c18bfbc281c76cbc969185834b2c32da5efeae89136d1a0c520dcbcabb9af8bc

Analysis

max time kernel
150s
max time network
156s
platform
debian-12_armhf
resource
debian12-armhf-20240221-en
resource tags

arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
25/02/2025, 18:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IAQ94_hidakibest.arm5.elf
Size

150KB
MD5

d5c5ae66e05052befafca94b65bcf1cf
SHA1

c1f8d0b315a97922fd065957a1255aa9d9ff1d58
SHA256

c18bfbc281c76cbc969185834b2c32da5efeae89136d1a0c520dcbcabb9af8bc
SHA512

ac1ada8857860695cb4dc36253fb102c43328f7d2a6f09c9e06231f911f5f176816759acc43dd266e73bd443c70493e8863fca5753d1ebd6e41421c0611860ad
SSDEEP

3072:Tdbmn8aAEHqgSkano1DTA65hWTGU2WV7lxXmpwTsL/QMyn:he8aAEHKkdDTr5hWTGU2WV7ldmpwTsLS

Score

6^/10

discovery

Malware Config

Signatures

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	IAQ94_hidakibest.arm5.elf

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	IAQ94_hidakibest.arm5.elf

/tmp/IAQ94_hidakibest.arm5.elf
/tmp/IAQ94_hidakibest.arm5.elf
1⤵
- Reads system routing table
- Reads system network configuration
PID:705

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads