Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

7

a0587444b3...70.elf

ubuntu-18.04-amd64

10

Analysis

  • max time kernel
    152s
  • max time network
    130s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20231221-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20231221-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    13/02/2024, 03:39 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a0587444b330396a655da01a7cc8405774da42b042a61812f884b95102273a70.elf

  • Size

    20KB

  • MD5

    ff6de7225359086e82701d3738bc68a8

  • SHA1

    79cc64d6d0439f769a108f2b0e1e2fe9913a870d

  • SHA256

    a0587444b330396a655da01a7cc8405774da42b042a61812f884b95102273a70

  • SHA512

    79c5c81dd533fd843f030443be0ac05ec1569f18ebea1da4261c3d85e381d01fd5cc1538b1f5f0b842a30ef0d22e247395f1180d50e0a3e7ad4b1d53bb5efabe

  • SSDEEP

    384:M0sLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkJaQNAr8vcoBAvP+qNV+KLebRtu7SyQ:k98o08kxofBE+ZkJaT47C2EpitmQ

Score
10/10
mirailzrdbotnet

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder 1 TTPs 2 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/a0587444b330396a655da01a7cc8405774da42b042a61812f884b95102273a70.elf
    /tmp/a0587444b330396a655da01a7cc8405774da42b042a61812f884b95102273a70.elf
    1⤵
      PID:1557

    Network

    • flag-us
      DNS
      cdn.fwupd.org
      Remote address:
      1.1.1.1:53
      Request
      cdn.fwupd.org
      IN A
      Response
      cdn.fwupd.org
      IN CNAME
      dualstack.p2.shared.global.fastly.net
      dualstack.p2.shared.global.fastly.net
      IN A
      151.101.66.49
      dualstack.p2.shared.global.fastly.net
      IN A
      151.101.130.49
      dualstack.p2.shared.global.fastly.net
      IN A
      151.101.194.49
      dualstack.p2.shared.global.fastly.net
      IN A
      151.101.2.49
    • flag-us
      DNS
      cdn.fwupd.org
      Remote address:
      1.1.1.1:53
      Request
      cdn.fwupd.org
      IN A
    • flag-us
      DNS
      cdn.fwupd.org
      Remote address:
      1.1.1.1:53
      Request
      cdn.fwupd.org
      IN A
    • flag-us
      DNS
      cdn.fwupd.org
      Remote address:
      1.1.1.1:53
      Request
      cdn.fwupd.org
      IN AAAA
      Response
      cdn.fwupd.org
      IN CNAME
      dualstack.p2.shared.global.fastly.net
      dualstack.p2.shared.global.fastly.net
      IN AAAA
      2a04:4e42:400::561
      dualstack.p2.shared.global.fastly.net
      IN AAAA
      2a04:4e42:600::561
      dualstack.p2.shared.global.fastly.net
      IN AAAA
      2a04:4e42::561
      dualstack.p2.shared.global.fastly.net
      IN AAAA
      2a04:4e42:200::561
    • flag-us
      DNS
      cdn.fwupd.org
      Remote address:
      1.1.1.1:53
      Request
      cdn.fwupd.org
      IN AAAA
    • flag-us
      DNS
      cdn.fwupd.org
      Remote address:
      1.1.1.1:53
      Request
      cdn.fwupd.org
      IN AAAA
    • flag-us
      DNS
      1527653184.rsc.cdn77.org
      Remote address:
      1.1.1.1:53
      Request
      1527653184.rsc.cdn77.org
      IN A
      Response
      1527653184.rsc.cdn77.org
      IN A
      195.181.164.14
      1527653184.rsc.cdn77.org
      IN A
      89.187.167.4
    • flag-us
      DNS
      1527653184.rsc.cdn77.org
      Remote address:
      1.1.1.1:53
      Request
      1527653184.rsc.cdn77.org
      IN AAAA
      Response
      1527653184.rsc.cdn77.org
      IN AAAA
      2a02:6ea0:ca00::4
      1527653184.rsc.cdn77.org
      IN AAAA
      2a02:6ea0:ca00::3
    • flag-us
      DNS
      1527653184.rsc.cdn77.org
      Remote address:
      1.1.1.1:53
      Request
      1527653184.rsc.cdn77.org
      IN AAAA
    • flag-us
      DNS
      1527653184.rsc.cdn77.org
      Remote address:
      1.1.1.1:53
      Request
      1527653184.rsc.cdn77.org
      IN AAAA
    • flag-us
      DNS
      1527653184.rsc.cdn77.org
      Remote address:
      1.1.1.1:53
      Request
      1527653184.rsc.cdn77.org
      IN AAAA
    • flag-us
      DNS
      1527653184.rsc.cdn77.org
      Remote address:
      1.1.1.1:53
      Request
      1527653184.rsc.cdn77.org
      IN AAAA
    • 151.101.130.49:443
      tls
      779 B
       11
    • 151.101.1.91:443
      tls
      779 B
       11
    • 195.181.164.14:443
      tls
      851 B
       11
    • 93.123.85.11:3778
      180 B
       3
    • 151.101.2.49:443
      cdn.fwupd.org
      tls
      1.8kB
       5.4kB
       17
      7
    • 185.125.188.62:443
      tls
      135 B
       2
    • 185.125.188.61:443
      tls
      135 B
       2
    • 151.101.1.91:443
      240 B
       4
    • 151.101.65.91:443
      240 B
       4
    • 151.101.129.91:443
      240 B
       4
    • 151.101.193.91:443
      extensions.gnome.org
      tls
      1.9kB
       60 B
       10
      1
    • 89.187.167.4:443
      odrs.gnome.org
      tls
      20.8kB
       1.6MB
       384
      1189
    • 224.0.0.251:5353
      146 B
       2
    • 1.1.1.1:53
      cdn.fwupd.org
      dns
      210 B
       185 B
       3
      1

      DNS Request

      cdn.fwupd.org

      DNS Request

      cdn.fwupd.org

      DNS Request

      cdn.fwupd.org

      DNS Response

      151.101.66.49
      151.101.130.49
      151.101.194.49
      151.101.2.49

    • 1.1.1.1:53
      cdn.fwupd.org
      dns
      210 B
       233 B
       3
      1

      DNS Request

      cdn.fwupd.org

      DNS Request

      cdn.fwupd.org

      DNS Request

      cdn.fwupd.org

      DNS Response

      2a04:4e42:400::561
      2a04:4e42:600::561
      2a04:4e42::561
      2a04:4e42:200::561

    • 1.1.1.1:53
      1527653184.rsc.cdn77.org
      dns
      81 B
       113 B
       1
      1

      DNS Request

      1527653184.rsc.cdn77.org

      DNS Response

      195.181.164.14
      89.187.167.4

    • 1.1.1.1:53
      1527653184.rsc.cdn77.org
      dns
      405 B
       137 B
       5
      1

      DNS Request

      1527653184.rsc.cdn77.org

      DNS Request

      1527653184.rsc.cdn77.org

      DNS Request

      1527653184.rsc.cdn77.org

      DNS Request

      1527653184.rsc.cdn77.org

      DNS Request

      1527653184.rsc.cdn77.org

      DNS Response

      2a02:6ea0:ca00::4
      2a02:6ea0:ca00::3

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.