Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
154s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
29/12/2024, 12:52
Behavioral task
behavioral1
Sample
bot.arm7.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
3 signatures
150 seconds
General
-
Target
bot.arm7.elf
-
Size
175KB
-
MD5
b48b9273165ad39ea0b08712084ed213
-
SHA1
517127d7eae5086aee2dba7b6733b3bcf4555258
-
SHA256
882bd6dca0b3b39ff64fdb5b814717a5d448ecc36ecf90062246a6d585b87f28
-
SHA512
2afd7678c702b5ff02a0246694acee4c4b8368ac5243cfd695c11bbe617e7f4da05840681acf813ba35842a2a48408ada68106ec731d18a74de91946e12c57dc
-
SSDEEP
3072:6N/msnezlTERakAajYFyisk5ybXCUBpv4/hJjogM/RnyOGN:6N/SlT89AajYFybkAZBB4/XMgM/RnyOC
Score
6/10
Malware Config
Signatures
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a- M" ! 648 bot.arm7.elf -
description ioc Process File opened for reading /proc/695/cmdline bot.arm7.elf File opened for reading /proc/715/cmdline bot.arm7.elf File opened for reading /proc/729/cmdline bot.arm7.elf File opened for reading /proc/736/cmdline bot.arm7.elf File opened for reading /proc/7/cmdline bot.arm7.elf File opened for reading /proc/16/cmdline bot.arm7.elf File opened for reading /proc/297/cmdline bot.arm7.elf File opened for reading /proc/672/cmdline bot.arm7.elf File opened for reading /proc/765/cmdline bot.arm7.elf File opened for reading /proc/724/cmdline bot.arm7.elf File opened for reading /proc/22/cmdline bot.arm7.elf File opened for reading /proc/41/cmdline bot.arm7.elf File opened for reading /proc/634/cmdline bot.arm7.elf File opened for reading /proc/717/cmdline bot.arm7.elf File opened for reading /proc/661/cmdline bot.arm7.elf File opened for reading /proc/678/cmdline bot.arm7.elf File opened for reading /proc/697/cmdline bot.arm7.elf File opened for reading /proc/702/cmdline bot.arm7.elf File opened for reading /proc/42/cmdline bot.arm7.elf File opened for reading /proc/106/cmdline bot.arm7.elf File opened for reading /proc/151/cmdline bot.arm7.elf File opened for reading /proc/295/cmdline bot.arm7.elf File opened for reading /proc/714/cmdline bot.arm7.elf File opened for reading /proc/649/cmdline bot.arm7.elf File opened for reading /proc/657/cmdline bot.arm7.elf File opened for reading /proc/660/cmdline bot.arm7.elf File opened for reading /proc/670/cmdline bot.arm7.elf File opened for reading /proc/3/cmdline bot.arm7.elf File opened for reading /proc/8/cmdline bot.arm7.elf File opened for reading /proc/12/cmdline bot.arm7.elf File opened for reading /proc/166/cmdline bot.arm7.elf File opened for reading /proc/754/cmdline bot.arm7.elf File opened for reading /proc/687/cmdline bot.arm7.elf File opened for reading /proc/690/cmdline bot.arm7.elf File opened for reading /proc/740/cmdline bot.arm7.elf File opened for reading /proc/741/cmdline bot.arm7.elf File opened for reading /proc/76/cmdline bot.arm7.elf File opened for reading /proc/770/cmdline bot.arm7.elf File opened for reading /proc/737/cmdline bot.arm7.elf File opened for reading /proc/739/cmdline bot.arm7.elf File opened for reading /proc/777/cmdline bot.arm7.elf File opened for reading /proc/9/cmdline bot.arm7.elf File opened for reading /proc/17/cmdline bot.arm7.elf File opened for reading /proc/307/cmdline bot.arm7.elf File opened for reading /proc/735/cmdline bot.arm7.elf File opened for reading /proc/732/cmdline bot.arm7.elf File opened for reading /proc/746/cmdline bot.arm7.elf File opened for reading /proc/762/cmdline bot.arm7.elf File opened for reading /proc/771/cmdline bot.arm7.elf File opened for reading /proc/23/cmdline bot.arm7.elf File opened for reading /proc/693/cmdline bot.arm7.elf File opened for reading /proc/710/cmdline bot.arm7.elf File opened for reading /proc/712/cmdline bot.arm7.elf File opened for reading /proc/692/cmdline bot.arm7.elf File opened for reading /proc/781/cmdline bot.arm7.elf File opened for reading /proc/1/cmdline bot.arm7.elf File opened for reading /proc/278/cmdline bot.arm7.elf File opened for reading /proc/686/cmdline bot.arm7.elf File opened for reading /proc/691/cmdline bot.arm7.elf File opened for reading /proc/726/cmdline bot.arm7.elf File opened for reading /proc/752/cmdline bot.arm7.elf File opened for reading /proc/6/cmdline bot.arm7.elf File opened for reading /proc/274/cmdline bot.arm7.elf File opened for reading /proc/674/cmdline bot.arm7.elf