074afa8a2aa53112b516f2a038bfc949c9d774ea46c171a131677d39fa640900

Analysis

max time kernel
100s
max time network
133s
platform
debian-12_armhf
resource
debian12-armhf-20240221-en
resource tags

arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
03-12-2024 20:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a-r.m-6.Logicnet.elf
Size

118KB
MD5

1a5663e45fb221ab95c0161f0e63473a
SHA1

1cc9f9b505c4432d846455239a6cecb6779b4e85
SHA256

074afa8a2aa53112b516f2a038bfc949c9d774ea46c171a131677d39fa640900
SHA512

0aac0cdd306b1d083ec9489e5823befd5bb13754f720addbfae3029575b5e63560e3ba3a91604d31c30848ff24b76d1baac970b5abca85e12153dd9f9689813b
SSDEEP

3072:ekYPUfsgnsb0J2ag/Vf/kDuuN4g+mTQOY5NX3cn:9YPUfsgEo2a0/kDuxg+mTQOY5R3cn

Score

6^/10

discovery

Malware Config

Signatures

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	a-r.m-6.Logicnet.elf

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	a-r.m-6.Logicnet.elf

/tmp/a-r.m-6.Logicnet.elf
/tmp/a-r.m-6.Logicnet.elf
1⤵
- Reads system routing table
- Reads system network configuration
PID:709

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads