Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
142s -
platform
linux_armhf -
resource
debian9-armhf-en-20211208 -
resource tags
arch:armhfimage:debian9-armhf-en-20211208kernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
16/10/2023, 12:45
Behavioral task
behavioral1
Sample
NEAS.NEAS66905502163c56e099aeba148c130e21f6dc666d099365cba01348c87126aa31elfelf_JC.elf
Resource
debian9-armhf-en-20211208
General
-
Target
NEAS.NEAS66905502163c56e099aeba148c130e21f6dc666d099365cba01348c87126aa31elfelf_JC.elf
-
Size
146KB
-
MD5
b05384f4df810485f7869218af37c9f6
-
SHA1
b568bd6791f1ec9b2b6001fcdbf8a3466edcc07e
-
SHA256
66905502163c56e099aeba148c130e21f6dc666d099365cba01348c87126aa31
-
SHA512
03cfa15962c38d97c01d8d8fc05464a06bd08cb915e129426132453d7e224e73f2ac13424be00443921f4d4d41daa9d238a4797f5c7b384101d358e4243a7148
-
SSDEEP
3072:ut8iFDKEfFN+Fa+1sWFh7n1erM/9pUMbmQwfCMQiGW:s8iFDLf/+FaN0h7nsrM/9p5mQwfCDiGW
Malware Config
Signatures
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/route NEAS.NEAS66905502163c56e099aeba148c130e21f6dc666d099365cba01348c87126aa31elfelf_JC.elf -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/route NEAS.NEAS66905502163c56e099aeba148c130e21f6dc666d099365cba01348c87126aa31elfelf_JC.elf