Analysis

  • max time kernel
    149s
  • max time network
    142s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240611-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    31/10/2024, 02:29

General

  • Target

    61ba334fece8115debc5170dfeb680881a93d1cd3610cac61e59c912fc63a7fc.elf

  • Size

    2.8MB

  • MD5

    a77c391a6e462618ccbbbf1aa4e326af

  • SHA1

    ffbc08f31c24c57d44f6e081443ec2d1d75607f5

  • SHA256

    61ba334fece8115debc5170dfeb680881a93d1cd3610cac61e59c912fc63a7fc

  • SHA512

    3cb4abad617b2748c16143fea055ee3455eaca672e224be90398fda8b0bd0846f3e0415b65c52806e46d4f93a8c59c0921632d3f086623ce7fe5d629527d7dfd

  • SSDEEP

    49152:VEqogX7kJRMT310OfID0ZwI5XdqwgLCHsgsdDZcP0zvvkS+w6scJUqYSYyvdQHWR:9okk3kaOfIgZwnVpgsdDc0vvjQsc2Vi9

Malware Config

Signatures

  • Virtualization/Sandbox Evasion: Time Based Evasion 1 TTPs 1 IoCs

    Adversaries may detect and evade virtualized environments and sandboxes.

  • Reads CPU attributes 1 TTPs 1 IoCs
  • Reads system network configuration 1 TTPs 6 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

  • Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 13 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/61ba334fece8115debc5170dfeb680881a93d1cd3610cac61e59c912fc63a7fc.elf
    /tmp/61ba334fece8115debc5170dfeb680881a93d1cd3610cac61e59c912fc63a7fc.elf
    1⤵
    • Enumerates kernel/hardware configuration
    • Reads runtime system information
    PID:647
    • /bin/bash
      /bin/bash -c uptime
      2⤵
        PID:682
      • /usr/bin/uptime
        uptime
        2⤵
        • Virtualization/Sandbox Evasion: Time Based Evasion
        • Reads CPU attributes
        • Reads runtime system information
        PID:682
      • /bin/bash
        bash -c "cat /proc/net/dev |grep eth0 |awk '{print \$2}'"
        2⤵
          PID:684
          • /bin/cat
            cat /proc/net/dev
            3⤵
            • Reads system network configuration
            PID:685
          • /bin/grep
            grep eth0
            3⤵
              PID:686
            • /usr/bin/awk
              awk "{print \$2}"
              3⤵
              • Reads runtime system information
              PID:687
          • /bin/bash
            bash -c "cat /proc/net/dev |grep eth0 |awk '{print \$10}'"
            2⤵
              PID:688
              • /bin/cat
                cat /proc/net/dev
                3⤵
                • Reads system network configuration
                PID:690
              • /bin/grep
                grep eth0
                3⤵
                  PID:691
                • /usr/bin/awk
                  awk "{print \$10}"
                  3⤵
                  • Reads runtime system information
                  PID:692
              • /bin/bash
                bash -c "cat /proc/net/dev |grep eth0 |awk '{print \$2}'"
                2⤵
                  PID:781
                  • /bin/cat
                    cat /proc/net/dev
                    3⤵
                    • Reads system network configuration
                    PID:782
                  • /bin/grep
                    grep eth0
                    3⤵
                      PID:783
                    • /usr/bin/awk
                      awk "{print \$2}"
                      3⤵
                      • Reads runtime system information
                      PID:784
                  • /bin/bash
                    bash -c "cat /proc/net/dev |grep eth0 |awk '{print \$10}'"
                    2⤵
                      PID:785
                      • /bin/cat
                        cat /proc/net/dev
                        3⤵
                        • Reads system network configuration
                        PID:786
                      • /bin/grep
                        grep eth0
                        3⤵
                          PID:787
                        • /usr/bin/awk
                          awk "{print \$10}"
                          3⤵
                          • Reads runtime system information
                          PID:788
                      • /bin/bash
                        bash -c "cat /proc/net/dev |grep eth0 |awk '{print \$2}'"
                        2⤵
                          PID:801
                          • /bin/cat
                            cat /proc/net/dev
                            3⤵
                            • Reads system network configuration
                            PID:802
                          • /bin/grep
                            grep eth0
                            3⤵
                              PID:803
                            • /usr/bin/awk
                              awk "{print \$2}"
                              3⤵
                              • Reads runtime system information
                              PID:804
                          • /bin/bash
                            bash -c "cat /proc/net/dev |grep eth0 |awk '{print \$10}'"
                            2⤵
                              PID:805
                              • /bin/cat
                                cat /proc/net/dev
                                3⤵
                                • Reads system network configuration
                                PID:806
                              • /bin/grep
                                grep eth0
                                3⤵
                                  PID:807
                                • /usr/bin/awk
                                  awk "{print \$10}"
                                  3⤵
                                  • Reads runtime system information
                                  PID:808

                            Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads