b8d4bf9e194f61703d597682997bcf702756e83948f359128e22babe9d08a952

Analysis

max time kernel
148s
max time network
149s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
02/07/2024, 05:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
qkdjdjj22.arm6.elf
Size 204KB
Sample240702-glw2rasgpj
SHA256 b8d4bf9e194f61703d597682997bcf702756e83948f359128e22babe9d08a952
MD5 aa6216495cf81557da544e6500636d3f
SHA1 887456d81b352e7d9ae4d368ef533e61485f38cc
SHA512 9072be414a9825d5a5e2f4f191ba7fe09bd16f7131dcf0b05cd1fb8ebe3daac586a341d1132f1badbbe19b616a79308bd08c96af8982a36096b083ed7e36891e
SSDEEP 6144:FZzyacCwXJ4DbpW0vV5hbL6K2axVOcgym0wfB5RyAn:FZzyacCwXJ4gC5hbMylgym0mB5RyAn
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

Malware Config

Signatures

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

System Network Configuration Discovery

T1016

description	ioc	Process
File opened for reading	/proc/net/route	qkdjdjj22.arm6.elf

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery

T1016

description	ioc	Process
File opened for reading	/proc/net/route	qkdjdjj22.arm6.elf

/tmp/qkdjdjj22.arm6.elf
/tmp/qkdjdjj22.arm6.elf
1⤵
- Reads system routing table
- Reads system network configuration
PID:643

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads