Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
150s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240418-en -
resource tags
-
submitted
22/08/2024, 02:43
General
-
Target
f2c832b5aeb16ec1353b578f15c4ea723f3f7b950f2e94ef9cb2514941a1f85b.elf
-
Size
91KB
-
MD5
4c145f3a4f70062e99d8dbb5cbd532c1
-
SHA1
75f6a59d771d0e3e20c8b3a429954195995d19ab
-
SHA256
f2c832b5aeb16ec1353b578f15c4ea723f3f7b950f2e94ef9cb2514941a1f85b
-
SHA512
4626dd9a0bbedc510dd1062e49d6aeef8a61f0252371afdca87dc1d8e710ea2b2f3a6bd1cbf729f7c29c465fed230ca7c9970c2d9c6b353fe01b3233cae584d4
-
SSDEEP
1536:aE2c8jcS2+SfGXNPMtQKhLKh4OhN+fcLLOkibZeb4MFvuJFre:dVS2XfG9PMtHcLLOHbmvuby
Malware Config
Signatures
-
Contacts a large (68043) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Renames itself 1 IoCs
-
Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Changes its process name 1 IoCs
-
Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/f2c832b5aeb16ec1353b578f15c4ea723f3f7b950f2e94ef9cb2514941a1f85b.elf/tmp/f2c832b5aeb16ec1353b578f15c4ea723f3f7b950f2e94ef9cb2514941a1f85b.elf1⤵
- Renames itself
- Changes its process name
- Reads runtime system information