2e1e3f75fdb08c26e41d7870db6ffea5b89b39100899fe609b3c1d0d018c87d3

Resubmissions

14/06/2024, 14:27

240614-rssysavamc

14/06/2024, 14:23

240614-rqapesxhrn3

17/04/2024, 09:42

240417-lpnl1abc264

Analysis

max time kernel
87s
platform
debian-9_armhf
resource
debian9-armhf-20240226-en
resource tags

arch:armhfimage:debian9-armhf-20240226-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
17/04/2024, 09:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d_lin_arm
Size 18.2MB
Sample240417-lpnl1abc26
SHA256 e3f229dc71ce65c1f2de05e2cfbd7ae848d330661d9b9b3fa00d594bf84f4d93
MD5 6eef15654dd0310a0e3b440530ec0a9e
SHA1 4a4df3dde0bec5bd72442b632657111e872aaec1
SHA512 b03a4faa48162e661e083e86866aa907f3f9a8470daa0ac4ae0cbbf50c294587e3c597d0dd8494e74d01b9ceffff0763300cbc01ecb8268316d8e4ea62ab3062
SSDEEP 196608:c5WkFm48euRcoCNKjBJI/5ZInFbuCmjoUAZUeh:UimPjoUAZUe
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	d_lin_arm

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/stat	d_lin_arm

/tmp/d_lin_arm
/tmp/d_lin_arm
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:773

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads