e96c0e739a35ad8ee5afdbc4e53bee183c22108ffa269e0917c50757b4226d5b

Analysis

max time kernel
146s
max time network
153s
platform
debian-12_armhf
resource
debian12-armhf-20240221-en
resource tags

arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
12-12-2024 05:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

arm6.xxx.elf
Size

156KB
MD5

0812c913971b511f42ac23ed34c6819c
SHA1

cf44197e4f73940959c12f4d5573b8175e20fc2d
SHA256

e96c0e739a35ad8ee5afdbc4e53bee183c22108ffa269e0917c50757b4226d5b
SHA512

d0c69d17a6f7db08c07bb8f26dafe1380f759c602bab4531bb2fb7f52b96cab0ff51427c37eb7ae3fc8085cc4d38bbb26fc7af980045e9e0c0ad4b5732a35458
SSDEEP

3072:T1g2/eINNlzx2kkQCMOaQcvBMYnYQTxVq3tmFwfBxKQodn:hg2hNNlzIkk/MOa/iYnYQTxVMmFwfBxE

Score

6^/10

discovery

Malware Config

Signatures

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	arm6.xxx.elf

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	arm6.xxx.elf

/tmp/arm6.xxx.elf
/tmp/arm6.xxx.elf
1⤵
- Reads system routing table
- Reads system network configuration
PID:712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads