Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240418-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    04/07/2024, 09:01

General

  • Target

    bd6c8c819089fc460661d184fbc15168.elf

  • Size

    33KB

  • MD5

    bd6c8c819089fc460661d184fbc15168

  • SHA1

    9626209faaed46abe1f641f8f8dae5a10a7fe466

  • SHA256

    059b8431f48c85f1e09eb2b1531e584da9e09428785beb3b9f9f6be79ece592e

  • SHA512

    746f87af0d9c247992d7ea08eb586448e19d79a7fadd942234eb6b21d2cc60c76144962e3b1cdf175e2e95fc8b8ce8275511f7e51d2e1a702a8b763576c25595

  • SSDEEP

    768:YLCEeKaNL3hT/Yds1ZHNgMtzJnm38xq7xwties3Uoz2u:dNN9/YiTHNLpmXytgz2u

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

  • Contacts a large (20602) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets 1 TTPs 1 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

  • Reads runtime system information 44 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/bd6c8c819089fc460661d184fbc15168.elf
    /tmp/bd6c8c819089fc460661d184fbc15168.elf
    1⤵
    • Modifies Watchdog functionality
    • Enumerates active TCP sockets
    • Reads system network configuration
    • Reads runtime system information
    PID:646

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads