Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
7s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20240226-en -
resource tags
arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
10/12/2024, 02:56
Behavioral task
behavioral1
Sample
713c40807274e72615c774e965dce35333d198e7fd1e8cb24432f7f5c227ba31.elf
Resource
debian9-mipsel-20240226-en
General
-
Target
713c40807274e72615c774e965dce35333d198e7fd1e8cb24432f7f5c227ba31.elf
-
Size
24KB
-
MD5
ee647bc1239d9b1765f07dfbc2ce48ce
-
SHA1
f8c795f5eda5c483abecf486da32baa008b40299
-
SHA256
713c40807274e72615c774e965dce35333d198e7fd1e8cb24432f7f5c227ba31
-
SHA512
e636e2411cc71c9b2da1ae27c2002d65b277301217bb684e50cc958bb9fd2ea50fc7b769fbbc322c3a78882be52eeaee085746c15bd98814c90b59461344b305
-
SSDEEP
768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpCOtFZqSWv7:4QlS07FUXqIYSXQKqu9t7qj
Malware Config
Extracted
mirai
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 713c40807274e72615c774e965dce35333d198e7fd1e8cb24432f7f5c227ba31.elf File opened for modification /dev/misc/watchdog 713c40807274e72615c774e965dce35333d198e7fd1e8cb24432f7f5c227ba31.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 713c40807274e72615c774e965dce35333d198e7fd1e8cb24432f7f5c227ba31.elf File opened for modification /bin/watchdog 713c40807274e72615c774e965dce35333d198e7fd1e8cb24432f7f5c227ba31.elf -
description ioc Process File opened for reading /proc/695/cmdline 713c40807274e72615c774e965dce35333d198e7fd1e8cb24432f7f5c227ba31.elf File opened for reading /proc/702/cmdline 713c40807274e72615c774e965dce35333d198e7fd1e8cb24432f7f5c227ba31.elf File opened for reading /proc/757/cmdline 713c40807274e72615c774e965dce35333d198e7fd1e8cb24432f7f5c227ba31.elf File opened for reading /proc/773/cmdline 713c40807274e72615c774e965dce35333d198e7fd1e8cb24432f7f5c227ba31.elf File opened for reading /proc/801/cmdline 713c40807274e72615c774e965dce35333d198e7fd1e8cb24432f7f5c227ba31.elf File opened for reading /proc/693/cmdline 713c40807274e72615c774e965dce35333d198e7fd1e8cb24432f7f5c227ba31.elf File opened for reading /proc/700/cmdline 713c40807274e72615c774e965dce35333d198e7fd1e8cb24432f7f5c227ba31.elf File opened for reading /proc/766/cmdline 713c40807274e72615c774e965dce35333d198e7fd1e8cb24432f7f5c227ba31.elf File opened for reading /proc/724/cmdline 713c40807274e72615c774e965dce35333d198e7fd1e8cb24432f7f5c227ba31.elf File opened for reading /proc/779/cmdline 713c40807274e72615c774e965dce35333d198e7fd1e8cb24432f7f5c227ba31.elf File opened for reading /proc/761/cmdline 713c40807274e72615c774e965dce35333d198e7fd1e8cb24432f7f5c227ba31.elf File opened for reading /proc/769/cmdline 713c40807274e72615c774e965dce35333d198e7fd1e8cb24432f7f5c227ba31.elf File opened for reading /proc/533/cmdline 713c40807274e72615c774e965dce35333d198e7fd1e8cb24432f7f5c227ba31.elf File opened for reading /proc/703/cmdline 713c40807274e72615c774e965dce35333d198e7fd1e8cb24432f7f5c227ba31.elf File opened for reading /proc/729/cmdline 713c40807274e72615c774e965dce35333d198e7fd1e8cb24432f7f5c227ba31.elf File opened for reading /proc/787/cmdline 713c40807274e72615c774e965dce35333d198e7fd1e8cb24432f7f5c227ba31.elf File opened for reading /proc/491/cmdline 713c40807274e72615c774e965dce35333d198e7fd1e8cb24432f7f5c227ba31.elf File opened for reading /proc/694/cmdline 713c40807274e72615c774e965dce35333d198e7fd1e8cb24432f7f5c227ba31.elf File opened for reading /proc/736/cmdline 713c40807274e72615c774e965dce35333d198e7fd1e8cb24432f7f5c227ba31.elf File opened for reading /proc/532/cmdline 713c40807274e72615c774e965dce35333d198e7fd1e8cb24432f7f5c227ba31.elf File opened for reading /proc/689/cmdline 713c40807274e72615c774e965dce35333d198e7fd1e8cb24432f7f5c227ba31.elf File opened for reading /proc/728/cmdline 713c40807274e72615c774e965dce35333d198e7fd1e8cb24432f7f5c227ba31.elf File opened for reading /proc/674/cmdline 713c40807274e72615c774e965dce35333d198e7fd1e8cb24432f7f5c227ba31.elf File opened for reading /proc/688/cmdline 713c40807274e72615c774e965dce35333d198e7fd1e8cb24432f7f5c227ba31.elf File opened for reading /proc/742/cmdline 713c40807274e72615c774e965dce35333d198e7fd1e8cb24432f7f5c227ba31.elf File opened for reading /proc/486/cmdline 713c40807274e72615c774e965dce35333d198e7fd1e8cb24432f7f5c227ba31.elf File opened for reading /proc/756/cmdline 713c40807274e72615c774e965dce35333d198e7fd1e8cb24432f7f5c227ba31.elf