c36beb6ef7cd3ea3608623b028b23f7908a06a381278323b49165c2bae831071

Analysis

max time kernel
8s
max time network
138s
platform
debian-12_armhf
resource
debian12-armhf-20240729-en
resource tags

arch:armhfimage:debian12-armhf-20240729-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
16-12-2024 09:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a-r.m-6.Sakura.elf
Size

118KB
MD5

806675314b77f885b10e45f65ac01a0a
SHA1

5f8ba6376ff3e4ebffe6cdb3c03f1eb8fadd8e3f
SHA256

c36beb6ef7cd3ea3608623b028b23f7908a06a381278323b49165c2bae831071
SHA512

234dbd25a133a850acabb2c5aad9ad090e7a0a8147c42dffe8eb77fd798574f61799f898958d9b11b0b44f8a58618e266fff7860b8fb252eaa3d8bfb7ef86d53
SSDEEP

3072:ekYPUfsgnsb0J2ag/Vf3kDN0dn+mTQOY5NX3cn:9YPUfsgEo2a03kDy+mTQOY5R3cn

Score

6^/10

discovery

Malware Config

Signatures

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	a-r.m-6.Sakura.elf

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	a-r.m-6.Sakura.elf

/tmp/a-r.m-6.Sakura.elf
/tmp/a-r.m-6.Sakura.elf
1⤵
- Reads system routing table
- Reads system network configuration
PID:701

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads