49b4069d61d66beb779fe2797a0f0f82ee044c915c9edca250343c2ae341620e

Analysis

max time kernel
0s
max time network
2s
platform
debian-9_armhf
resource
debian9-armhf-20240729-en
resource tags

arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
31-12-2024 07:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

chernobyl.arm5.elf
Size

157KB
MD5

5e0d02ef99d7c1c2fbf413a108e6eeae
SHA1

77a5e006edd227c34d97797444e7ba4c83cdf343
SHA256

49b4069d61d66beb779fe2797a0f0f82ee044c915c9edca250343c2ae341620e
SHA512

dc364a2305b1891695e740b81b78bd5276669c7dbafcb4bf601ffcd9f76fbfa3912599997c3be14a8ff0a4ab0c04c9a6f6bffe2322196ad68f1c758eca403178
SSDEEP

3072:ChA2qd/yhKBgXz3uaOmzq+XCd88V7Xxg2mgwZBxSQzNa:32qd/2KBgD3ua/TXCd88V7XVmgwZBxJg

Score

6^/10

discovery

Malware Config

Signatures

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	chernobyl.arm5.elf

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	chernobyl.arm5.elf

/tmp/chernobyl.arm5.elf
/tmp/chernobyl.arm5.elf
1⤵
- Reads system routing table
- Reads system network configuration
PID:658

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads