8635f296dd8324b34b563be5f1116cd161b1d3476d65dc5aa324f1b6d4b0fdf4

Analysis

max time kernel
95s
max time network
128s
platform
ubuntu-22.04_amd64
resource
ubuntu2204-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
submitted
26-12-2024 08:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

keksec.x86.elf
Size

140KB
MD5

0f1676b1363d0e5268e4e8e6dc572b62
SHA1

8061f19240f26a5adf65727e41ed032650c89d0e
SHA256

8635f296dd8324b34b563be5f1116cd161b1d3476d65dc5aa324f1b6d4b0fdf4
SHA512

6fa8d714a6eca7f2beace38d709b0ef3cd0d35a7bf0cf952fe4faff298b708ecba056482a79ceec217e6e44473ba197d0a491e76c9806804c1f093ae465253a0
SSDEEP

3072:c6UyaR370QkWuZI3zKZPhJephaO+1QktUm+QVOXFNqOPPe:OXOI3mYphaN1Qxm+QVOXFNqOPPe

Score

6^/10

discovery

Malware Config

Signatures

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	keksec.x86.elf

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	keksec.x86.elf

/tmp/keksec.x86.elf
/tmp/keksec.x86.elf
1⤵
- Reads system routing table
- Reads system network configuration
PID:1565

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads