983e19517ae90c2905a1c5071e1afa031d6cfce9d2377ceb74c45dc2e086625b

Analysis

max time kernel
129s
max time network
151s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
22-11-2024 23:12

Target

hidakibest.arm5.elf
Size

150KB
MD5

2019d6f3ca9696122b2a46bde0c22e9a
SHA1

8e95db4f407919b1bed25258b2ab7af56e2a0c52
SHA256

983e19517ae90c2905a1c5071e1afa031d6cfce9d2377ceb74c45dc2e086625b
SHA512

10d7899176eeb63acba225484db1b2102c80e3ac8dabd6314476f583984c0258d3624a9d885af5d42bda0f7ddada102217a0a464d4a86ba72bb6d8d77b7a7d7b
SSDEEP

3072:/dQbnQao0HawD+zQNz7gb5hZ1GU2WV7kxHmpwTsL/QMyn:VmQao0H3D9z7+5hZ1GU2WV7kNmpwTsLS

Score

6^/10

discovery

Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
discovery

Internet Connection Discovery
T1016.001

Processes:

hidakibest.arm5.elf

description ioc process

File opened for reading /proc/net/route hidakibest.arm5.elf
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
discovery

Internet Connection Discovery
T1016.001

Processes:

hidakibest.arm5.elf

description ioc process

File opened for reading /proc/net/route hidakibest.arm5.elf

description	ioc	process
File opened for reading	/proc/net/route	hidakibest.arm5.elf

description	ioc	process
File opened for reading	/proc/net/route	hidakibest.arm5.elf

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact