Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
157s -
platform
debian-9_armhf -
resource
debian9-armhf-20231215-en -
resource tags
-
submitted
19/12/2023, 22:46
General
-
Target
2609fffe70fa613805f9a24f289405bd
-
Size
174KB
-
MD5
2609fffe70fa613805f9a24f289405bd
-
SHA1
fae65d6c7cf8b87aaa6487d55383bacb89c3a519
-
SHA256
f846e9337020c62d9201ce945ecfe4d6486258c46787e74b7944bec76627c02b
-
SHA512
62e447b0ef2a2c950ed3f96a0598ff881478a90175a534910c5047e7dd816f4c6d9d810d1cd062a3e89936f82993089a3feffbce43b379f4f206480111920258
-
SSDEEP
3072:Pe1ywfQgR7Ee5ZiI/naVa1w/O/N2B1dO2HqsX43mGnWmgcygSw2EZAi:PMEyjaVa8OwdO2HqvmGnWmgcygSw2EZB
Malware Config
Signatures
-
Contacts a large (67827) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Changes its process name 1 IoCs
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes
-
/tmp/2609fffe70fa613805f9a24f289405bd/tmp/2609fffe70fa613805f9a24f289405bd1⤵
- Changes its process name
- Reads system routing table
- Reads system network configuration