Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
6s -
platform
debian-9_armhf -
resource
debian9-armhf-20240729-en -
resource tags
arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
01/01/2025, 01:13
Behavioral task
behavioral1
Sample
bffc0b923efab28f6fa96aa9db459193da608dd26226124dfeecbe3957602869.elf
Resource
debian9-armhf-20240729-en
General
-
Target
bffc0b923efab28f6fa96aa9db459193da608dd26226124dfeecbe3957602869.elf
-
Size
45KB
-
MD5
3dee7a742c3240832d92af16796cbf41
-
SHA1
be1443888c2bbfd454511ae89d7088a48f704fdc
-
SHA256
bffc0b923efab28f6fa96aa9db459193da608dd26226124dfeecbe3957602869
-
SHA512
d145d1f33d609880468730e3290725e259f3d62b87147de764ee621cababe4ab92045a01cb06d4518cc7e1c8af4e38016cda423dab5d3ac570c60af2d835cec1
-
SSDEEP
768:D/TYCoIxdEk+AxoTZAZHFeq8b35sLN9q3UELbUXfi6nVMQHI4vcGpvb:DECFd+A6YHAxqgLRQZb
Malware Config
Extracted
mirai
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog bffc0b923efab28f6fa96aa9db459193da608dd26226124dfeecbe3957602869.elf File opened for modification /dev/misc/watchdog bffc0b923efab28f6fa96aa9db459193da608dd26226124dfeecbe3957602869.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog bffc0b923efab28f6fa96aa9db459193da608dd26226124dfeecbe3957602869.elf File opened for modification /bin/watchdog bffc0b923efab28f6fa96aa9db459193da608dd26226124dfeecbe3957602869.elf -
description ioc Process File opened for reading /proc/764/cmdline bffc0b923efab28f6fa96aa9db459193da608dd26226124dfeecbe3957602869.elf File opened for reading /proc/769/cmdline bffc0b923efab28f6fa96aa9db459193da608dd26226124dfeecbe3957602869.elf File opened for reading /proc/773/cmdline bffc0b923efab28f6fa96aa9db459193da608dd26226124dfeecbe3957602869.elf File opened for reading /proc/775/cmdline bffc0b923efab28f6fa96aa9db459193da608dd26226124dfeecbe3957602869.elf File opened for reading /proc/781/cmdline bffc0b923efab28f6fa96aa9db459193da608dd26226124dfeecbe3957602869.elf File opened for reading /proc/783/cmdline bffc0b923efab28f6fa96aa9db459193da608dd26226124dfeecbe3957602869.elf File opened for reading /proc/602/cmdline bffc0b923efab28f6fa96aa9db459193da608dd26226124dfeecbe3957602869.elf File opened for reading /proc/761/cmdline bffc0b923efab28f6fa96aa9db459193da608dd26226124dfeecbe3957602869.elf File opened for reading /proc/650/cmdline bffc0b923efab28f6fa96aa9db459193da608dd26226124dfeecbe3957602869.elf File opened for reading /proc/785/cmdline bffc0b923efab28f6fa96aa9db459193da608dd26226124dfeecbe3957602869.elf File opened for reading /proc/789/cmdline bffc0b923efab28f6fa96aa9db459193da608dd26226124dfeecbe3957602869.elf File opened for reading /proc/586/cmdline bffc0b923efab28f6fa96aa9db459193da608dd26226124dfeecbe3957602869.elf File opened for reading /proc/600/cmdline bffc0b923efab28f6fa96aa9db459193da608dd26226124dfeecbe3957602869.elf File opened for reading /proc/607/cmdline bffc0b923efab28f6fa96aa9db459193da608dd26226124dfeecbe3957602869.elf File opened for reading /proc/684/cmdline bffc0b923efab28f6fa96aa9db459193da608dd26226124dfeecbe3957602869.elf File opened for reading /proc/715/cmdline bffc0b923efab28f6fa96aa9db459193da608dd26226124dfeecbe3957602869.elf File opened for reading /proc/719/cmdline bffc0b923efab28f6fa96aa9db459193da608dd26226124dfeecbe3957602869.elf File opened for reading /proc/762/cmdline bffc0b923efab28f6fa96aa9db459193da608dd26226124dfeecbe3957602869.elf File opened for reading /proc/779/cmdline bffc0b923efab28f6fa96aa9db459193da608dd26226124dfeecbe3957602869.elf File opened for reading /proc/606/cmdline bffc0b923efab28f6fa96aa9db459193da608dd26226124dfeecbe3957602869.elf File opened for reading /proc/644/cmdline bffc0b923efab28f6fa96aa9db459193da608dd26226124dfeecbe3957602869.elf File opened for reading /proc/747/cmdline bffc0b923efab28f6fa96aa9db459193da608dd26226124dfeecbe3957602869.elf File opened for reading /proc/self/exe bffc0b923efab28f6fa96aa9db459193da608dd26226124dfeecbe3957602869.elf File opened for reading /proc/649/cmdline bffc0b923efab28f6fa96aa9db459193da608dd26226124dfeecbe3957602869.elf File opened for reading /proc/727/cmdline bffc0b923efab28f6fa96aa9db459193da608dd26226124dfeecbe3957602869.elf File opened for reading /proc/787/cmdline bffc0b923efab28f6fa96aa9db459193da608dd26226124dfeecbe3957602869.elf File opened for reading /proc/651/cmdline bffc0b923efab28f6fa96aa9db459193da608dd26226124dfeecbe3957602869.elf File opened for reading /proc/655/cmdline bffc0b923efab28f6fa96aa9db459193da608dd26226124dfeecbe3957602869.elf File opened for reading /proc/666/cmdline bffc0b923efab28f6fa96aa9db459193da608dd26226124dfeecbe3957602869.elf File opened for reading /proc/771/cmdline bffc0b923efab28f6fa96aa9db459193da608dd26226124dfeecbe3957602869.elf File opened for reading /proc/777/cmdline bffc0b923efab28f6fa96aa9db459193da608dd26226124dfeecbe3957602869.elf