bba8f550b0f4cc8f0a29f3a62ef7b00652787b5629ffdb5fbdbdce154796abcb

Analysis

max time kernel
149s
max time network
181s
platform
debian-12_armhf
resource
debian12-armhf-20240221-en
resource tags

arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
22-11-2024 23:12

Target

hidakibest.arm6.elf
Size

150KB
MD5

31ef4ace95094aea3da2e0dd38da5a0d
SHA1

fd4b3bb3eaf2fa54052e03e3760ad06a315e427d
SHA256

bba8f550b0f4cc8f0a29f3a62ef7b00652787b5629ffdb5fbdbdce154796abcb
SHA512

9c01c8b7caecd6e8cedea11263cc93b37a3cfafeb637e5aff7cc7c4a77d3198c991f466aaffad04c921ba892d212b5a1ed7674f1011aec8c0208af4c3d9ca2eb
SSDEEP

3072:/dQbnQao0HawD+zQNz7gb5hZ1GZWYxVkxHmpwTsL/QMyn:VmQao0H3D9z7+5hZ1GZWYxVkNmpwTsLS

Score

6^/10

discovery

Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
discovery

Internet Connection Discovery
T1016.001

Processes:

hidakibest.arm6.elf

description ioc process

File opened for reading /proc/net/route hidakibest.arm6.elf
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
discovery

Internet Connection Discovery
T1016.001

Processes:

hidakibest.arm6.elf

description ioc process

File opened for reading /proc/net/route hidakibest.arm6.elf

description	ioc	process
File opened for reading	/proc/net/route	hidakibest.arm6.elf

description	ioc	process
File opened for reading	/proc/net/route	hidakibest.arm6.elf

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact