Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
143s -
platform
debian-12_armhf -
resource
debian12-armhf-20240221-en -
resource tags
arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
01/01/2025, 23:46
General
-
Target
bot.arm7.elf
-
Size
175KB
-
MD5
b879e8281f57d1bb2ed6924e36abdfd2
-
SHA1
26b0b1f5a98b657f822177ec029a64ff0a758fc6
-
SHA256
b15391a5bc89b016807a7eb36ba74c8f7c68299afc3a0538e89b120597217e75
-
SHA512
53bad62e6f72f20e96514274c50f65898dc983fafe07668df5b017eee71540c98003f62f7c46b1a17c4708f4d6881db720b4be89a8b7e1b8e46f7f991b79d63d
-
SSDEEP
3072:HK/lcDBbBLHcBCkAabwdyqkkUbH/6EBp9O/hJjogM/RHyfqs:HK/UBLHElAabwdybkQ1BTO/XMgM/RHyz
Malware Config
Extracted
Family
latentbot
C2
botnetdolly.zapto.org
Signatures
-
Latentbot family
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a- M" ! 708 bot.arm7.elf -
description ioc Process File opened for reading /proc/9/cmdline bot.arm7.elf File opened for reading /proc/31/cmdline bot.arm7.elf File opened for reading /proc/341/cmdline bot.arm7.elf File opened for reading /proc/738/cmdline bot.arm7.elf File opened for reading /proc/45/cmdline bot.arm7.elf File opened for reading /proc/34/cmdline bot.arm7.elf File opened for reading /proc/51/cmdline bot.arm7.elf File opened for reading /proc/11/cmdline bot.arm7.elf File opened for reading /proc/15/cmdline bot.arm7.elf File opened for reading /proc/706/cmdline bot.arm7.elf File opened for reading /proc/35/cmdline bot.arm7.elf File opened for reading /proc/324/cmdline bot.arm7.elf File opened for reading /proc/715/cmdline bot.arm7.elf File opened for reading /proc/26/cmdline bot.arm7.elf File opened for reading /proc/221/cmdline bot.arm7.elf File opened for reading /proc/713/cmdline bot.arm7.elf File opened for reading /proc/188/cmdline bot.arm7.elf File opened for reading /proc/208/cmdline bot.arm7.elf File opened for reading /proc/647/cmdline bot.arm7.elf File opened for reading /proc/743/cmdline bot.arm7.elf File opened for reading /proc/3/cmdline bot.arm7.elf File opened for reading /proc/7/cmdline bot.arm7.elf File opened for reading /proc/27/cmdline bot.arm7.elf File opened for reading /proc/57/cmdline bot.arm7.elf File opened for reading /proc/10/cmdline bot.arm7.elf File opened for reading /proc/12/cmdline bot.arm7.elf File opened for reading /proc/721/cmdline bot.arm7.elf File opened for reading /proc/742/cmdline bot.arm7.elf File opened for reading /proc/23/cmdline bot.arm7.elf File opened for reading /proc/679/cmdline bot.arm7.elf File opened for reading /proc/44/cmdline bot.arm7.elf File opened for reading /proc/751/cmdline bot.arm7.elf File opened for reading /proc/732/cmdline bot.arm7.elf File opened for reading /proc/711/cmdline bot.arm7.elf File opened for reading /proc/727/cmdline bot.arm7.elf File opened for reading /proc/29/cmdline bot.arm7.elf File opened for reading /proc/56/cmdline bot.arm7.elf File opened for reading /proc/729/cmdline bot.arm7.elf File opened for reading /proc/8/cmdline bot.arm7.elf File opened for reading /proc/17/cmdline bot.arm7.elf File opened for reading /proc/317/cmdline bot.arm7.elf File opened for reading /proc/319/cmdline bot.arm7.elf File opened for reading /proc/725/cmdline bot.arm7.elf File opened for reading /proc/748/cmdline bot.arm7.elf File opened for reading /proc/73/cmdline bot.arm7.elf File opened for reading /proc/309/cmdline bot.arm7.elf File opened for reading /proc/733/cmdline bot.arm7.elf File opened for reading /proc/28/cmdline bot.arm7.elf File opened for reading /proc/731/cmdline bot.arm7.elf File opened for reading /proc/701/cmdline bot.arm7.elf File opened for reading /proc/36/cmdline bot.arm7.elf File opened for reading /proc/346/cmdline bot.arm7.elf File opened for reading /proc/248/cmdline bot.arm7.elf File opened for reading /proc/699/cmdline bot.arm7.elf File opened for reading /proc/1/cmdline bot.arm7.elf File opened for reading /proc/6/cmdline bot.arm7.elf File opened for reading /proc/752/cmdline bot.arm7.elf File opened for reading /proc/735/cmdline bot.arm7.elf File opened for reading /proc/745/cmdline bot.arm7.elf File opened for reading /proc/758/cmdline bot.arm7.elf File opened for reading /proc/632/cmdline bot.arm7.elf File opened for reading /proc/714/cmdline bot.arm7.elf File opened for reading /proc/710/cmdline bot.arm7.elf File opened for reading /proc/746/cmdline bot.arm7.elf