Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240611-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
10/07/2024, 06:43
Behavioral task
behavioral1
Sample
226af5f4878091cceb4ffdc0930fd880.elf
Resource
debian9-mipsbe-20240611-en
General
-
Target
226af5f4878091cceb4ffdc0930fd880.elf
-
Size
77KB
-
MD5
226af5f4878091cceb4ffdc0930fd880
-
SHA1
9c47e7eb60c04ebf1fb7142e5bc147443a5bd876
-
SHA256
baf7139b1b373cc6e6f9a77b45fe119b7fcf75f457cf0378216ab3a76002ff17
-
SHA512
69ba65fd61af68e00908bd1c6999e2b79f27bd83bc070a9e4cad50eacae1a80b34b5bd06a4a1f6e43c227dd165b1cc2fdce261fa6236f40d5d3ae26bae4e01da
-
SSDEEP
1536:26OHayEW+YOtZtNvXXb6D0vRp+2Db+32EHi4a1BcXbf7oyvur:kHUJYIVq0Z02QNHi4lXL7oKk
Malware Config
Signatures
-
Contacts a large (20532) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 226af5f4878091cceb4ffdc0930fd880.elf File opened for modification /dev/misc/watchdog 226af5f4878091cceb4ffdc0930fd880.elf -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp 226af5f4878091cceb4ffdc0930fd880.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp 226af5f4878091cceb4ffdc0930fd880.elf -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/1149/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/1186/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/1236/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/710/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/890/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/997/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/1006/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/793/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/1038/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/1117/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/1161/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/325/fd 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/696/fd 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/668/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/700/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/1176/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/148/fd 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/901/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/1153/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/1268/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/1280/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/1/fd 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/695/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/1050/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/1203/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/1065/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/1071/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/1197/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/1209/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/696/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/811/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/907/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/1012/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/1301/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/695/fd 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/940/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/967/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/1230/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/1128/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/374/fd 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/874/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/985/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/1062/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/956/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/1018/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/1131/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/241/fd 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/807/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/857/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/880/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/913/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/1029/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/1084/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/1096/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/707/fd 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/805/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/1121/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/326/fd 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/358/fd 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/382/fd 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/673/fd 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/1307/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/1328/exe 226af5f4878091cceb4ffdc0930fd880.elf File opened for reading /proc/863/exe 226af5f4878091cceb4ffdc0930fd880.elf