47e593299cd75c5837594433cbc16749f58cd0ae39820a9a944e90e3a621ba3e

Analysis

max time kernel
148s
max time network
27s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
25-11-2024 07:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

pXdN91.armv4l.elf
Size

126KB
MD5

6b7b6a7809a567d3653431a96cfb61bc
SHA1

22f4fbf6279e4b8f2c64edbaa7a107c90c57383c
SHA256

47e593299cd75c5837594433cbc16749f58cd0ae39820a9a944e90e3a621ba3e
SHA512

b846a07f3e1ebb29bd1e34c3149233cae9cc860cda7b62e1911b379e9bbf4518c8d6078ce2611b52222f5adc8807999f74660b2ef1c465e17e846f86a80dbdfa
SSDEEP

3072:VtbV6ZzxvgV2bF7a6rz0X7s6JzR/2wb5vMmfQK7oXdC8:tuv2Ea60X7HhR/DMmfQK7udC8

Score

6^/10

discovery

Malware Config

Signatures

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	pXdN91.armv4l.elf

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	pXdN91.armv4l.elf

/tmp/pXdN91.armv4l.elf
/tmp/pXdN91.armv4l.elf
1⤵
- Reads system routing table
- Reads system network configuration
PID:662

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads