7c8d83a2a40b3bb8f1bab956ac57a8eba1d4d119ca28a83fb5a53ca51afc2fd3

Analysis

max time kernel
145s
max time network
148s
platform
debian-9_armhf
resource
debian9-armhf-20240729-en
resource tags

arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
13-12-2024 09:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

roze.armv6.elf
Size

204KB
MD5

dda182a45be867bafe352903fb903f42
SHA1

4268470e21c066846cb9a40bbe40d9b391b8a385
SHA256

7c8d83a2a40b3bb8f1bab956ac57a8eba1d4d119ca28a83fb5a53ca51afc2fd3
SHA512

0844dabb570ad864afbf81e671d438480f42d5efdf68f8e4b209b9d7237d2f4e3715a180bd5c110bbb632092854442f998d533084f2c51bf8c3c0fd5a2814150
SSDEEP

6144:VNfeaUiwXi0MtA0ef5hgu6K2axVPx2m0wfB5RyAn:VNfeaUiwXi0jf5hg/yb2m0mB5RyAn

Score

6^/10

discovery

Malware Config

Signatures

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	roze.armv6.elf

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	roze.armv6.elf

/tmp/roze.armv6.elf
/tmp/roze.armv6.elf
1⤵
- Reads system routing table
- Reads system network configuration
PID:646

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads