89cb3f2951d295b7075e70a138b1937783187d1668f17e1405d440700b6e1e63

Analysis

max time kernel
147s
max time network
149s
platform
debian-9_armhf
resource
debian9-armhf-20240418-en
resource tags

arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
30-12-2024 01:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

rebirth.arm5.elf
Size

146KB
MD5

1ac5cc564d1b102e20115e1237b87955
SHA1

b4bb128bd116ebd86f0dc47de066628b3021b57d
SHA256

89cb3f2951d295b7075e70a138b1937783187d1668f17e1405d440700b6e1e63
SHA512

00cd73c151026b7d2b6cabaec41f8f6e1989697bf533b1aeb7f6774dbba1b45cb5d71865ee823549f15da7e37b97cb4e9fd90627e73c0f786ca7fed2a89e89c6
SSDEEP

3072:ut8iFDKEfFN+Fa+1sWth7a8oXV7pUMbmQwfCMQiGW:s8iFDLf/+FaNoh7a8oXV7p5mQwfCDiGW

Score

6^/10

discovery

Malware Config

Signatures

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	rebirth.arm5.elf

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	rebirth.arm5.elf

/tmp/rebirth.arm5.elf
/tmp/rebirth.arm5.elf
1⤵
- Reads system routing table
- Reads system network configuration
PID:640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads