7471a1dae77f38eab97aa3dae30547a55bd9981c2f492d72ff9b4611c0ad90ff

Analysis

max time kernel
106s
max time network
109s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
03-12-2024 20:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a-r.m-5.Logicnet.elf
Size

98KB
MD5

cb388dabc7c0f263425b687029f4037e
SHA1

7cd46b815d00be17b56fc9d0cfc2abd05c7003ac
SHA256

7471a1dae77f38eab97aa3dae30547a55bd9981c2f492d72ff9b4611c0ad90ff
SHA512

ee2e978b1f6ad19d229bf65f3fb7a44ab30572e8a7934f55a2d7baa3bf3c6209081823bba719c2067d1f9ad5700806cb02999a13caba8b320c4232d6ffec9e26
SSDEEP

3072:VSx+i6mqaObhNmnPLGd22mZuqQ4DPwXXtse:y6mRObnmnPp2mZuqQ4DPwXXtse

Score

6^/10

discovery

Malware Config

Signatures

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	a-r.m-5.Logicnet.elf

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	a-r.m-5.Logicnet.elf

/tmp/a-r.m-5.Logicnet.elf
/tmp/a-r.m-5.Logicnet.elf
1⤵
- Reads system routing table
- Reads system network configuration
PID:644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads