824bd7b116e2d5b8d2b7d11bd32756964313196f55fed442d0bc8ea3f54f704d

Analysis

max time kernel
141s
max time network
155s
platform
debian-12_armhf
resource
debian12-armhf-20240221-en
resource tags

arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
02-11-2024 06:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

824bd7b116e2d5b8d2b7d11bd32756964313196f55fed442d0bc8ea3f54f704d.elf
Size

243KB
MD5

d78a2539eb007bd56f0bc1a363ddced0
SHA1

1275f7ce882376c70d82e69780b59505eeb47535
SHA256

824bd7b116e2d5b8d2b7d11bd32756964313196f55fed442d0bc8ea3f54f704d
SHA512

8a8cd0d4464e19218f30f4b97c0bba2d04cad1720d506621247c1f2570678a99f847c32b4ff2035f8a5a39d506912b4bec5041e40a01bb9f9cf2548eeed6fe8d
SSDEEP

6144:od+zaQj8aycw6r8le/Fxgd9Cxq53Ep7V7Yvl3mojKMl2k:od88aycw6YlW7d+opEd3mojKMl2k

Score

6^/10

discovery

Malware Config

Signatures

Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
discovery

Internet Connection Discovery
T1016.001

Processes:

824bd7b116e2d5b8d2b7d11bd32756964313196f55fed442d0bc8ea3f54f704d.elf

description ioc process

File opened for reading /proc/net/route 824bd7b116e2d5b8d2b7d11bd32756964313196f55fed442d0bc8ea3f54f704d.elf

description	ioc	process
File opened for reading	/proc/net/route	824bd7b116e2d5b8d2b7d11bd32756964313196f55fed442d0bc8ea3f54f704d.elf

Changes its process name 1 IoCs

Processes:

824bd7b116e2d5b8d2b7d11bd32756964313196f55fed442d0bc8ea3f54f704d.elf

description	pid	process
Changes the process name, possibly in an attempt to hide itself	705	824bd7b116e2d5b8d2b7d11bd32756964313196f55fed442d0bc8ea3f54f704d.elf

Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
discovery

Internet Connection Discovery
T1016.001

Processes:

824bd7b116e2d5b8d2b7d11bd32756964313196f55fed442d0bc8ea3f54f704d.elf

description ioc process

File opened for reading /proc/net/route 824bd7b116e2d5b8d2b7d11bd32756964313196f55fed442d0bc8ea3f54f704d.elf

description	ioc	process
File opened for reading	/proc/net/route	824bd7b116e2d5b8d2b7d11bd32756964313196f55fed442d0bc8ea3f54f704d.elf

/tmp/824bd7b116e2d5b8d2b7d11bd32756964313196f55fed442d0bc8ea3f54f704d.elf
/tmp/824bd7b116e2d5b8d2b7d11bd32756964313196f55fed442d0bc8ea3f54f704d.elf
1⤵
- Reads system routing table
- Changes its process name
- Reads system network configuration
PID:705

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads