Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    la.bot.arm7.elf

  • Size

    77KB

  • Sample

    241018-f42jhssfrr

  • MD5

    6ea4a578d4cc9f805713981a9f55a97a

  • SHA1

    6982510dc00d91da25cd3e5160c9053a4a5150e3

  • SHA256

    e6dcda79ad7487e8648b5117b73bcda608829c2ebb09b17398f78145eb8f419b

  • SHA512

    dbec2be2709663247f844808d9218a9a94c2586c2179ade7f8a6bdc9af67524533a146ab7438bef8d365ba133c1b46bcbff42bff158b095d2a3c34b19485c53e

  • SSDEEP

    1536:6kntZ/gCIdy2t6RDHrnFtEjAKC9NRpUnpNpTI2/SImlMFigfkr5Ol:3JgCIdy2t4Fj7zXUnpNZI2d/fkr4

Malware Config

Targets

    • Target

      la.bot.arm7.elf

    • Size

      77KB

    • MD5

      6ea4a578d4cc9f805713981a9f55a97a

    • SHA1

      6982510dc00d91da25cd3e5160c9053a4a5150e3

    • SHA256

      e6dcda79ad7487e8648b5117b73bcda608829c2ebb09b17398f78145eb8f419b

    • SHA512

      dbec2be2709663247f844808d9218a9a94c2586c2179ade7f8a6bdc9af67524533a146ab7438bef8d365ba133c1b46bcbff42bff158b095d2a3c34b19485c53e

    • SSDEEP

      1536:6kntZ/gCIdy2t6RDHrnFtEjAKC9NRpUnpNpTI2/SImlMFigfkr5Ol:3JgCIdy2t4Fj7zXUnpNZI2d/fkr4

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Renames itself

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Reads process memory

      Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

MITRE ATT&CK Enterprise v15

Tasks