ade59a49f2512e8acb3bc21e00ae64f98fb335ae74f1cbe6a4e25fb84dc9cac4

Analysis

max time kernel
150s
max time network
153s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
13-11-2024 12:12

Target

a-r.m-6.ISIS.elf
Size

124KB
MD5

977b6bed4d30d21b9e9e9dc193fc782f
SHA1

596394c83e2c73db41351cccdc856b3eeb173456
SHA256

ade59a49f2512e8acb3bc21e00ae64f98fb335ae74f1cbe6a4e25fb84dc9cac4
SHA512

07e5f8dde2f22c298bd9cc038094e39c343204ae0ec2751b0f4a6078f5bcf92af32ebd014833718cf72a862701a4f119ae839880397e96202a555cad691b3b7e
SSDEEP

3072:KdB2qwap6KVXPi4jv8x+xMDkmDhZmTQOIsXAqE:aRwap6Kt6+xMDHZmTQOICAqE

Score

6^/10

discovery

Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
discovery

Internet Connection Discovery
T1016.001

Processes:

a-r.m-6.ISIS.elf

description ioc process

File opened for reading /proc/net/route a-r.m-6.ISIS.elf
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
discovery

Internet Connection Discovery
T1016.001

Processes:

a-r.m-6.ISIS.elf

description ioc process

File opened for reading /proc/net/route a-r.m-6.ISIS.elf

description	ioc	process
File opened for reading	/proc/net/route	a-r.m-6.ISIS.elf

description	ioc	process
File opened for reading	/proc/net/route	a-r.m-6.ISIS.elf

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact