Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
156s -
platform
debian-12_armhf -
resource
debian12-armhf-20240221-en -
resource tags
arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
02/10/2024, 14:58
Behavioral task
behavioral1
Sample
yakov.arm7.elf
Resource
debian12-armhf-20240221-en
General
-
Target
yakov.arm7.elf
-
Size
47KB
-
MD5
5b1f3db09b31b8ef14d8f8eb9ab0b9a3
-
SHA1
be7468e9560b82a81370fa14ae8b14d0e1df21a9
-
SHA256
f54e1156880d0f3e39fc0503230f94f0bbd5486ff8a15eae2a8d5f82b8663ff6
-
SHA512
1a08d1e58e698d315c3524683f20fc8d2176baae87578077c4d137345d9654e560dfe07caf4eef5e83ab13b8f082e8e4ef4687944a1b5d34bfb9f310c2d7b47c
-
SSDEEP
768:vu0Uuq71GZJoWQ2QSgwg0lggM7f0fF69q3UELMfYyHJ2wpDN/pg:vtfUGP5Q2QYll4cRLMfYoN6
Malware Config
Extracted
mirai
LZRD
Signatures
-
Contacts a large (20523) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog yakov.arm7.elf File opened for modification /dev/misc/watchdog yakov.arm7.elf -
description ioc Process File opened for reading /proc/self/exe yakov.arm7.elf