4bda17b9533cfed36bab0192ca46b5b4a2cef9434e879130a6b0d6ac461ebe6a

Analysis

max time kernel
43s
max time network
166s
platform
debian-12_armhf
resource
debian12-armhf-20240221-en
resource tags

arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
10-12-2024 17:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

hax.arm7.elf
Size

127KB
MD5

94b931b0c092b3a180f070136f162c29
SHA1

bf285addcd7c9e5210b0c4ed8409f9b540450ef0
SHA256

4bda17b9533cfed36bab0192ca46b5b4a2cef9434e879130a6b0d6ac461ebe6a
SHA512

0138716f62a9ba0ada2f8a092a9e0ff0be60fbc1601223ed219eff4df72e8a9139990e82ffabacf3d5ce3cc80cb897af2826b461f13ad5c977c9abc860be822c
SSDEEP

3072:w+fQVeTK2CWmIjlJLGsh2FmORwtASPSZO2M/9+BSOZA:JfQVeu2CWxvCsh2FmOGtRSZDM/9EZA

Score

9^/10

discovery

Malware Config

Signatures

Contacts a large (139510) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	hax.arm7.elf

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	c5pd3aafg21aacmi4pg	708	hax.arm7.elf

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	hax.arm7.elf

Reads runtime system information 14 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/221/fd	hax.arm7.elf
File opened for reading	/proc/247/fd	hax.arm7.elf
File opened for reading	/proc/318/fd	hax.arm7.elf
File opened for reading	/proc/188/fd	hax.arm7.elf
File opened for reading	/proc/308/fd	hax.arm7.elf
File opened for reading	/proc/310/fd	hax.arm7.elf
File opened for reading	/proc/316/fd	hax.arm7.elf
File opened for reading	/proc/338/fd	hax.arm7.elf
File opened for reading	/proc/352/fd	hax.arm7.elf
File opened for reading	/proc/317/fd	hax.arm7.elf
File opened for reading	/proc/341/fd	hax.arm7.elf
File opened for reading	/proc/711/exe	hax.arm7.elf
File opened for reading	/proc/1/fd	hax.arm7.elf
File opened for reading	/proc/337/fd	hax.arm7.elf

/tmp/hax.arm7.elf
/tmp/hax.arm7.elf
1⤵
- Enumerates active TCP sockets
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads