Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
154s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20231215-en -
resource tags
arch:mipselimage:debian9-mipsel-20231215-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
20/12/2023, 09:49
General
-
Target
9ea571eae4e7531b2d6235bc6342e28e
-
Size
31KB
-
MD5
9ea571eae4e7531b2d6235bc6342e28e
-
SHA1
2d3e333d8f0beb549784c68c32cdc117e9b67838
-
SHA256
2d74ccb0ea0853e80b11a99c738e32d8a031a161fd73c7ecfd83ef324803f4a1
-
SHA512
6de50bbfce843ec44dda4d02087b963c644a51d613f968458c3346e521594c4dde2ea43e08ee00a09b0d59561ffed5c4de690486db372be6439184ae7deb49d7
-
SSDEEP
384:f6qBpsx9W82ArxSUFkk56WDWJ8opxowbOoN0B4GodzADf1Nul1eWsVDndL9ZRWGv:SqIx9aA9SUsWEpKwKoN0BuMDPySnWa
Malware Config
Extracted
mirai
RIFT
Signatures
-
Contacts a large (23365) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself NK^LH\8 710 9ea571eae4e7531b2d6235bc6342e28e -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc File opened for modification /dev/watchdog File opened for modification /dev/misc/watchdog -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc File opened for reading /proc/net/tcp -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 1 TTPs 1 IoCs
description ioc File opened for modification /sbin/watchdog -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc File opened for reading /proc/net/tcp -
Reads runtime system information 38 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/694/maps File opened for reading /proc/144/fd File opened for reading /proc/712/fd File opened for reading /proc/548/maps File opened for reading /proc/572/maps File opened for reading /proc/703/maps File opened for reading /proc/719/maps File opened for reading /proc/168/fd File opened for reading /proc/714/fd File opened for reading /proc/533/maps File opened for reading /proc/697/maps File opened for reading /proc/318/fd File opened for reading /proc/350/fd File opened for reading /proc/372/fd File opened for reading /proc/533/fd File opened for reading /proc/573/fd File opened for reading /proc/716/fd File opened for reading /proc/695/maps File opened for reading /proc/680/maps File opened for reading /proc/716/maps File opened for reading /proc/344/fd File opened for reading /proc/371/fd File opened for reading /proc/680/fd File opened for reading /proc/699/maps File opened for reading /proc/320/fd File opened for reading /proc/348/fd File opened for reading /proc/379/fd File opened for reading /proc/1/fd File opened for reading /proc/573/maps File opened for reading /proc/735/maps File opened for reading /proc/548/fd File opened for reading /proc/408/maps File opened for reading /proc/712/maps File opened for reading /proc/714/maps File opened for reading /proc/230/fd File opened for reading /proc/408/fd File opened for reading /proc/572/fd File opened for reading /proc/700/maps