Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
32608s -
max time network
150s -
platform
linux_armhf -
resource
debian9-armhf-en-20211208 -
resource tags
arch:armhfimage:debian9-armhf-en-20211208kernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
21/12/2022, 02:52
Behavioral task
behavioral1
Sample
5ff19fe6d7c5c0859f6d54cbe39c4766
Resource
debian9-armhf-en-20211208
debian-9-armhf
4 signatures
150 seconds
General
-
Target
5ff19fe6d7c5c0859f6d54cbe39c4766
-
Size
228KB
-
MD5
5ff19fe6d7c5c0859f6d54cbe39c4766
-
SHA1
6b99c05d0b28015f904104260fdfaabb4d0bf24f
-
SHA256
09dce1b6665ae2ab3224de5d03f3b6717888f88ba15546068ba60f6899d322ab
-
SHA512
351612adcf60d659151a246cdbc23f10d900e0ab1df1651c8813271bc6a8bb7cdd8bf8603a9295955a420a7ab3a7d3f5754593c289e65d4e5d42fe38356799c9
-
SSDEEP
6144:BtrDYHU7N7aFm68KTZ3tfierLmTiPFLYoYOtY:XrTh7aFmUT9/LmOPFLYo1Y
Score
9/10
Malware Config
Signatures
-
Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
-
Writes file to system bin folder 1 TTPs 1 IoCs
description ioc /bin/watchdog /bin/watchdog -
Modifies rc script 1 TTPs 1 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
description ioc /etc/rc.d/rc.local /etc/rc.d/rc.local -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process /proc/41/cmdline /proc/41/cmdline 5ff19fe6d7c5c0859f6d54cbe39c4766 /proc/323/cmdline /proc/323/cmdline 5ff19fe6d7c5c0859f6d54cbe39c4766 /proc/ /proc/ Process not Found /proc/14/cmdline /proc/14/cmdline Process not Found /proc/24/maps /proc/24/maps Process not Found /proc/24/cmdline /proc/24/cmdline Process not Found /proc/145/cmdline /proc/145/cmdline Process not Found /proc/428/maps /proc/428/maps Process not Found /proc/ /proc/ 5ff19fe6d7c5c0859f6d54cbe39c4766 /proc/26/cmdline /proc/26/cmdline 5ff19fe6d7c5c0859f6d54cbe39c4766 /proc/4/cmdline /proc/4/cmdline Process not Found /proc/21/maps /proc/21/maps Process not Found /proc/320/maps /proc/320/maps Process not Found /proc/74/cmdline /proc/74/cmdline 5ff19fe6d7c5c0859f6d54cbe39c4766 /proc/269/cmdline /proc/269/cmdline 5ff19fe6d7c5c0859f6d54cbe39c4766 /proc/15/cmdline /proc/15/cmdline Process not Found /proc/359/cmdline /proc/359/cmdline Process not Found /proc/391/cmdline /proc/391/cmdline Process not Found /proc/403/cmdline /proc/403/cmdline Process not Found /proc/13/cmdline /proc/13/cmdline 5ff19fe6d7c5c0859f6d54cbe39c4766 /proc/238/cmdline /proc/238/cmdline 5ff19fe6d7c5c0859f6d54cbe39c4766 /proc/20/maps /proc/20/maps Process not Found /proc/455/cmdline /proc/455/cmdline Process not Found /proc/226/cmdline /proc/226/cmdline 5ff19fe6d7c5c0859f6d54cbe39c4766 /proc/238/maps /proc/238/maps Process not Found /proc/385/maps /proc/385/maps Process not Found /proc/278/maps /proc/278/maps Process not Found /proc/399/cmdline /proc/399/cmdline Process not Found /proc/22/cmdline /proc/22/cmdline 5ff19fe6d7c5c0859f6d54cbe39c4766 /proc/26/maps /proc/26/maps Process not Found /proc/26/cmdline /proc/26/cmdline Process not Found /proc/377/maps /proc/377/maps Process not Found /proc/395/maps /proc/395/maps Process not Found /proc/396/cmdline /proc/396/cmdline Process not Found /proc/419/maps /proc/419/maps Process not Found /proc/450/cmdline /proc/450/cmdline Process not Found /proc/17/cmdline /proc/17/cmdline Process not Found /proc/42/maps /proc/42/maps Process not Found /proc/278/cmdline /proc/278/cmdline Process not Found /proc/435/maps /proc/435/maps Process not Found /proc/435/cmdline /proc/435/cmdline Process not Found /proc/445/cmdline /proc/445/cmdline Process not Found /proc/135/maps /proc/135/maps Process not Found /proc/383/cmdline /proc/383/cmdline Process not Found /proc/373/maps /proc/373/maps Process not Found /proc/381/maps /proc/381/maps Process not Found /proc/414/cmdline /proc/414/cmdline Process not Found /proc/41/maps /proc/41/maps Process not Found /proc/106/maps /proc/106/maps Process not Found /proc/316/maps /proc/316/maps Process not Found /proc/374/cmdline /proc/374/cmdline Process not Found /proc/412/cmdline /proc/412/cmdline Process not Found /proc/18/cmdline /proc/18/cmdline 5ff19fe6d7c5c0859f6d54cbe39c4766 /proc/42/cmdline /proc/42/cmdline 5ff19fe6d7c5c0859f6d54cbe39c4766 /proc/self/cmdline /proc/self/cmdline Process not Found /proc/42/cmdline /proc/42/cmdline Process not Found /proc/402/cmdline /proc/402/cmdline Process not Found /proc/1/cmdline /proc/1/cmdline 5ff19fe6d7c5c0859f6d54cbe39c4766 /proc/287/cmdline /proc/287/cmdline 5ff19fe6d7c5c0859f6d54cbe39c4766 /proc/17/maps /proc/17/maps Process not Found /proc/2/cmdline /proc/2/cmdline Process not Found /proc/21/cmdline /proc/21/cmdline Process not Found /proc/427/maps /proc/427/maps Process not Found /proc/5/cmdline /proc/5/cmdline Process not Found