b7a92b169626e3b6cdd4e4ae1bfece45ce3a0a32a33952b154a0deeda351c624

Analysis

max time kernel
148s
max time network
149s
platform
debian-9_armhf
resource
debian9-armhf-20240729-en
resource tags

arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
26-12-2024 21:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

kitsune.arm4.elf
Size

112KB
MD5

d59dcafcf80778e83d08e570c06be735
SHA1

c93b91844f15557ee6fbc49d9331505c846b6827
SHA256

b7a92b169626e3b6cdd4e4ae1bfece45ce3a0a32a33952b154a0deeda351c624
SHA512

38060a34ba1c139eb4aff6da2bcdd225fc6e0149d7665c8563a74b3ea163938b27b99744993d1962f4dfda54d028d62a7c095d07f4ee19a84c7104f43b3d65da
SSDEEP

3072:vhfviOui5FCRSUaVejY68tt5hqSr3hGm0Qxu1bXWIn:pvfUQVejYXtt5hqSr3hGm0Qxu1rWIn

Score

6^/10

discovery

Malware Config

Signatures

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	kitsune.arm4.elf

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	kitsune.arm4.elf

/tmp/kitsune.arm4.elf
/tmp/kitsune.arm4.elf
1⤵
- Reads system routing table
- Reads system network configuration
PID:645

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads