38548bab729836106e23badebd80615fa95f17dcd461f15b47400e2fbe91c952

Analysis

max time kernel
147s
max time network
149s
platform
debian-9_armhf
resource
debian9-armhf-20240729-en
resource tags

arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
22-11-2024 23:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

hidakibest.arm4.elf
Size

112KB
MD5

40b93365938ab7f928181cd7cd4a1bc0
SHA1

78ff805bcbb48ce089f80cc47f9cc9dc81f94c47
SHA256

38548bab729836106e23badebd80615fa95f17dcd461f15b47400e2fbe91c952
SHA512

81ff07efb002d97bed286fa63859a423bd0f8063a64a89f6abcf0c52b19bdd9f96888fa935a987e5e7d22bcd3c1755df3b0fa049888a5e8eac14b86625501a55
SSDEEP

3072:ULveOu+5FClWUaVeDYeQ1e5hiBrn1Gm0Qxu1bXWIn:6v78EVeDYH1e5hiBrn1Gm0Qxu1rWIn

Score

6^/10

discovery

Malware Config

Signatures

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	hidakibest.arm4.elf

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	hidakibest.arm4.elf

/tmp/hidakibest.arm4.elf
/tmp/hidakibest.arm4.elf
1⤵
- Reads system routing table
- Reads system network configuration
PID:660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads