9915159e9514ead6e7f730883a1ab2d2b03a8412594cad82327cb8035b903db4

Analysis

max time kernel
149s
max time network
153s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
03-12-2024 20:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

p-p.c-.Logicnet.elf
Size

105KB
MD5

f810846bc536085ceee0d5af0599d396
SHA1

85b594e9f808eb84324e15f5c88eaf248e87caa3
SHA256

9915159e9514ead6e7f730883a1ab2d2b03a8412594cad82327cb8035b903db4
SHA512

cd61e16a76fd8102a4569fb8fd25eca001945119af63b80ba49b3087e014d411c9091e55a017080895f7722843c8ff4f3326474bf1e89128cf329091e87e18c2
SSDEEP

3072:MSY+46m1qOzssXFPueFhkPmkZrQAhPDCXFke:06mgOzJXFPJEmkZrQAhPDCXFke

Score

6^/10

discovery

Malware Config

Signatures

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	p-p.c-.Logicnet.elf

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	p-p.c-.Logicnet.elf

/tmp/p-p.c-.Logicnet.elf
/tmp/p-p.c-.Logicnet.elf
1⤵
- Reads system routing table
- Reads system network configuration
PID:649

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads