fb8bddbc583183582742ecae76e31967af22f63f18e9454fbcdc45697a628394

Analysis

max time kernel
100s
max time network
102s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
22-12-2024 14:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

hidakibest.arm4.elf
Size

101KB
MD5

426bfa9b1f8bf6a028d2f5a7a09176a0
SHA1

30dc5cf1650761dc7d36721785b6c29b1a82a89f
SHA256

fb8bddbc583183582742ecae76e31967af22f63f18e9454fbcdc45697a628394
SHA512

ebe9f9a15564db59e3b37336042d301aee28ff87349299b620a778dbbd158136ade93a6860979f8c6e7bebbb5f041f123682c8d079fdbe99a0c88a0c3f68fab7
SSDEEP

3072:KsPwVe1e5hpUZKaGU+L7yj0yrQ0Knm4XnTe:1Pv1e5hOZKNSj0yrQ0Knm4XnTe

Score

6^/10

discovery

Malware Config

Signatures

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	hidakibest.arm4.elf

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	hidakibest.arm4.elf

/tmp/hidakibest.arm4.elf
/tmp/hidakibest.arm4.elf
1⤵
- Reads system routing table
- Reads system network configuration
PID:656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads