Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
152s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20231215-en -
resource tags
arch:mipselimage:debian9-mipsel-20231215-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
12/02/2024, 04:36
Static task
static1
Behavioral task
behavioral1
Sample
84e799494544b7c5043a7f26bca343fa096bb063ef4a8fde5c92558ab2c0d34c.elf
Resource
debian9-mipsel-20231215-en
debian-9-mipsel
3 signatures
150 seconds
General
-
Target
84e799494544b7c5043a7f26bca343fa096bb063ef4a8fde5c92558ab2c0d34c.elf
-
Size
157KB
-
MD5
845f9aa3337ece67e431664ebc82021b
-
SHA1
d79d163c8a674e2aac10074e47593adc033cd255
-
SHA256
84e799494544b7c5043a7f26bca343fa096bb063ef4a8fde5c92558ab2c0d34c
-
SHA512
0f02f612850281b2358a495863f52e57b02a676b63f5b166baed1072e249bf1916101a3169da397b319f81b48342ca1013bec16e125bca265e8addc1837c77e5
-
SSDEEP
3072:2tcIXjWn0uhTEb24H6SrLIx/YuNkdqAl:2xjWBTEv6qLiAuNEl
Score
7/10
Malware Config
Signatures
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a- M" ! 713 84e799494544b7c5043a7f26bca343fa096bb063ef4a8fde5c92558ab2c0d34c.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/740/cmdline File opened for reading /proc/754/cmdline File opened for reading /proc/776/cmdline File opened for reading /proc/333/cmdline File opened for reading /proc/728/cmdline File opened for reading /proc/717/cmdline File opened for reading /proc/727/cmdline File opened for reading /proc/738/cmdline File opened for reading /proc/745/cmdline File opened for reading /proc/768/cmdline File opened for reading /proc/809/cmdline File opened for reading /proc/69/cmdline File opened for reading /proc/543/cmdline File opened for reading /proc/578/cmdline File opened for reading /proc/723/cmdline File opened for reading /proc/753/cmdline File opened for reading /proc/764/cmdline File opened for reading /proc/788/cmdline File opened for reading /proc/799/cmdline File opened for reading /proc/82/cmdline File opened for reading /proc/386/cmdline File opened for reading /proc/732/cmdline File opened for reading /proc/755/cmdline File opened for reading /proc/766/cmdline File opened for reading /proc/784/cmdline File opened for reading /proc/801/cmdline File opened for reading /proc/806/cmdline File opened for reading /proc/22/cmdline File opened for reading /proc/81/cmdline File opened for reading /proc/73/cmdline File opened for reading /proc/327/cmdline File opened for reading /proc/746/cmdline File opened for reading /proc/747/cmdline File opened for reading /proc/756/cmdline File opened for reading /proc/791/cmdline File opened for reading /proc/7/cmdline File opened for reading /proc/16/cmdline File opened for reading /proc/803/cmdline File opened for reading /proc/808/cmdline File opened for reading /proc/810/cmdline File opened for reading /proc/751/cmdline File opened for reading /proc/775/cmdline File opened for reading /proc/765/cmdline File opened for reading /proc/793/cmdline File opened for reading /proc/795/cmdline File opened for reading /proc/18/cmdline File opened for reading /proc/734/cmdline File opened for reading /proc/148/cmdline File opened for reading /proc/716/cmdline File opened for reading /proc/20/cmdline File opened for reading /proc/120/cmdline File opened for reading /proc/702/cmdline File opened for reading /proc/731/cmdline File opened for reading /proc/762/cmdline File opened for reading /proc/778/cmdline File opened for reading /proc/781/cmdline File opened for reading /proc/783/cmdline File opened for reading /proc/23/cmdline File opened for reading /proc/156/cmdline File opened for reading /proc/789/cmdline File opened for reading /proc/802/cmdline File opened for reading /proc/683/cmdline File opened for reading /proc/763/cmdline File opened for reading /proc/71/cmdline