94b7a1510dc186e3bd1973c973c77bbafda47ea646fc91d841e6caedb64543c4

Analysis

max time kernel
124s
max time network
147s
platform
debian-12_armhf
resource
debian12-armhf-20240729-en
resource tags

arch:armhfimage:debian12-armhf-20240729-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
28-11-2024 22:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

hidakibest.arm5.elf
Size

150KB
MD5

fe84568cc26b482abaea48e5ff1c260f
SHA1

54516d0d871405113fa7d1f5e652fdda493e5657
SHA256

94b7a1510dc186e3bd1973c973c77bbafda47ea646fc91d841e6caedb64543c4
SHA512

7031ab1b506d9a3d703efca367785eaa5bd85f62b838145fa87734200a571b1649c509418d9a34b34653f61eadd8f3777ecc8c75acb8592ca73cedfeb9247ace
SSDEEP

3072:Tdbmn8aAEHqgSkano1DTAw5hWTGU2WV7lxXmpwTsL/QMyn:he8aAEHKkdDTx5hWTGU2WV7ldmpwTsLS

Score

6^/10

discovery

Malware Config

Signatures

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	hidakibest.arm5.elf

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	hidakibest.arm5.elf

/tmp/hidakibest.arm5.elf
/tmp/hidakibest.arm5.elf
1⤵
- Reads system routing table
- Reads system network configuration
PID:703

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads