956ff44f4787a2def1ff41dbf24f89f8368f3542a2c5cb1d12434379dd14a2aa

Analysis

max time kernel
0s
max time network
125s
platform
debian-12_armhf
resource
debian12-armhf-20240221-en
resource tags

arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
01-12-2024 13:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

snype.arm6.elf
Size

105KB
MD5

7abeb737ae1ab444027a43a355240f60
SHA1

440e4885580f80c1864b91ff185e67be59b1dcfb
SHA256

956ff44f4787a2def1ff41dbf24f89f8368f3542a2c5cb1d12434379dd14a2aa
SHA512

322b9adcb79e5ff990f823bc6585ac6d7d1ef97226688f77086813f43553cf6a3d080bc72c5a427052f7e001fb53ef16df06d0ae373cf43c8283ca68b51d2f2c
SSDEEP

3072:OaKh4ut9WuRg0WwGDa5SMXzfbmNQfPfXv4n:OaKh4uFWwGDobmNQfP/v4n

Score

6^/10

discovery

Malware Config

Signatures

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	snype.arm6.elf

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	snype.arm6.elf

/tmp/snype.arm6.elf
/tmp/snype.arm6.elf
1⤵
- Reads system routing table
- Reads system network configuration
PID:706

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads