fb76d3b27cf799ce57466693ae75dd2b0d0fc627d2dff55f518c6910f86d9bce

Analysis

max time kernel
138s
max time network
142s
platform
debian-9_mipsel
resource
debian9-mipsel-20240226-en
resource tags

arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
14-12-2024 14:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb76d3b27cf799ce57466693ae75dd2b0d0fc627d2dff55f518c6910f86d9bce.elf
Size

104KB
MD5

666fd8f36ee363d671814585e74e3d85
SHA1

9868a73adf68fcaad60967b412c0a7a2b8169403
SHA256

fb76d3b27cf799ce57466693ae75dd2b0d0fc627d2dff55f518c6910f86d9bce
SHA512

fd6dac2beffb32a119384e76a895ea0f1783e67dd0f42dac7b91daff4169b2e3c3bdbdaa29ff74801407d77006dd279ec16398c666260e964928a991e6bf155b
SSDEEP

1536:tuYk5qdBvHRLloCPVL1qgPHsYNDFsTbIxNqOCpXM:tuY82BvHNlo+nFpFMbGIBu

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
706	fb76d3b27cf799ce57466693ae75dd2b0d0fc627d2dff55f518c6910f86d9bce.elf

Renames itself 1 IoCs

pid	Process
706	fb76d3b27cf799ce57466693ae75dd2b0d0fc627d2dff55f518c6910f86d9bce.elf

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	fb76d3b27cf799ce57466693ae75dd2b0d0fc627d2dff55f518c6910f86d9bce.elf

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	a	706	fb76d3b27cf799ce57466693ae75dd2b0d0fc627d2dff55f518c6910f86d9bce.elf

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	fb76d3b27cf799ce57466693ae75dd2b0d0fc627d2dff55f518c6910f86d9bce.elf

/tmp/fb76d3b27cf799ce57466693ae75dd2b0d0fc627d2dff55f518c6910f86d9bce.elf
/tmp/fb76d3b27cf799ce57466693ae75dd2b0d0fc627d2dff55f518c6910f86d9bce.elf
1⤵
- Deletes itself
- Renames itself
- Enumerates active TCP sockets
- Changes its process name
- Reads system network configuration
PID:706

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads