10fb8b90f2b656a4ae6c7a573cb190a848b4d2b1e520585bd67801b62e43cf86

Analysis

max time kernel
136s
max time network
156s
platform
debian-12_armhf
resource
debian12-armhf-20240221-en
resource tags

arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
13-12-2024 09:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

roze.armv5.elf
Size

204KB
MD5

1bf52f79b5ef22ee493783d4a296e61f
SHA1

dfff7f0d5130b53da696b0c0d6e451950f228ea4
SHA256

10fb8b90f2b656a4ae6c7a573cb190a848b4d2b1e520585bd67801b62e43cf86
SHA512

563a998fd262e301873bf399862db3cba30f84bcf881d3230e91acc174d23c3b9f104a84697334aef69aa8f661b981ca31e3a95a7de3034ed27181e680feeca4
SSDEEP

6144:VNfeaUiwXi0MtA0ef5hgu6nWgV7Px2m0wfB5RyAn:VNfeaUiwXi0jf5hgUiV2m0mB5RyAn

Score

6^/10

discovery

Malware Config

Signatures

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	roze.armv5.elf

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	roze.armv5.elf

/tmp/roze.armv5.elf
/tmp/roze.armv5.elf
1⤵
- Reads system routing table
- Reads system network configuration
PID:705

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads