Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
154s -
platform
debian-9_armhf -
resource
debian9-armhf-20231215-en -
resource tags
arch:armhfimage:debian9-armhf-20231215-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
20/12/2023, 09:25
Static task
static1
Behavioral task
behavioral1
Sample
9c6d413d849d35b2edbe557e1d408c15
Resource
debian9-armhf-20231215-en
General
-
Target
9c6d413d849d35b2edbe557e1d408c15
-
Size
131KB
-
MD5
9c6d413d849d35b2edbe557e1d408c15
-
SHA1
d6507375b7ca1e0d3885b95a7670d4310dafac71
-
SHA256
f420edf09d37f1f3857bcb8c736cec398729559ec963f003a8a83c10c4481201
-
SHA512
76dbe9ad463bacb03d4ccf22faab75bd86e20f227743d474e745429ddcf25e30021e879aed571eda9acd75264d8d5d282d8668ded23217b917b0f68cdc70328a
-
SSDEEP
3072:OVWLLftrN7AT5ftgMlNu4BCUTgQ0YELouADffiEQMM/9YogT1:OVwLftrN7AT5ftgMi2CUTgQpqolffizw
Malware Config
Signatures
-
Contacts a large (22555) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself 6h64ho1lhedwlk4tiaod 647 9c6d413d849d35b2edbe557e1d408c15 -
Deletes itself 1 IoCs
pid Process 647 9c6d413d849d35b2edbe557e1d408c15 -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc File opened for modification /dev/watchdog File opened for modification /dev/misc/watchdog -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc File opened for reading /proc/net/tcp -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc File opened for reading /proc/net/tcp