Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
130s -
max time network
133s -
platform
debian-9_armhf -
resource
debian9-armhf-20231215-en -
resource tags
arch:armhfimage:debian9-armhf-20231215-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
11/01/2024, 02:28
Behavioral task
behavioral1
Sample
popbang.arm7-20240111-0227.elf
Resource
debian9-armhf-20231215-en
debian-9-armhf
6 signatures
150 seconds
General
-
Target
popbang.arm7-20240111-0227.elf
-
Size
45KB
-
MD5
461f7477cdcef030861113acab02c386
-
SHA1
709e725c231860fbf3f05498f554ce0e7ef1f9b7
-
SHA256
d095a5f03d41cf3451aeb011b8ea46f1b0af1556d01cfee9b34c3df8b2fb483a
-
SHA512
ac47783d1b60ab497834e79fb3b5ba2d47d60a5c40a9e8bef19d531818cb46cc30b7400334c62d9930b3a90ff492ad0c3d3e03fd5e17b7a8a8287a14c1aec8ff
-
SSDEEP
768:5jEJR/PpxXE9b9shqNep2r3aifknpUxbk8UPHPYDaHLD8BIPAv3ewgz7XRCY:50DE9byIG2baifkpMbVUPvYWHv853QXv
Score
7/10
Malware Config
Signatures
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself 655 popbang.arm7-20240111-0227.elf -
Deletes itself 1 IoCs
pid Process 655 popbang.arm7-20240111-0227.elf -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc File opened for modification /dev/watchdog File opened for modification /dev/misc/watchdog -
Writes DNS configuration 1 TTPs 1 IoCs
Writes data to DNS resolver config file.
description ioc Process File opened for modification /etc/resolv.conf popbang.arm7-20240111-0227.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/2/maps File opened for reading /proc/41/maps File opened for reading /proc/301/maps File opened for reading /proc/584/maps File opened for reading /proc/686/maps File opened for reading /proc/9/maps File opened for reading /proc/10/maps File opened for reading /proc/795/maps File opened for reading /proc/22/maps File opened for reading /proc/664/maps File opened for reading /proc/692/maps File opened for reading /proc/595/maps File opened for reading /proc/691/maps File opened for reading /proc/742/maps File opened for reading /proc/4/maps File opened for reading /proc/585/maps File opened for reading /proc/693/maps File opened for reading /proc/796/maps File opened for reading /proc/43/maps File opened for reading /proc/306/maps File opened for reading /proc/683/maps File opened for reading /proc/744/maps File opened for reading /proc/800/maps File opened for reading /proc/12/maps File opened for reading /proc/638/maps File opened for reading /proc/737/maps File opened for reading /proc/790/maps File opened for reading /proc/3/maps File opened for reading /proc/6/maps File opened for reading /proc/15/maps File opened for reading /proc/16/maps File opened for reading /proc/752/maps File opened for reading /proc/21/maps File opened for reading /proc/28/maps File opened for reading /proc/284/maps File opened for reading /proc/17/maps File opened for reading /proc/798/maps File opened for reading /proc/272/maps File opened for reading /proc/315/maps File opened for reading /proc/661/maps File opened for reading /proc/751/maps File opened for reading /proc/783/maps File opened for reading /proc/797/maps File opened for reading /proc/14/maps File opened for reading /proc/687/maps File opened for reading /proc/743/maps File opened for reading /proc/791/maps File opened for reading /proc/7/maps File opened for reading /proc/141/maps File opened for reading /proc/145/maps File opened for reading /proc/680/maps File opened for reading /proc/740/maps File opened for reading /proc/785/maps File opened for reading /proc/789/maps File opened for reading /proc/135/maps File opened for reading /proc/136/maps File opened for reading /proc/635/maps File opened for reading /proc/689/maps File opened for reading /proc/794/maps File opened for reading /proc/750/maps File opened for reading /proc/106/maps File opened for reading /proc/690/maps File opened for reading /proc/739/maps File opened for reading /proc/749/maps