Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
debian-9_mips -
resource
debian9-mipsbe-20230831-en -
resource tags
-
submitted
05/10/2023, 19:21
General
-
Target
f44335b7b8b3fe04567de3f894ebd9634439cf30275335212cbe72805cbf58c8elf_JC.elf
-
Size
110KB
-
MD5
56914892ce20aa1bb1bc105443e1e5c6
-
SHA1
02770ca948619ccaec8b5870ea1e12097562e83c
-
SHA256
f44335b7b8b3fe04567de3f894ebd9634439cf30275335212cbe72805cbf58c8
-
SHA512
bf4c6a3b27b0e2400f46449ed2a7a1ee51deb2da6ea139e5d6bd9b14a2c1dac4e2aaff089536405f143850965c6e9436620b41587a7e963083efd78d211efc41
-
SSDEEP
1536:ZZkalZCevKSJSSSgMSnXKUFrIX3En/E1p6mtQYxWQ+qibro409eOd3Ly9df:Sejn1pIXU/E1NeYCqibro40V3Ly9df
Malware Config
Signatures
-
Contacts a large (10159) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Changes its process name 1 IoCs
-
Deletes itself 1 IoCs
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 51 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/f44335b7b8b3fe04567de3f894ebd9634439cf30275335212cbe72805cbf58c8elf_JC.elf/tmp/f44335b7b8b3fe04567de3f894ebd9634439cf30275335212cbe72805cbf58c8elf_JC.elf1⤵
- Changes its process name
- Deletes itself
- Writes file to tmp directory