a5a24f796c7204059a62e251c35d67f0e2cd7d591792b65f7b55921261ab163d

Analysis

max time kernel
90s
max time network
151s
platform
ubuntu-22.04_amd64
resource
ubuntu2204-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
submitted
13-12-2024 09:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

roze.x86.elf
Size

155KB
MD5

301cf3c8fc89ee44d7a40461bbf9bd00
SHA1

6d49ae38398ca9b225c4d2e1a11c160a828313b4
SHA256

a5a24f796c7204059a62e251c35d67f0e2cd7d591792b65f7b55921261ab163d
SHA512

947d7ce4ddde2257df784cb22c7478c869f409bb31ebb9731df7eb37dfbfaa744b3fb29daab15d4c9922d0c5d09f42b50df3a54f9492c20d770cf0116743df1e
SSDEEP

3072:a8L2FlZkCzC2TCX5hGhfmphahpCn38n9VAlZn31mBT38dAY4:Mr1mphabkm6lmBT38dAY4

Score

6^/10

discovery

Malware Config

Signatures

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	roze.x86.elf

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	roze.x86.elf

/tmp/roze.x86.elf
/tmp/roze.x86.elf
1⤵
- Reads system routing table
- Reads system network configuration
PID:1570

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads