Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    15s
  • platform
    debian-12_mipsel
  • resource
    debian12-mipsel-20240221-en
  • resource tags

    arch:mipselimage:debian12-mipsel-20240221-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem
  • submitted
    01/01/2025, 01:51 UTC

General

  • Target

    9edcacfbfbb25cd2864e431738ec6d8085b5ec241400943b4cc2c9ea7a2fe67c.elf

  • Size

    32KB

  • MD5

    e30368ed86531051ae95d0ba79d33d7e

  • SHA1

    cb69227ff998e24c588e67968e6c38437b939524

  • SHA256

    9edcacfbfbb25cd2864e431738ec6d8085b5ec241400943b4cc2c9ea7a2fe67c

  • SHA512

    740d00a37517473848c32c8dc957f1974c801f9279ccbc83ffcaea89ed1c94b292d6e52540565c819f88eb9c7ddc1634e116685c7063f7f7a459c5c100a2f795

  • SSDEEP

    768:Xky7pBOnQthzk8Ya7Fb4ARL1wZK8wTSWujfLm6Wa:Upn4z9Ygb4A51b477L7

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

  • Mirai family
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Writes file to system bin folder 2 IoCs
  • Reads runtime system information 18 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/9edcacfbfbb25cd2864e431738ec6d8085b5ec241400943b4cc2c9ea7a2fe67c.elf
    /tmp/9edcacfbfbb25cd2864e431738ec6d8085b5ec241400943b4cc2c9ea7a2fe67c.elf
    1⤵
    • Modifies Watchdog functionality
    • Writes file to system bin folder
    • Reads runtime system information
    PID:744

Network

  • flag-us
    DNS
    debian12-mipsel-20240221-en-5
    Remote address:
    1.1.1.1:53
    Request
    debian12-mipsel-20240221-en-5
    IN AAAA
    Response
  • flag-us
    DNS
    debian12-mipsel-20240221-en-5
    Remote address:
    1.1.1.1:53
    Request
    debian12-mipsel-20240221-en-5
    IN A
    Response
  • flag-us
    DNS
    debian12-mipsel-20240221-en-5
    Remote address:
    1.1.1.1:53
    Request
    debian12-mipsel-20240221-en-5
    IN AAAA
    Response
  • flag-us
    DNS
    debian12-mipsel-20240221-en-5
    Remote address:
    1.1.1.1:53
    Request
    debian12-mipsel-20240221-en-5
    IN AAAA
  • flag-us
    DNS
    debian12-mipsel-20240221-en-5
    Remote address:
    1.1.1.1:53
    Request
    debian12-mipsel-20240221-en-5
    IN A
    Response
  • 154.216.17.216:3778
    60 B
    40 B
    1
    1
  • 1.1.1.1:53
    debian12-mipsel-20240221-en-5
    dns
    75 B
    150 B
    1
    1

    DNS Request

    debian12-mipsel-20240221-en-5

  • 1.1.1.1:53
    debian12-mipsel-20240221-en-5
    dns
    75 B
    150 B
    1
    1

    DNS Request

    debian12-mipsel-20240221-en-5

  • 1.1.1.1:53
    debian12-mipsel-20240221-en-5
    dns
    150 B
    150 B
    2
    1

    DNS Request

    debian12-mipsel-20240221-en-5

    DNS Request

    debian12-mipsel-20240221-en-5

  • 1.1.1.1:53
    debian12-mipsel-20240221-en-5
    dns
    75 B
    150 B
    1
    1

    DNS Request

    debian12-mipsel-20240221-en-5

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.