fffb3e8ed151fcb149a90df25a9f5634845eb8faaa18ea214a47b5092eb2ea40

Analysis

max time kernel
149s
max time network
152s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
13-11-2024 12:12

Target

a-r.m-4.ISIS.elf
Size

110KB
MD5

90bdadbbd4ded70fff1855cacf413008
SHA1

2500c0d969f39385cb617fe8f5b1e36895556b54
SHA256

fffb3e8ed151fcb149a90df25a9f5634845eb8faaa18ea214a47b5092eb2ea40
SHA512

71cc303f927033eefed9de7365c6eb7f58246dc0cfbb526ff5e63114d42e0d037b7e9b42097cece54bf07aff80bd490fdd0df0ed873ad155dc04711afc1c6cd4
SSDEEP

3072:9lX2jKRi0ZDvCTpTv7DSubUmGVrQAXiUXouX:6j6ZUpTv7DImGVrQAXiUXouX

Score

6^/10

discovery

Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
discovery

Internet Connection Discovery
T1016.001

Processes:

a-r.m-4.ISIS.elf

description ioc process

File opened for reading /proc/net/route a-r.m-4.ISIS.elf
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
discovery

Internet Connection Discovery
T1016.001

Processes:

a-r.m-4.ISIS.elf

description ioc process

File opened for reading /proc/net/route a-r.m-4.ISIS.elf

description	ioc	process
File opened for reading	/proc/net/route	a-r.m-4.ISIS.elf

description	ioc	process
File opened for reading	/proc/net/route	a-r.m-4.ISIS.elf

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact