Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
150s -
platform
debian-9_armhf -
resource
debian9-armhf-20231215-en -
resource tags
arch:armhfimage:debian9-armhf-20231215-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
12/02/2024, 02:21
Behavioral task
behavioral1
Sample
172ecd2ed9f56c27d915edda6dffebda627b2f7de3ed79254e06a9e5da3b8567.elf
Resource
debian9-armhf-20231215-en
debian-9-armhf
3 signatures
150 seconds
General
-
Target
172ecd2ed9f56c27d915edda6dffebda627b2f7de3ed79254e06a9e5da3b8567.elf
-
Size
164KB
-
MD5
e1d3c49a5b6f2480608dd318a3cd7ef1
-
SHA1
f92669e583579768317ff90fe812e31dd9ac25a6
-
SHA256
172ecd2ed9f56c27d915edda6dffebda627b2f7de3ed79254e06a9e5da3b8567
-
SHA512
c38241629ab613bd83bbe364c635608bda1e733784c5e0ce696ce0218884bc6bea8064777dce9febc1e1a92f17d493a7e9142119dc0aa265c62969da1371f1fd
-
SSDEEP
3072:QYa2eFdHlkQaNcTZeZz/oMsCXPtW/szDDohM/RXpsBQl:HeFt2QaNcTZ6zwy1W/cshM/R2al
Score
7/10
Malware Config
Signatures
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a- M" ! 664 172ecd2ed9f56c27d915edda6dffebda627b2f7de3ed79254e06a9e5da3b8567.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/5/cmdline File opened for reading /proc/753/cmdline File opened for reading /proc/41/cmdline File opened for reading /proc/278/cmdline File opened for reading /proc/682/cmdline File opened for reading /proc/724/cmdline File opened for reading /proc/717/cmdline File opened for reading /proc/12/cmdline File opened for reading /proc/14/cmdline File opened for reading /proc/42/cmdline File opened for reading /proc/311/cmdline File opened for reading /proc/584/cmdline File opened for reading /proc/683/cmdline File opened for reading /proc/700/cmdline File opened for reading /proc/729/cmdline File opened for reading /proc/760/cmdline File opened for reading /proc/7/cmdline File opened for reading /proc/8/cmdline File opened for reading /proc/673/cmdline File opened for reading /proc/698/cmdline File opened for reading /proc/738/cmdline File opened for reading /proc/779/cmdline File opened for reading /proc/13/cmdline File opened for reading /proc/28/cmdline File opened for reading /proc/590/cmdline File opened for reading /proc/744/cmdline File opened for reading /proc/776/cmdline File opened for reading /proc/4/cmdline File opened for reading /proc/668/cmdline File opened for reading /proc/703/cmdline File opened for reading /proc/754/cmdline File opened for reading /proc/752/cmdline File opened for reading /proc/26/cmdline File opened for reading /proc/136/cmdline File opened for reading /proc/581/cmdline File opened for reading /proc/646/cmdline File opened for reading /proc/676/cmdline File opened for reading /proc/731/cmdline File opened for reading /proc/737/cmdline File opened for reading /proc/757/cmdline File opened for reading /proc/24/cmdline File opened for reading /proc/25/cmdline File opened for reading /proc/43/cmdline File opened for reading /proc/641/cmdline File opened for reading /proc/694/cmdline File opened for reading /proc/769/cmdline File opened for reading /proc/681/cmdline File opened for reading /proc/747/cmdline File opened for reading /proc/755/cmdline File opened for reading /proc/777/cmdline File opened for reading /proc/696/cmdline File opened for reading /proc/1/cmdline File opened for reading /proc/2/cmdline File opened for reading /proc/96/cmdline File opened for reading /proc/680/cmdline File opened for reading /proc/685/cmdline File opened for reading /proc/693/cmdline File opened for reading /proc/695/cmdline File opened for reading /proc/710/cmdline File opened for reading /proc/726/cmdline File opened for reading /proc/770/cmdline File opened for reading /proc/733/cmdline File opened for reading /proc/10/cmdline File opened for reading /proc/27/cmdline