Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
162s -
platform
debian-12_armhf -
resource
debian12-armhf-20240221-en -
resource tags
arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
15/12/2024, 03:54
Behavioral task
behavioral1
Sample
9efbf31d6e27540eba5069725740b9eecc381a81f23cbfb80d0efeed7c839691.elf
Resource
debian12-armhf-20240221-en
General
-
Target
9efbf31d6e27540eba5069725740b9eecc381a81f23cbfb80d0efeed7c839691.elf
-
Size
151KB
-
MD5
4a23530dbc9670bce65f32924f89cc5e
-
SHA1
e8080ac306fd7b917a0e1b8e0f98b70f4bb8a5bc
-
SHA256
9efbf31d6e27540eba5069725740b9eecc381a81f23cbfb80d0efeed7c839691
-
SHA512
0469708b9995631b8f4af56ff8dd95bc17f30b0e9378cf9818e2cfd120a87e9c6f14c647cfcb220dce7a4b75a5d8f535e0bac5eeea4710d908d4fcd0b4da4bf3
-
SSDEEP
3072:cYuS/Hp34dNxISv4d+TfJvWa2dCAnhcJhL9H9LBQZ2jxBOCL1WvVAM/9i/ym3:cYuS/HCdgSv4d+TfJvH2dCAnhs9NBQZ+
Malware Config
Signatures
-
Contacts a large (20294) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 9efbf31d6e27540eba5069725740b9eecc381a81f23cbfb80d0efeed7c839691.elf File opened for modification /dev/misc/watchdog 9efbf31d6e27540eba5069725740b9eecc381a81f23cbfb80d0efeed7c839691.elf -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp 9efbf31d6e27540eba5069725740b9eecc381a81f23cbfb80d0efeed7c839691.elf -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp 9efbf31d6e27540eba5069725740b9eecc381a81f23cbfb80d0efeed7c839691.elf -
description ioc Process File opened for reading /proc/1/fd 9efbf31d6e27540eba5069725740b9eecc381a81f23cbfb80d0efeed7c839691.elf File opened for reading /proc/270/fd 9efbf31d6e27540eba5069725740b9eecc381a81f23cbfb80d0efeed7c839691.elf File opened for reading /proc/301/fd 9efbf31d6e27540eba5069725740b9eecc381a81f23cbfb80d0efeed7c839691.elf File opened for reading /proc/717/fd 9efbf31d6e27540eba5069725740b9eecc381a81f23cbfb80d0efeed7c839691.elf File opened for reading /proc/323/fd 9efbf31d6e27540eba5069725740b9eecc381a81f23cbfb80d0efeed7c839691.elf File opened for reading /proc/347/fd 9efbf31d6e27540eba5069725740b9eecc381a81f23cbfb80d0efeed7c839691.elf File opened for reading /proc/644/fd 9efbf31d6e27540eba5069725740b9eecc381a81f23cbfb80d0efeed7c839691.elf File opened for reading /proc/683/fd 9efbf31d6e27540eba5069725740b9eecc381a81f23cbfb80d0efeed7c839691.elf File opened for reading /proc/702/fd 9efbf31d6e27540eba5069725740b9eecc381a81f23cbfb80d0efeed7c839691.elf File opened for reading /proc/712/fd 9efbf31d6e27540eba5069725740b9eecc381a81f23cbfb80d0efeed7c839691.elf File opened for reading /proc/714/fd 9efbf31d6e27540eba5069725740b9eecc381a81f23cbfb80d0efeed7c839691.elf File opened for reading /proc/334/fd 9efbf31d6e27540eba5069725740b9eecc381a81f23cbfb80d0efeed7c839691.elf File opened for reading /proc/348/fd 9efbf31d6e27540eba5069725740b9eecc381a81f23cbfb80d0efeed7c839691.elf File opened for reading /proc/663/fd 9efbf31d6e27540eba5069725740b9eecc381a81f23cbfb80d0efeed7c839691.elf File opened for reading /proc/680/fd 9efbf31d6e27540eba5069725740b9eecc381a81f23cbfb80d0efeed7c839691.elf File opened for reading /proc/350/fd 9efbf31d6e27540eba5069725740b9eecc381a81f23cbfb80d0efeed7c839691.elf File opened for reading /proc/710/fd 9efbf31d6e27540eba5069725740b9eecc381a81f23cbfb80d0efeed7c839691.elf File opened for reading /proc/325/fd 9efbf31d6e27540eba5069725740b9eecc381a81f23cbfb80d0efeed7c839691.elf File opened for reading /proc/629/fd 9efbf31d6e27540eba5069725740b9eecc381a81f23cbfb80d0efeed7c839691.elf File opened for reading /proc/679/fd 9efbf31d6e27540eba5069725740b9eecc381a81f23cbfb80d0efeed7c839691.elf File opened for reading /proc/212/fd 9efbf31d6e27540eba5069725740b9eecc381a81f23cbfb80d0efeed7c839691.elf File opened for reading /proc/660/fd 9efbf31d6e27540eba5069725740b9eecc381a81f23cbfb80d0efeed7c839691.elf File opened for reading /proc/331/fd 9efbf31d6e27540eba5069725740b9eecc381a81f23cbfb80d0efeed7c839691.elf File opened for reading /proc/715/fd 9efbf31d6e27540eba5069725740b9eecc381a81f23cbfb80d0efeed7c839691.elf File opened for reading /proc/188/fd 9efbf31d6e27540eba5069725740b9eecc381a81f23cbfb80d0efeed7c839691.elf File opened for reading /proc/365/fd 9efbf31d6e27540eba5069725740b9eecc381a81f23cbfb80d0efeed7c839691.elf File opened for reading /proc/645/fd 9efbf31d6e27540eba5069725740b9eecc381a81f23cbfb80d0efeed7c839691.elf