Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
debian-9_mips -
resource
debian9-mipsbe-20231222-en -
resource tags
arch:mipsimage:debian9-mipsbe-20231222-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
13/02/2024, 02:59
Behavioral task
behavioral1
Sample
02fbbe2be07977009b820832f285cdbdf2ee5356dfb9849d340623a99c6dbbb0.elf
Resource
debian9-mipsbe-20231222-en
debian-9-mips
General
-
Target
02fbbe2be07977009b820832f285cdbdf2ee5356dfb9849d340623a99c6dbbb0.elf
-
Size
66KB
-
MD5
79982cc2cf9d89f148b7c1aeb2ca8e96
-
SHA1
f81dca859e788620037a303bfb30414ab97a897e
-
SHA256
02fbbe2be07977009b820832f285cdbdf2ee5356dfb9849d340623a99c6dbbb0
-
SHA512
6567507abef81e418c9c3b43421053dc2801715ab589cb7d27dc57447e3741ef81be5624780b74079ed840006feb5a4cfd8a9bca35e79f439ad1d2ed9b59a384
-
SSDEEP
768:TVlVF+tKLGNApNpFtFNffS6qNSb3BaD741gP6tGUrQoBacyUBU5wkZL:X6yRNf1KPyFY2Uikx
Malware Config
Signatures
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a 710 02fbbe2be07977009b820832f285cdbdf2ee5356dfb9849d340623a99c6dbbb0.elf -
Deletes itself 1 IoCs
pid Process 710 02fbbe2be07977009b820832f285cdbdf2ee5356dfb9849d340623a99c6dbbb0.elf -
Renames itself 2 IoCs
pid Process 710 02fbbe2be07977009b820832f285cdbdf2ee5356dfb9849d340623a99c6dbbb0.elf 710 02fbbe2be07977009b820832f285cdbdf2ee5356dfb9849d340623a99c6dbbb0.elf -
Unexpected DNS network traffic destination 64 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 94.16.114.254 Destination IP 94.16.114.254 Destination IP 194.36.144.87 Destination IP 94.16.114.254 Destination IP 168.138.12.137 Destination IP 178.254.22.166 Destination IP 35.211.96.150 Destination IP 103.1.206.179 Destination IP 130.61.69.123 Destination IP 130.61.64.122 Destination IP 51.254.162.59 Destination IP 63.231.92.27 Destination IP 63.231.92.27 Destination IP 130.61.69.123 Destination IP 94.16.114.254 Destination IP 51.254.162.59 Destination IP 103.1.206.179 Destination IP 134.195.4.2 Destination IP 94.16.114.254 Destination IP 35.211.96.150 Destination IP 88.198.92.222 Destination IP 80.152.203.134 Destination IP 51.254.162.59 Destination IP 38.103.195.4 Destination IP 45.61.49.203 Destination IP 81.169.136.222 Destination IP 89.163.140.67 Destination IP 168.138.12.137 Destination IP 168.138.12.137 Destination IP 162.243.19.47 Destination IP 168.138.12.137 Destination IP 168.138.12.137 Destination IP 51.158.108.203 Destination IP 45.84.1.149 Destination IP 130.61.64.122 Destination IP 65.21.1.106 Destination IP 168.138.12.137 Destination IP 80.152.203.134 Destination IP 64.176.6.48 Destination IP 194.36.144.87 Destination IP 65.21.1.106 Destination IP 94.16.114.254 Destination IP 38.103.195.4 Destination IP 195.10.195.195 Destination IP 38.103.195.4 Destination IP 88.198.92.222 Destination IP 80.152.203.134 Destination IP 134.195.4.2 Destination IP 134.195.4.2 Destination IP 35.211.96.150 Destination IP 80.152.203.134 Destination IP 94.16.114.254 Destination IP 65.21.1.106 Destination IP 88.198.92.222 Destination IP 103.1.206.179 Destination IP 51.254.162.59 Destination IP 194.36.144.87 Destination IP 130.61.69.123 Destination IP 194.36.144.87 Destination IP 178.254.22.166 Destination IP 192.3.165.37 Destination IP 130.61.64.122 Destination IP 130.61.64.122 Destination IP 178.254.22.166 -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc File opened for reading /proc/net/tcp -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc File opened for reading /proc/net/tcp