5hjH27gmyhQaSGg7J

Score

7^/10

Malware Config

Signatures

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	wt4q	659	07e40500a3644190cfc1a6a4579af30d

Deletes itself 1 IoCs

pid	Process
659	07e40500a3644190cfc1a6a4579af30d

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

System Network Configuration Discovery

T1016

description	ioc	Process
File opened for reading	/proc/net/route	07e40500a3644190cfc1a6a4579af30d

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery

T1016

description	ioc	Process
File opened for reading	/proc/net/route	07e40500a3644190cfc1a6a4579af30d

/tmp/07e40500a3644190cfc1a6a4579af30d
/tmp/07e40500a3644190cfc1a6a4579af30d
1⤵
- Changes its process name
- Deletes itself
- Reads system routing table
- Reads system network configuration
PID:659

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads