5e1d55aa380b6a0d274c380ca1b732e2b8e7595e996a32a2bb7b6a98163ecb41

Analysis

max time kernel
151s
max time network
152s
platform
debian-9_armhf
resource
debian9-armhf-20231222-en
resource tags

arch:armhfimage:debian9-armhf-20231222-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
12/02/2024, 03:23

Target

5e1d55aa380b6a0d274c380ca1b732e2b8e7595e996a32a2bb7b6a98163ecb41.elf
Size

71KB
MD5

a34a235408918919a60219983c361a21
SHA1

4a61b29128740fd351db05b5b07bb4b99dc058f9
SHA256

5e1d55aa380b6a0d274c380ca1b732e2b8e7595e996a32a2bb7b6a98163ecb41
SHA512

5e72bc54928c8e691ed620ed084dfe5a2cc92e102ddc2c559446f8a0cb4d24b0d6773e4858006191fa6a7cfd854d16a12efec958a83a0ba76c7972a5fa3a7a4a
SSDEEP

1536:eicHbFeTIaBh0Scu+t5oE9zgUuBlb/OltVpAwMfBY3mN:eicH2JAFbRcUuXCtMkM

Score

9^/10

discovery

Contacts a large (76253) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	/usr/bin/dbus-daemon	699	5e1d55aa380b6a0d274c380ca1b732e2b8e7595e996a32a2bb7b6a98163ecb41.elf

Deletes itself 1 IoCs

pid	Process
699	5e1d55aa380b6a0d274c380ca1b732e2b8e7595e996a32a2bb7b6a98163ecb41.elf

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact