Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
debian-9_armhf -
resource
debian9-armhf-20231222-en -
resource tags
arch:armhfimage:debian9-armhf-20231222-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
22/12/2023, 14:05
Behavioral task
behavioral1
Sample
b63e34a355379db646e01b5a3540bcbd
Resource
debian9-armhf-20231222-en
General
-
Target
b63e34a355379db646e01b5a3540bcbd
-
Size
73KB
-
MD5
b63e34a355379db646e01b5a3540bcbd
-
SHA1
95f681f5587e3e0a9d52c12a8d169e2632a0eddb
-
SHA256
ce0d9cc5fefd937c0472c95a8b7991de322e39fc5ca31cef1a87350e8b9844a6
-
SHA512
bd9cb8a429add3ca8cde5d3592796491b985f6e133b9873f6984d3c8ab7907cbc74126a54c31f1bb2bef8dd6a2a413f66c0556db8547389dc44c0a12ad1e6ba6
-
SSDEEP
1536:VKopURgnc0KwH7BqFcxrRbxLkr85n6KZgsAf5H/XA5F7xCRAOv/:VKopURC3Z5+5fXmNA/
Malware Config
Signatures
-
Contacts a large (23832) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog b63e34a355379db646e01b5a3540bcbd File opened for modification /dev/misc/watchdog b63e34a355379db646e01b5a3540bcbd -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads runtime system information 26 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/577/smaps File opened for reading /proc/687/smaps File opened for reading /proc/788/smaps File opened for reading /proc/794/smaps File opened for reading /proc/588/smaps File opened for reading /proc/786/smaps File opened for reading /proc/798/smaps File opened for reading /proc/575/smaps File opened for reading /proc/784/smaps File opened for reading /proc/790/smaps File opened for reading /proc/664/smaps File opened for reading /proc/802/smaps File opened for reading /proc/775/smaps File opened for reading /proc/777/smaps File opened for reading /proc/782/smaps File opened for reading /proc/659/smaps File opened for reading /proc/663/smaps File opened for reading /proc/665/smaps File opened for reading /proc/723/smaps File opened for reading /proc/579/smaps File opened for reading /proc/620/smaps File opened for reading /proc/691/smaps File opened for reading /proc/792/smaps File opened for reading /proc/796/smaps File opened for reading /proc/686/smaps File opened for reading /proc/800/smaps