517e5f65c8af8123d0939b560074c9cf735829d5b141f8764b4f982bc6aa3f62

Analysis

max time kernel
150s
max time network
162s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
07-12-2024 09:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

p-p.c-.Sakura.elf
Size

105KB
MD5

6e80a5217c6d2bd6f076ebdb32a420f0
SHA1

a6051d8000358438bedddf94d83a64fe8f215ced
SHA256

517e5f65c8af8123d0939b560074c9cf735829d5b141f8764b4f982bc6aa3f62
SHA512

57dae19994814e98a3aa5385152fcf41390b334bea56fa8c56baf5273aa97f5153e08038dd59b3f9542fc883e730dd6a35b8a2a1b2a82ea523a85096bdd5cc04
SSDEEP

3072:MSY+46m1qOzsssFPPKNy+AmkZrQAhPDCXFke:06mgOzJsFPzmkZrQAhPDCXFke

Score

6^/10

discovery

Malware Config

Signatures

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	p-p.c-.Sakura.elf

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	p-p.c-.Sakura.elf

/tmp/p-p.c-.Sakura.elf
/tmp/p-p.c-.Sakura.elf
1⤵
- Reads system routing table
- Reads system network configuration
PID:665

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads