9a0fe6a65657539c679b6e69c961ba2ac62413e04ec3b705cfbf9504ba611e47

Analysis

max time kernel
142s
max time network
155s
platform
debian-12_armhf
resource
debian12-armhf-20240221-en
resource tags

arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
14-12-2024 10:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

rebirth.arm5.elf
Size

146KB
MD5

ee590158a313f9ef3f47a780231275d1
SHA1

650c72166bdf4a39765adc2cf2df3c65a1693153
SHA256

9a0fe6a65657539c679b6e69c961ba2ac62413e04ec3b705cfbf9504ba611e47
SHA512

51befc75160a30ee16a9da226cc8625f079463f4a7304f121d9807a3d56e6001a9a079b9b699ebd8604953e6cbef6cdf45a7b7717ab10c7f29136ea34576050f
SSDEEP

3072:CtfSVjcVCLJDexaWt8mT17a8oXV7EHIzmQwfCMQiGW:AfSVjcgLNexa9a17a8oXV7EcmQwfCDi9

Score

6^/10

discovery

Malware Config

Signatures

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	rebirth.arm5.elf

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	rebirth.arm5.elf

/tmp/rebirth.arm5.elf
/tmp/rebirth.arm5.elf
1⤵
- Reads system routing table
- Reads system network configuration
PID:710

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads