d46252e1bbc794e004f7a060042b4522c4392a3d39fe5cf6eef98f50deb636a7

Analysis

max time kernel
149s
max time network
152s
platform
debian-12_armhf
resource
debian12-armhf-20240418-en
resource tags

arch:armhfimage:debian12-armhf-20240418-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
06-01-2025 11:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

hidakibest.arm6.elf
Size

150KB
MD5

bea42eb8c137e1ca501442e944156844
SHA1

a6e9e72a66d1d660d3bf6944bb3090ca4a2a0adb
SHA256

d46252e1bbc794e004f7a060042b4522c4392a3d39fe5cf6eef98f50deb636a7
SHA512

ecebe1d5c6c3008a49d7876c1e3ab8bfc773e87480867a465cf482753773516236eb66fc98ff0f1a0d1eee8a017a569d62fffa5c2090da96e100c7667c9fe015
SSDEEP

3072:/dQbnQao0HawD+zQNz7gv5hZ1GZWYxVkxHmpwTsL/QMyn:VmQao0H3D9z7i5hZ1GZWYxVkNmpwTsLS

Score

6^/10

discovery

Malware Config

Signatures

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	hidakibest.arm6.elf

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	hidakibest.arm6.elf

/tmp/hidakibest.arm6.elf
/tmp/hidakibest.arm6.elf
1⤵
- Reads system routing table
- Reads system network configuration
PID:706

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads