Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    jew.x86.elf

  • Size

    60KB

  • Sample

    241211-3v7qhaxmcm

  • MD5

    0c9d13b8a66a0d51a37ad36c0a4f85e2

  • SHA1

    869b064cdcb70310b9af9fa25bc92c4a0430af13

  • SHA256

    6cae9625ea917a34f39d33cc7372ee7d261a29beb7a6a242b2bae7bf3f6c8401

  • SHA512

    128da26297725cb918e49fab03b42fdab6c1b8e6c31610eafb86ed056e074b98af33ce0a11a881ae52ba32ffd3e7436c955467716c0e71ce46cc1921a582176b

  • SSDEEP

    768:JjiwQ4KFW+Ny+8GbGN1hLZYRMLxJtWOboPLZhgtp7Cya3slMqWvjW:Ey+NH8x7huxObchgTNJWrW

Malware Config

Extracted

Family

mirai

Botnet

KURC

Targets

    • Target

      jew.x86.elf

    • Size

      60KB

    • MD5

      0c9d13b8a66a0d51a37ad36c0a4f85e2

    • SHA1

      869b064cdcb70310b9af9fa25bc92c4a0430af13

    • SHA256

      6cae9625ea917a34f39d33cc7372ee7d261a29beb7a6a242b2bae7bf3f6c8401

    • SHA512

      128da26297725cb918e49fab03b42fdab6c1b8e6c31610eafb86ed056e074b98af33ce0a11a881ae52ba32ffd3e7436c955467716c0e71ce46cc1921a582176b

    • SSDEEP

      768:JjiwQ4KFW+Ny+8GbGN1hLZYRMLxJtWOboPLZhgtp7Cya3slMqWvjW:Ey+NH8x7huxObchgTNJWrW

    • Contacts a large (115796) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Writes file to system bin folder

MITRE ATT&CK Enterprise v15

Tasks