Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
123s -
max time network
150s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240418-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
22/08/2024, 01:15
Static task
static1
Behavioral task
behavioral1
Sample
28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf
Resource
debian9-mipsbe-20240418-en
General
-
Target
28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf
-
Size
80KB
-
MD5
b15a935246018d21335632060ff6db6c
-
SHA1
79e80a929268f8361242e53f97db3d93a94a4650
-
SHA256
28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86
-
SHA512
75cc9ab1f28dbc80d187f7b80ddf1540ef8093b1ea404cb51950714c23d59de922b91bfac7e883bd1449d7cf3cab3ac34d4208991374290e8f87d9623a25b579
-
SSDEEP
1536:c5dkjueVIuJjj6kZONnONgpNFGIv3W9tmgFUBeI9KJZC2:cHJeVIuJH6kuvG93FUfKfb
Malware Config
Signatures
-
Contacts a large (54036) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Renames itself 1 IoCs
pid Process 730 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf -
Unexpected DNS network traffic destination 11 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 217.160.70.42 Destination IP 137.220.52.23 Destination IP 65.21.1.106 Destination IP 65.21.1.106 Destination IP 81.169.136.222 Destination IP 152.53.15.127 Destination IP 70.34.254.19 Destination IP 5.161.109.23 Destination IP 139.84.165.176 Destination IP 137.220.52.23 Destination IP 137.220.52.23 -
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /bin/busybox telentd 730 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/836/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/24/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/371/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/815/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/792/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/800/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/822/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/20/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/164/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/221/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/818/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/832/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/14/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/21/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/802/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/750/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/755/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/823/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/19/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/71/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/75/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/779/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/785/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/807/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/788/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/817/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/11/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/12/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/149/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/808/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/826/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/147/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/732/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/780/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/777/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/830/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/6/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/738/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/763/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/114/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/744/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/773/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/115/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/761/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/838/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/327/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/767/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/359/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/726/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/735/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/775/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/778/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/22/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/37/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/328/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/770/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/776/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/17/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/81/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/764/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/749/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/782/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/790/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf File opened for reading /proc/794/cmdline 28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf