82e560a078cd7bb4472d5af832a04c4bc8f1001bac97b1574efe9863d3f66550

Analysis

max time kernel
1s
platform
debian-9_armhf
resource
debian9-armhf-20240226-en
resource tags

arch:armhfimage:debian9-armhf-20240226-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
25-03-2024 20:54

Target

d_nas_arm.out
Size

2.0MB
MD5

7de2173c75f9778b9c9c20447ad4c1f8
SHA1

0bea740c49e30d3c8d58976951331068f181c453
SHA256

2cd6d4a52dbaf9e79d93492ad73dc229e06d0cee9e3327cc3bef165fae06f918
SHA512

666387bea53b85ccb8d6f5925f2c4fa69530836a58834234f6c9c5c0034997dad2270f270bea138796f7bb2010bcf2c4430bbaf10fa8a6f50b52323b84b21e18
SSDEEP

24576:T138npoIXekt5RAg6hjRofWxTRLgHykaWm/kC4szj05oFVps5RThELC7ox0Yulo7:TNWdJxNxuGWsRlW011vfH6/E6tRb

Score

3^/10

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery
T1082

Processes:

d_nas_arm.out

description ioc process

File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size d_nas_arm.out

description	ioc	process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	d_nas_arm.out

/tmp/d_nas_arm.out
/tmp/d_nas_arm.out
1⤵
- Enumerates kernel/hardware configuration
PID:693

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact