23a47f20a21a76b45757b8446325cdba24d7f4200ec9a6de786de95eea503000

Analysis

max time kernel
140s
max time network
149s
platform
debian-9_armhf
resource
debian9-armhf-20240418-en
resource tags

arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
15-11-2024 02:07

Target

a-r.m-6.Sakura.elf
Size

118KB
MD5

47dd4c1f1108ecf8788b88f0d776f4aa
SHA1

ea0e1671729c5e400ec485cc0fd2243b575c8b89
SHA256

23a47f20a21a76b45757b8446325cdba24d7f4200ec9a6de786de95eea503000
SHA512

c7d2f7cb20759a1510b6bfd64d16d2c353218ae6e7f03e910b8c24870acdefd91ba687e0616ed090f1c5f77a7ead093e965869ddc2fcd096664c75919f1f97bf
SSDEEP

3072:ekYPUfsgnsb0J2ag/Vf2kDN0dn+mTQOY5NX3cn:9YPUfsgEo2a02kDy+mTQOY5R3cn

Score

6^/10

discovery

Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
discovery

Internet Connection Discovery
T1016.001

Processes:

a-r.m-6.Sakura.elf

description ioc process

File opened for reading /proc/net/route a-r.m-6.Sakura.elf
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
discovery

Internet Connection Discovery
T1016.001

Processes:

a-r.m-6.Sakura.elf

description ioc process

File opened for reading /proc/net/route a-r.m-6.Sakura.elf

description	ioc	process
File opened for reading	/proc/net/route	a-r.m-6.Sakura.elf

description	ioc	process
File opened for reading	/proc/net/route	a-r.m-6.Sakura.elf

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact