3d148483dce04c383ef564b9934674d0f51d344eec017dd748194f72739d6f8d

Analysis

max time kernel
149s
max time network
152s
platform
debian-9_armhf
resource
debian9-armhf-20240729-en
resource tags

arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
28-11-2024 17:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

arm4.elf
Size

105KB
MD5

dfdd17823125146295896f2ffb7cc476
SHA1

7dd52ad6dca096423acd40f02513c04e7a3f5395
SHA256

3d148483dce04c383ef564b9934674d0f51d344eec017dd748194f72739d6f8d
SHA512

a72a1bb86dd01c901f1f20338f9d3c1ee25118d9390f34e7fe87fddc59e14b731619f5beba755d8be775c15f509c8ac5c7e455ed78423b81b65a600a43890667
SSDEEP

3072:MSY+46m1qOzssoFPp2HAmkZrQAhPDCXFke:06mgOzJoFPJmkZrQAhPDCXFke

Score

6^/10

discovery

Malware Config

Signatures

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	arm4.elf

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	arm4.elf

/tmp/arm4.elf
/tmp/arm4.elf
1⤵
- Reads system routing table
- Reads system network configuration
PID:646

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads