Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
151s -
platform
debian-9_armhf -
resource
debian9-armhf-20240226-en -
resource tags
arch:armhfimage:debian9-armhf-20240226-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
22/04/2024, 01:39
Behavioral task
behavioral1
Sample
80be879b8377c8c269c366c456d2fcc0336825b0424bee4c20e129e2e1ed8969.elf
Resource
debian9-armhf-20240226-en
General
-
Target
80be879b8377c8c269c366c456d2fcc0336825b0424bee4c20e129e2e1ed8969.elf
-
Size
74KB
-
MD5
8374373a2be97dcc625de716147ff1fe
-
SHA1
629895abb50371a12550a0720c4c410119dd1d23
-
SHA256
80be879b8377c8c269c366c456d2fcc0336825b0424bee4c20e129e2e1ed8969
-
SHA512
cb4093b62495432dbd9fec90644556d3dc28dbf455cfc5787dd4d2880cd5221ae7f7a1913642e215fb6be9b4779a262b37f59dac8ba28b05bf9eca0f3e19d9e8
-
SSDEEP
1536:/AZlz2ROCO6/fvqz/HYmGNZcYKb7k2v2H8pdqE1Cp:/AZIzQAcYKb7k2LpXCp
Malware Config
Signatures
-
description ioc Process File deleted /var/log/audit/audit.log 80be879b8377c8c269c366c456d2fcc0336825b0424bee4c20e129e2e1ed8969.elf -
Deletes itself 1 IoCs
pid Process 658 80be879b8377c8c269c366c456d2fcc0336825b0424bee4c20e129e2e1ed8969.elf -
Deletes system logs 1 TTPs 1 IoCs
Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
description ioc Process File deleted /var/log/syslog 80be879b8377c8c269c366c456d2fcc0336825b0424bee4c20e129e2e1ed8969.elf -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 80be879b8377c8c269c366c456d2fcc0336825b0424bee4c20e129e2e1ed8969.elf File opened for modification /dev/misc/watchdog 80be879b8377c8c269c366c456d2fcc0336825b0424bee4c20e129e2e1ed8969.elf -
Deletes log files 1 TTPs 1 IoCs
Deletes log files on the system.
description ioc Process File deleted /var/log/daemon.log 80be879b8377c8c269c366c456d2fcc0336825b0424bee4c20e129e2e1ed8969.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself uiobwsm3rq4b2s5f1rbv 658 80be879b8377c8c269c366c456d2fcc0336825b0424bee4c20e129e2e1ed8969.elf