7aebc6a86fda69a4889e18ff8d7d1b6b0bd227070793298450c9ec107f66fb41

Analysis

max time kernel
120s
max time network
121s
platform
debian-9_armhf
resource
debian9-armhf-20240418-en
resource tags

arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
12-11-2024 02:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7aebc6a86fda69a4889e18ff8d7d1b6b0bd227070793298450c9ec107f66fb41.elf
Size

160KB
MD5

2a45d315342063a6ca92c63f5f77287a
SHA1

94dbc030cbb625fea324b1dd9838e3ba926bb5a3
SHA256

7aebc6a86fda69a4889e18ff8d7d1b6b0bd227070793298450c9ec107f66fb41
SHA512

ed6e8126a68212aa2c39a7696c4c508808c53e98ca88978b89c59c375c1af44d084ce6937406da6c358ecd96f17034d09bc8b637e7268330ba2643f29ff5f93f
SSDEEP

3072:EIrBzuvjgC/m/PyH/DrGi3ax5tNhGdHEq2c9etJ8add9Qzhs3iCdjeK8PvmyOQ0G:Er7rGgaTtuF2c9etJ8addQ+iCdjeHvm4

Score

6^/10

discovery

Malware Config

Signatures

Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
discovery

Internet Connection Discovery
T1016.001

Processes:

7aebc6a86fda69a4889e18ff8d7d1b6b0bd227070793298450c9ec107f66fb41.elf

description ioc process

File opened for reading /proc/net/route 7aebc6a86fda69a4889e18ff8d7d1b6b0bd227070793298450c9ec107f66fb41.elf

description	ioc	process
File opened for reading	/proc/net/route	7aebc6a86fda69a4889e18ff8d7d1b6b0bd227070793298450c9ec107f66fb41.elf

Changes its process name 1 IoCs

Processes:

7aebc6a86fda69a4889e18ff8d7d1b6b0bd227070793298450c9ec107f66fb41.elf

description	pid	process
Changes the process name, possibly in an attempt to hide itself	638	7aebc6a86fda69a4889e18ff8d7d1b6b0bd227070793298450c9ec107f66fb41.elf

Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
discovery

Internet Connection Discovery
T1016.001

Processes:

7aebc6a86fda69a4889e18ff8d7d1b6b0bd227070793298450c9ec107f66fb41.elf

description ioc process

File opened for reading /proc/net/route 7aebc6a86fda69a4889e18ff8d7d1b6b0bd227070793298450c9ec107f66fb41.elf

description	ioc	process
File opened for reading	/proc/net/route	7aebc6a86fda69a4889e18ff8d7d1b6b0bd227070793298450c9ec107f66fb41.elf

/tmp/7aebc6a86fda69a4889e18ff8d7d1b6b0bd227070793298450c9ec107f66fb41.elf
/tmp/7aebc6a86fda69a4889e18ff8d7d1b6b0bd227070793298450c9ec107f66fb41.elf
1⤵
- Reads system routing table
- Changes its process name
- Reads system network configuration
PID:638

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads