Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
28749s -
max time network
152s -
platform
linux_mipsel -
resource
debian9-mipsel-en-20211208 -
resource tags
arch:mipselimage:debian9-mipsel-en-20211208kernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
06/11/2022, 11:06
Static task
static1
Behavioral task
behavioral1
Sample
ce05a237de19a0dda5891ee4d8fc80e1.elf
Resource
debian9-mipsel-en-20211208
debian-9-mipsel
General
-
Target
ce05a237de19a0dda5891ee4d8fc80e1.elf
-
Size
37KB
-
MD5
ce05a237de19a0dda5891ee4d8fc80e1
-
SHA1
514b91292f2aa6e421603b9fc3b11b4491e62ffc
-
SHA256
5014ee8c9b5f198e1682e9650043a65258f3bcef4daf6d7f7f305ea130ca09e4
-
SHA512
a392cc3fbcb7bf75202478dcab8548bff8d8352dfcd052530604cb30b11d0d9875e1c3d71763a85b2e86012de3c9f7c38ab7a06cef6f9622b297b17ac3ea8a4c
-
SSDEEP
768:eJr8JdEdURFm7bgUl0/tUE00VXahMn42mLMshSYknc1YWB9:eZ8JDb+bdCtM2Xw7pLL/kaH9
Malware Config
Signatures
-
Contacts a large (36154) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc /proc/212/cmdline /proc/212/cmdline /proc/215/cmdline /proc/215/cmdline /proc/13/cmdline /proc/13/cmdline /proc/22/cmdline /proc/22/cmdline /proc/83/cmdline /proc/83/cmdline /proc/282/cmdline /proc/282/cmdline /proc/352/cmdline /proc/352/cmdline /proc/353/cmdline /proc/353/cmdline /proc/355/cmdline /proc/355/cmdline /proc/3/cmdline /proc/3/cmdline /proc/81/cmdline /proc/81/cmdline /proc/276/cmdline /proc/276/cmdline /proc/279/cmdline /proc/279/cmdline /proc/335/cmdline /proc/335/cmdline /proc/357/cmdline /proc/357/cmdline /proc/7/cmdline /proc/7/cmdline /proc/73/cmdline /proc/73/cmdline /proc/216/cmdline /proc/216/cmdline /proc/341/cmdline /proc/341/cmdline /proc/246/cmdline /proc/246/cmdline /proc/323/cmdline /proc/323/cmdline /proc/340/cmdline /proc/340/cmdline /proc/2/cmdline /proc/2/cmdline /proc/16/cmdline /proc/16/cmdline /proc/337/cmdline /proc/337/cmdline /proc/244/cmdline /proc/244/cmdline /proc/343/cmdline /proc/343/cmdline /proc/348/cmdline /proc/348/cmdline /proc/349/cmdline /proc/349/cmdline /proc/354/cmdline /proc/354/cmdline /proc/4/cmdline /proc/4/cmdline /proc/19/cmdline /proc/19/cmdline /proc/37/cmdline /proc/37/cmdline /proc/105/cmdline /proc/105/cmdline /proc/115/cmdline /proc/115/cmdline /proc/6/cmdline /proc/6/cmdline /proc/21/cmdline /proc/21/cmdline /proc/71/cmdline /proc/71/cmdline /proc/339/cmdline /proc/339/cmdline /proc/345/cmdline /proc/345/cmdline /proc/10/cmdline /proc/10/cmdline /proc/17/cmdline /proc/17/cmdline /proc/78/cmdline /proc/78/cmdline /proc/338/cmdline /proc/338/cmdline /proc/146/cmdline /proc/146/cmdline /proc/204/cmdline /proc/204/cmdline /proc/9/cmdline /proc/9/cmdline /proc/20/cmdline /proc/20/cmdline /proc/24/cmdline /proc/24/cmdline /proc/327/cmdline /proc/327/cmdline /proc/350/cmdline /proc/350/cmdline /proc/1/cmdline /proc/1/cmdline /proc/11/cmdline /proc/11/cmdline /proc/74/cmdline /proc/74/cmdline /proc/75/cmdline /proc/75/cmdline /proc/77/cmdline /proc/77/cmdline /proc/334/cmdline /proc/334/cmdline /proc/342/cmdline /proc/342/cmdline /proc/347/cmdline /proc/347/cmdline /proc/5/cmdline /proc/5/cmdline /proc/18/cmdline /proc/18/cmdline /proc/36/cmdline /proc/36/cmdline /proc/8/cmdline /proc/8/cmdline /proc/76/cmdline /proc/76/cmdline -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process /tmp/ce05a237de19a0dda5891ee4d8fc80e1.elf /tmp/ce05a237de19a0dda5891ee4d8fc80e1.elf ce05a237de19a0dda5891ee4d8fc80e1.elf