Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
5s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240418-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
10/12/2024, 02:46
Behavioral task
behavioral1
Sample
64aef5e09f70468794dcf5228a0c9d956316ca0cb4d941434195f04e61bbaf4a.elf
Resource
debian9-mipsbe-20240418-en
General
-
Target
64aef5e09f70468794dcf5228a0c9d956316ca0cb4d941434195f04e61bbaf4a.elf
-
Size
23KB
-
MD5
d0429f93afa91903dd7eb051b907ccb0
-
SHA1
1252bc4c7eeab5bafc5d8233fa3cfa2fe40a3524
-
SHA256
64aef5e09f70468794dcf5228a0c9d956316ca0cb4d941434195f04e61bbaf4a
-
SHA512
9ee5fca939497f4f738d072f2d7a20c59242e287c31eb2dadcc01f22fe7fbb05a8c1838760b5194936cced3cbc805db761beb7f19073bb579e5a091e205adfed
-
SSDEEP
384:YeD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtuiRVmdtJgGlzDpH7uNj1JAl:YeD8ZSWvZHZbs1row697qohQvg9DitJT
Malware Config
Extracted
mirai
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog 64aef5e09f70468794dcf5228a0c9d956316ca0cb4d941434195f04e61bbaf4a.elf File opened for modification /dev/watchdog 64aef5e09f70468794dcf5228a0c9d956316ca0cb4d941434195f04e61bbaf4a.elf -
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 64aef5e09f70468794dcf5228a0c9d956316ca0cb4d941434195f04e61bbaf4a.elf File opened for modification /bin/watchdog 64aef5e09f70468794dcf5228a0c9d956316ca0cb4d941434195f04e61bbaf4a.elf -
description ioc Process File opened for reading /proc/420/cmdline 64aef5e09f70468794dcf5228a0c9d956316ca0cb4d941434195f04e61bbaf4a.elf File opened for reading /proc/677/cmdline 64aef5e09f70468794dcf5228a0c9d956316ca0cb4d941434195f04e61bbaf4a.elf File opened for reading /proc/732/cmdline 64aef5e09f70468794dcf5228a0c9d956316ca0cb4d941434195f04e61bbaf4a.elf File opened for reading /proc/733/cmdline 64aef5e09f70468794dcf5228a0c9d956316ca0cb4d941434195f04e61bbaf4a.elf File opened for reading /proc/741/cmdline 64aef5e09f70468794dcf5228a0c9d956316ca0cb4d941434195f04e61bbaf4a.elf File opened for reading /proc/773/cmdline 64aef5e09f70468794dcf5228a0c9d956316ca0cb4d941434195f04e61bbaf4a.elf File opened for reading /proc/823/cmdline 64aef5e09f70468794dcf5228a0c9d956316ca0cb4d941434195f04e61bbaf4a.elf File opened for reading /proc/727/cmdline 64aef5e09f70468794dcf5228a0c9d956316ca0cb4d941434195f04e61bbaf4a.elf File opened for reading /proc/785/cmdline 64aef5e09f70468794dcf5228a0c9d956316ca0cb4d941434195f04e61bbaf4a.elf File opened for reading /proc/800/cmdline 64aef5e09f70468794dcf5228a0c9d956316ca0cb4d941434195f04e61bbaf4a.elf File opened for reading /proc/674/cmdline 64aef5e09f70468794dcf5228a0c9d956316ca0cb4d941434195f04e61bbaf4a.elf File opened for reading /proc/681/cmdline 64aef5e09f70468794dcf5228a0c9d956316ca0cb4d941434195f04e61bbaf4a.elf File opened for reading /proc/716/cmdline 64aef5e09f70468794dcf5228a0c9d956316ca0cb4d941434195f04e61bbaf4a.elf File opened for reading /proc/734/cmdline 64aef5e09f70468794dcf5228a0c9d956316ca0cb4d941434195f04e61bbaf4a.elf File opened for reading /proc/745/cmdline 64aef5e09f70468794dcf5228a0c9d956316ca0cb4d941434195f04e61bbaf4a.elf File opened for reading /proc/838/cmdline 64aef5e09f70468794dcf5228a0c9d956316ca0cb4d941434195f04e61bbaf4a.elf File opened for reading /proc/680/cmdline 64aef5e09f70468794dcf5228a0c9d956316ca0cb4d941434195f04e61bbaf4a.elf File opened for reading /proc/728/cmdline 64aef5e09f70468794dcf5228a0c9d956316ca0cb4d941434195f04e61bbaf4a.elf File opened for reading /proc/738/cmdline 64aef5e09f70468794dcf5228a0c9d956316ca0cb4d941434195f04e61bbaf4a.elf File opened for reading /proc/786/cmdline 64aef5e09f70468794dcf5228a0c9d956316ca0cb4d941434195f04e61bbaf4a.elf File opened for reading /proc/796/cmdline 64aef5e09f70468794dcf5228a0c9d956316ca0cb4d941434195f04e61bbaf4a.elf File opened for reading /proc/808/cmdline 64aef5e09f70468794dcf5228a0c9d956316ca0cb4d941434195f04e61bbaf4a.elf File opened for reading /proc/822/cmdline 64aef5e09f70468794dcf5228a0c9d956316ca0cb4d941434195f04e61bbaf4a.elf