a2abfe0fce0928b57960fe83500189e48825efa48bf9340879d9575673b74b4e

Analysis

max time kernel
129s
max time network
140s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
14-12-2024 10:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

rebirth.arm4t.elf
Size

146KB
MD5

cfc87728a514a086cc3ff22550d9d652
SHA1

a378fd7831ae75ee988b819f5ef34d9625b9af41
SHA256

a2abfe0fce0928b57960fe83500189e48825efa48bf9340879d9575673b74b4e
SHA512

add6b92d1bf065378e661f5d8f351e55bea181a6faaf861ec0eccf1eb03654d07c2ad4a8a96228efcc6feee1fb34200f2c11e315b0334cd60173c79f93ce72ae
SSDEEP

3072:2tfSVjcVCLJDexaWt8mT17rz0JH/WoHIzmQwfCMQiGW:0fSVjcgLNexa9a17rz0JH/WocmQwfCDU

Score

6^/10

discovery

Malware Config

Signatures

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	rebirth.arm4t.elf

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	rebirth.arm4t.elf

/tmp/rebirth.arm4t.elf
/tmp/rebirth.arm4t.elf
1⤵
- Reads system routing table
- Reads system network configuration
PID:641

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads