Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
153s -
platform
debian-9_armhf -
resource
debian9-armhf-20231215-en -
resource tags
-
submitted
19/12/2023, 22:26
General
-
Target
092818efce0dc46b5c5d22c922244d61
-
Size
70KB
-
MD5
092818efce0dc46b5c5d22c922244d61
-
SHA1
1c000baec2d6c88c2ba9392950692dbdcc8dffb3
-
SHA256
1b3999cd82775eab703d50229a08e64b83f6ef53539eb4bb12ba4ae32d66b51d
-
SHA512
aa29c12b08140a8f25e08a8d8d3f13ba2db9f799e42d376e64d4ce26bf47a86b422647a7b4b66d17271f261e87d1da9a9e7783ae2591683e4447431df4dc91a0
-
SSDEEP
1536:GbtexU5L9XouIRhb96pUQzXtwavaJ3V8OHxouJeZWDFI8VM:GbtexU0r8QCKw2FbS
Malware Config
Signatures
-
Contacts a large (20279) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 44 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/092818efce0dc46b5c5d22c922244d61/tmp/092818efce0dc46b5c5d22c922244d611⤵