Analysis
-
max time kernel
142s -
max time network
152s -
platform
debian-9_armhf -
resource
debian9-armhf-20231215-en -
resource tags
arch:armhfimage:debian9-armhf-20231215-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
12-02-2024 04:56
Behavioral task
behavioral1
Sample
83953898a2e82deb94d627ba5fb4217060637fe05f1b3656233892f1ba1d46bf.elf
Resource
debian9-armhf-20231215-en
General
-
Target
83953898a2e82deb94d627ba5fb4217060637fe05f1b3656233892f1ba1d46bf.elf
-
Size
53KB
-
MD5
8cf69824c6370c3d94f1b33ad82d1cb5
-
SHA1
229affd9b5703b7c9a0a41d747d2c3d25941bff5
-
SHA256
83953898a2e82deb94d627ba5fb4217060637fe05f1b3656233892f1ba1d46bf
-
SHA512
d34dc3de63df9dbed46b0adf980768b74185cddc40169a3bd0e5a689509c53f9c32d3593fd6b504a809c73d17bd848dad571b2dc3ef38a6aed91f7d4786572ad
-
SSDEEP
1536:jYTBTpvc86Ixisjt26UEzsqoELzpANxknLWuA:ET1pvx6Ixis5mEzsNEL1YmniuA
Malware Config
Signatures
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/route 83953898a2e82deb94d627ba5fb4217060637fe05f1b3656233892f1ba1d46bf.elf -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/route 83953898a2e82deb94d627ba5fb4217060637fe05f1b3656233892f1ba1d46bf.elf -
Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/self/exe 83953898a2e82deb94d627ba5fb4217060637fe05f1b3656233892f1ba1d46bf.elf -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/Infected.log 83953898a2e82deb94d627ba5fb4217060637fe05f1b3656233892f1ba1d46bf.elf
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
107B
MD5a70a5dde6f79eaea4e71c88b6a2ccc38
SHA192c0273c4be5d4b7bdbdd500de5a64e5e05652b2
SHA256d087a5a10a09b589993d8cc44a24ef22db26ffd0feeeb3f29b15af008c292af8
SHA512aaa7d00faa34a87292f23a16dae8a7a4b5a40c8e375a579f1286427819c2a04e1c6f970dbc0f2433e6c03f59a2ece0f28ba1e8fc526bc4afe77f176f61876c52