223081fec38b805a88edf16c10d9dbc961af19af51edf96ae7fe4af15ff23671

Analysis

max time kernel
149s
max time network
150s
platform
debian-9_armhf
resource
debian9-armhf-20240729-en
resource tags

arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
22-12-2024 15:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

hidakibest.arm6.elf
Size

113KB
MD5

86e0ecb88b3a5880862e0be8e3ab0fc1
SHA1

a1fae4ceab4241c5d7bd3c20c32a98d143ffdc24
SHA256

223081fec38b805a88edf16c10d9dbc961af19af51edf96ae7fe4af15ff23671
SHA512

83747bf98fe12efc20839f419b35ba3c1f5c31d74597708cc8db313101e0d852b3222a538326c9872fc8f9d276a6a03e606c452876bdda30f91b17e214b3a9c5
SSDEEP

3072:udGs8aNAHiNPHS7fSiq5hulKM7y1myjQUJ1UXpTn:2Gs8aNEiPiq5hulKN1myjQUJ1apTn

Score

6^/10

discovery

Malware Config

Signatures

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	hidakibest.arm6.elf

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	hidakibest.arm6.elf

/tmp/hidakibest.arm6.elf
/tmp/hidakibest.arm6.elf
1⤵
- Reads system routing table
- Reads system network configuration
PID:660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads