23ae7d0cb7ab73ce40a18282ece21431ab6d3762c889675e3b554a4645b0ebf6

Analysis

max time kernel
150s
max time network
154s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
20-01-2025 02:09

Target

23ae7d0cb7ab73ce40a18282ece21431ab6d3762c889675e3b554a4645b0ebf6.elf
Size

133KB
MD5

bfd624e7edb29a578b8b7fecb8827c1c
SHA1

4d6849f6f9bee9a183375587355b9f807dbf6972
SHA256

23ae7d0cb7ab73ce40a18282ece21431ab6d3762c889675e3b554a4645b0ebf6
SHA512

fe204481fba0e45fa039f1d53330c183782f4bf70e980f07bebef2d7344464060efc04d27083ea14fd3286bb267df50fe22c67e83610e1d4534a6abf9a625033
SSDEEP

3072:JtV+WraJ4WH6An6291attOySnlKyLNM/9jzJn:JtVfraiWH6AnJ96klKyxM/9fJn

Score

6^/10

discovery

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	sshd: root@notty	649	23ae7d0cb7ab73ce40a18282ece21431ab6d3762c889675e3b554a4645b0ebf6.elf

/tmp/23ae7d0cb7ab73ce40a18282ece21431ab6d3762c889675e3b554a4645b0ebf6.elf
/tmp/23ae7d0cb7ab73ce40a18282ece21431ab6d3762c889675e3b554a4645b0ebf6.elf
1⤵
- Changes its process name
PID:649

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact