Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
39084s -
max time network
151s -
platform
linux_mipsel -
resource
debian9-mipsel-en-20211208 -
resource tags
arch:mipselimage:debian9-mipsel-en-20211208kernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
06/03/2023, 01:51
Behavioral task
behavioral1
Sample
b55cf50228e7edd1f4deee01d3303d1e41bdf02a3cde44a950dfed77f393c30a.elf
Resource
debian9-mipsel-en-20211208
debian-9-mipsel
General
-
Target
b55cf50228e7edd1f4deee01d3303d1e41bdf02a3cde44a950dfed77f393c30a.elf
-
Size
67KB
-
MD5
cf1810414f8bad05d621321880c8ad35
-
SHA1
976a10aa92d1c0e1175cc6b81ecf71c49ffe9dd3
-
SHA256
b55cf50228e7edd1f4deee01d3303d1e41bdf02a3cde44a950dfed77f393c30a
-
SHA512
e511e3427b14c28a939e781a7e89680c3e09d04e2e454b64278b26c1b98ff85b7b26ca0ccf69ee6f7753f3bb71b25910852cc1953e97bc5f8898608c6a43fbdd
-
SSDEEP
1536:s5KqO60Cg3XkLB3ILvTdt38K8ZweT4Qg:sYqO60CgH98/B
Malware Config
Signatures
-
Contacts a large (113097) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc /proc/15/cmdline /proc/15/cmdline /proc/36/cmdline /proc/36/cmdline /proc/77/cmdline /proc/77/cmdline /proc/335/cmdline /proc/335/cmdline /proc/379/cmdline /proc/379/cmdline /proc/380/cmdline /proc/380/cmdline /proc/14/cmdline /proc/14/cmdline /proc/5/cmdline /proc/5/cmdline /proc/16/cmdline /proc/16/cmdline /proc/1/cmdline /proc/1/cmdline /proc/7/cmdline /proc/7/cmdline /proc/8/cmdline /proc/8/cmdline /proc/307/cmdline /proc/307/cmdline /proc/4/cmdline /proc/4/cmdline /proc/20/cmdline /proc/20/cmdline /proc/22/cmdline /proc/22/cmdline /proc/115/cmdline /proc/115/cmdline /proc/222/cmdline /proc/222/cmdline /proc/394/cmdline /proc/394/cmdline /proc/12/cmdline /proc/12/cmdline /proc/71/cmdline /proc/71/cmdline /proc/260/cmdline /proc/260/cmdline /proc/293/cmdline /proc/293/cmdline /proc/300/cmdline /proc/300/cmdline /proc/328/cmdline /proc/328/cmdline /proc/399/cmdline /proc/399/cmdline /proc/405/cmdline /proc/405/cmdline /proc/70/cmdline /proc/70/cmdline /proc/10/cmdline /proc/10/cmdline /proc/73/cmdline /proc/73/cmdline /proc/251/cmdline /proc/251/cmdline /proc/323/cmdline /proc/323/cmdline /proc/329/cmdline /proc/329/cmdline /proc/2/cmdline /proc/2/cmdline /proc/116/cmdline /proc/116/cmdline /proc/78/cmdline /proc/78/cmdline /proc/157/cmdline /proc/157/cmdline /proc/18/cmdline /proc/18/cmdline /proc/219/cmdline /proc/219/cmdline /proc/363/cmdline /proc/363/cmdline /proc/76/cmdline /proc/76/cmdline /proc/69/cmdline /proc/69/cmdline /proc/72/cmdline /proc/72/cmdline /proc/82/cmdline /proc/82/cmdline /proc/269/cmdline /proc/269/cmdline /proc/13/cmdline /proc/13/cmdline /proc/17/cmdline /proc/17/cmdline /proc/208/cmdline /proc/208/cmdline /proc/233/cmdline /proc/233/cmdline /proc/390/cmdline /proc/390/cmdline /proc/11/cmdline /proc/11/cmdline /proc/80/cmdline /proc/80/cmdline /proc/105/cmdline /proc/105/cmdline /proc/142/cmdline /proc/142/cmdline /proc/235/cmdline /proc/235/cmdline /proc/306/cmdline /proc/306/cmdline /proc/357/cmdline /proc/357/cmdline /proc/74/cmdline /proc/74/cmdline /proc/256/cmdline /proc/256/cmdline /proc/339/cmdline /proc/339/cmdline /proc/21/cmdline /proc/21/cmdline /proc/9/cmdline /proc/9/cmdline /proc/24/cmdline /proc/24/cmdline /proc/37/cmdline /proc/37/cmdline