Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
31123s -
max time network
152s -
platform
linux_mips -
resource
debian9-mipsbe-en-20211208 -
resource tags
arch:mipsimage:debian9-mipsbe-en-20211208kernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
03/12/2022, 22:25
Static task
static1
Behavioral task
behavioral1
Sample
bok.mips.elf
Resource
debian9-mipsbe-en-20211208
debian-9-mips
General
-
Target
bok.mips.elf
-
Size
35KB
-
MD5
0b5ae6ba278b23c1ea27348124ec3a52
-
SHA1
6ebebd8d27bca649668773ee41c229a09e50d081
-
SHA256
c161fde26a1635e1103a6a9a8a837c8856f14400313eb77feba5a215fe1bd2d7
-
SHA512
a67000ee1fcffda1bd8d8fbe9bf08d689e326465a1fffa863fa02ccf84263efb42b74fc3db78ce7d090e359536fc6ab73052626b1a9ebacd496aa05766fc56c9
-
SSDEEP
768:baCOZ31VTepOEjCjfvwM04oazl/gs/s6Y/d6JgGlzDpbuR1Jm:g1VTKOEjCzSnil/gsUZdeVJuQ
Malware Config
Signatures
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc /proc/36/cmdline /proc/36/cmdline /proc/142/cmdline /proc/142/cmdline /proc/363/cmdline /proc/363/cmdline /proc/394/cmdline /proc/394/cmdline /proc/5/cmdline /proc/5/cmdline /proc/23/cmdline /proc/23/cmdline /proc/223/cmdline /proc/223/cmdline /proc/251/cmdline /proc/251/cmdline /proc/255/cmdline /proc/255/cmdline /proc/337/cmdline /proc/337/cmdline /proc/349/cmdline /proc/349/cmdline /proc/402/cmdline /proc/402/cmdline /proc/22/cmdline /proc/22/cmdline /proc/37/cmdline /proc/37/cmdline /proc/114/cmdline /proc/114/cmdline /proc/340/cmdline /proc/340/cmdline /proc/365/cmdline /proc/365/cmdline /proc/381/cmdline /proc/381/cmdline /proc/273/cmdline /proc/273/cmdline /proc/326/cmdline /proc/326/cmdline /proc/374/cmdline /proc/374/cmdline /proc/377/cmdline /proc/377/cmdline /proc/9/cmdline /proc/9/cmdline /proc/360/cmdline /proc/360/cmdline /proc/389/cmdline /proc/389/cmdline /proc/69/cmdline /proc/69/cmdline /proc/359/cmdline /proc/359/cmdline /proc/387/cmdline /proc/387/cmdline /proc/8/cmdline /proc/8/cmdline /proc/351/cmdline /proc/351/cmdline /proc/373/cmdline /proc/373/cmdline /proc/392/cmdline /proc/392/cmdline /proc/307/cmdline /proc/307/cmdline /proc/4/cmdline /proc/4/cmdline /proc/24/cmdline /proc/24/cmdline /proc/352/cmdline /proc/352/cmdline /proc/376/cmdline /proc/376/cmdline /proc/13/cmdline /proc/13/cmdline /proc/222/cmdline /proc/222/cmdline /proc/225/cmdline /proc/225/cmdline /proc/335/cmdline /proc/335/cmdline /proc/378/cmdline /proc/378/cmdline /proc/366/cmdline /proc/366/cmdline /proc/14/cmdline /proc/14/cmdline /proc/18/cmdline /proc/18/cmdline /proc/79/cmdline /proc/79/cmdline /proc/155/cmdline /proc/155/cmdline /proc/344/cmdline /proc/344/cmdline /proc/347/cmdline /proc/347/cmdline /proc/364/cmdline /proc/364/cmdline /proc/367/cmdline /proc/367/cmdline /proc/369/cmdline /proc/369/cmdline /proc/382/cmdline /proc/382/cmdline /proc/342/cmdline /proc/342/cmdline /proc/398/cmdline /proc/398/cmdline /proc/15/cmdline /proc/15/cmdline /proc/346/cmdline /proc/346/cmdline /proc/401/cmdline /proc/401/cmdline /proc/207/cmdline /proc/207/cmdline /proc/348/cmdline /proc/348/cmdline /proc/354/cmdline /proc/354/cmdline /proc/391/cmdline /proc/391/cmdline /proc/2/cmdline /proc/2/cmdline /proc/12/cmdline /proc/12/cmdline -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process /tmp/bok.mips.elf /tmp/bok.mips.elf bok.mips.elf