Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
24702s -
max time network
146s -
platform
linux_mips -
resource
debian9-mipsbe-en-20211208 -
resource tags
arch:mipsimage:debian9-mipsbe-en-20211208kernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
20/09/2022, 14:46
Behavioral task
behavioral1
Sample
mips-20220920-1445.elf
Resource
debian9-mipsbe-en-20211208
3 signatures
150 seconds
General
-
Target
mips-20220920-1445.elf
-
Size
98KB
-
MD5
06eb87e3e0271a898a647e57e0e12481
-
SHA1
c76d81da9ea13e79a8a799dd6014cd4f2f3af511
-
SHA256
59de6bfdd9ed67d803bc062b5f2234fa76e339833f99963e41ca744330d14005
-
SHA512
d48a590a964721ed58c5e8dc27a3bee796700c45d809f3deb0f57e2a809227e497b59879e53351bfbe9d2edf5e8d1d31e9f59c09358d9409e4572310961f7856
-
SSDEEP
768:L8tDHzromzMYPQ8EL89els9F1jcAYjbPIEx02rKJLo+4A3Iabx31t10W34V6k3yo:4D1YzUF1YpXWJLo+4A3IaV3+JceZtXAy
Score
7/10
Malware Config
Signatures
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc /proc/net/tcp /proc/net/tcp -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc /proc/net/tcp /proc/net/tcp -
Reads runtime system information 22 IoCs
Reads data from /proc virtual filesystem.
description ioc Process /proc/308/fd /proc/308/fd Process not Found /proc/334/fd /proc/334/fd Process not Found /proc/295/fd /proc/295/fd Process not Found /proc/299/fd /proc/299/fd Process not Found /proc/155/fd /proc/155/fd Process not Found /proc/207/fd /proc/207/fd Process not Found /proc/222/fd /proc/222/fd Process not Found /proc/327/fd /proc/327/fd Process not Found /proc/333/fd /proc/333/fd Process not Found /proc/filesystems /proc/filesystems mv /proc/ /proc/ Process not Found /proc/251/fd /proc/251/fd Process not Found /proc/252/fd /proc/252/fd Process not Found /proc/filesystems /proc/filesystems mkdir /proc/224/fd /proc/224/fd Process not Found /proc/225/fd /proc/225/fd Process not Found /proc/226/fd /proc/226/fd Process not Found /proc/255/fd /proc/255/fd Process not Found /proc/273/fd /proc/273/fd Process not Found /proc/307/fd /proc/307/fd Process not Found /proc/1/fd /proc/1/fd Process not Found /proc/142/fd /proc/142/fd Process not Found
Processes
-
/tmp/mips-20220920-1445.elf/tmp/mips-20220920-1445.elf1⤵PID:324
-
/bin/shsh -c "rm -rf bin/systemd && mkdir bin; >bin/systemd && mv /tmp/mips-20220920-1445.elf bin/systemd; chmod 777 bin/systemd"1⤵PID:325
-
/bin/rmrm -rf bin/systemd2⤵PID:326
-
-
/bin/mkdirmkdir bin2⤵
- Reads runtime system information
PID:330
-
-
/bin/mvmv /tmp/mips-20220920-1445.elf bin/systemd2⤵
- Reads runtime system information
PID:331
-
-
/bin/chmodchmod 777 bin/systemd2⤵PID:332
-