Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
102s -
platform
linux_amd64 -
resource
ubuntu1804-amd64-en-20211208 -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
14/05/2023, 11:30
General
-
Target
boatnet.x86.elf
-
Size
20KB
-
MD5
be8d693609ae90f6298ac8c8c266de14
-
SHA1
32c7b2736849cf611408674f9dae5b2f254409b1
-
SHA256
32f235cf162849caeafc87151cbd868b3d4f9aec63a7753fff5d96cdb82dae41
-
SHA512
5ee0c6dd1ad213f6010aefd5661d65f980ce08db4cf9b104aa1a550d11479a923e512f8a73cd993e280a34a0b2cdc6bfabd6a4ada72afc57723f95822dbdb3a2
-
SSDEEP
384:Mg9Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oT3:798o08kxofBE+ZkXaITbp2F2TWul0c5z
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
-
Writes file to system bin folder 1 TTPs 2 IoCs
description ioc File opened for modification /sbin/watchdog File opened for modification /bin/watchdog -
Reads runtime system information 16 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/615/cmdline File opened for reading /proc/678/cmdline File opened for reading /proc/409/cmdline File opened for reading /proc/424/cmdline File opened for reading /proc/591/cmdline File opened for reading /proc/606/cmdline File opened for reading /proc/565/cmdline File opened for reading /proc/592/cmdline File opened for reading /proc/599/cmdline File opened for reading /proc/690/cmdline File opened for reading /proc/460/cmdline File opened for reading /proc/600/cmdline File opened for reading /proc/682/cmdline File opened for reading /proc/422/cmdline File opened for reading /proc/593/cmdline File opened for reading /proc/594/cmdline