Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
debian-12_armhf -
resource
debian12-armhf-20240729-en -
resource tags
arch:armhfimage:debian12-armhf-20240729-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
12/12/2024, 01:01
Behavioral task
behavioral1
Sample
29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf
Resource
debian12-armhf-20240729-en
debian-12-armhf
3 signatures
150 seconds
General
-
Target
29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf
-
Size
175KB
-
MD5
120454526962ecb994fb605038be27c4
-
SHA1
6e8f575a79154a11d6bd02b3a2bf757e99511942
-
SHA256
29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f
-
SHA512
44bed1758870ce1d777267f392abbc614881d4a60182e4240ccb1b2059ad1c3166422c86e5dfa5f758f7fabeb5d54db359913fe9ae6d210ce039d83719ea9e36
-
SSDEEP
3072:HK/lc7BbBLHcBCkAabwdyqkkUbH/6EBpbO/hJjogM/RHyfqs:HK/oBLHElAabwdybkQ1BZO/XMgM/RHyz
Score
6/10
Malware Config
Signatures
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a- M" ! 705 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf -
description ioc Process File opened for reading /proc/32/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/186/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/712/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/742/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/747/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/752/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/22/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/647/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/2/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/9/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/13/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/277/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/735/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/19/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/34/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/646/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/678/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/711/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/6/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/12/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/14/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/16/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/26/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/741/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/1/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/707/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/4/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/42/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/44/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/212/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/709/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/726/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/27/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/737/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/751/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/754/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/755/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/753/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/10/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/269/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/662/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/743/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/748/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/750/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/327/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/348/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/731/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/739/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/28/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/36/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/325/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/338/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/346/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/703/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/142/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/290/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/719/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/732/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/736/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/33/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/718/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/25/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/372/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf File opened for reading /proc/728/cmdline 29a6737b8892b2fa5ae9515bcf033f5860c143974a275ca420c08afface2555f.elf