Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
144s -
platform
debian-9_armhf -
resource
debian9-armhf-20240418-en -
resource tags
arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
02/01/2025, 00:06
General
-
Target
bot.arm5.elf
-
Size
126KB
-
MD5
c64277ed1fafc22a4ff6561693f81bc0
-
SHA1
ffe8c30fd3b5f924e30e3cad9faa46004a8e951a
-
SHA256
b330ddc13d3ebc89bc778a183ab85014dc57d8351b2cfa8d6ac7c8ad340bbec8
-
SHA512
cd9d03ed3574cf038478128dc346a096b517b9305bd0728033548d8c6d8f429b341622d5a4d3c796c6ef87945dc64ed9bcdd369aec2fd5e0087a46116c3b1ba6
-
SSDEEP
1536:Jtv+s43G5bUWk8RA9Sh71QAFMxK4VIGUT2y1C1O/T0A46nrtplUuwyw1FrR7bVnN:Dv+XQ/Rqg71QNE43Uqy1C1O146rOgbT
Malware Config
Extracted
Family
latentbot
C2
botnetdolly.zapto.org
Signatures
-
Latentbot family
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a- M" ! 637 bot.arm5.elf -
description ioc Process File opened for reading /proc/700/cmdline bot.arm5.elf File opened for reading /proc/717/cmdline bot.arm5.elf File opened for reading /proc/726/cmdline bot.arm5.elf File opened for reading /proc/734/cmdline bot.arm5.elf File opened for reading /proc/735/cmdline bot.arm5.elf File opened for reading /proc/742/cmdline bot.arm5.elf File opened for reading /proc/25/cmdline bot.arm5.elf File opened for reading /proc/757/cmdline bot.arm5.elf File opened for reading /proc/664/cmdline bot.arm5.elf File opened for reading /proc/677/cmdline bot.arm5.elf File opened for reading /proc/10/cmdline bot.arm5.elf File opened for reading /proc/20/cmdline bot.arm5.elf File opened for reading /proc/105/cmdline bot.arm5.elf File opened for reading /proc/139/cmdline bot.arm5.elf File opened for reading /proc/304/cmdline bot.arm5.elf File opened for reading /proc/589/cmdline bot.arm5.elf File opened for reading /proc/709/cmdline bot.arm5.elf File opened for reading /proc/725/cmdline bot.arm5.elf File opened for reading /proc/755/cmdline bot.arm5.elf File opened for reading /proc/143/cmdline bot.arm5.elf File opened for reading /proc/690/cmdline bot.arm5.elf File opened for reading /proc/707/cmdline bot.arm5.elf File opened for reading /proc/732/cmdline bot.arm5.elf File opened for reading /proc/699/cmdline bot.arm5.elf File opened for reading /proc/702/cmdline bot.arm5.elf File opened for reading /proc/13/cmdline bot.arm5.elf File opened for reading /proc/16/cmdline bot.arm5.elf File opened for reading /proc/165/cmdline bot.arm5.elf File opened for reading /proc/642/cmdline bot.arm5.elf File opened for reading /proc/646/cmdline bot.arm5.elf File opened for reading /proc/659/cmdline bot.arm5.elf File opened for reading /proc/745/cmdline bot.arm5.elf File opened for reading /proc/3/cmdline bot.arm5.elf File opened for reading /proc/651/cmdline bot.arm5.elf File opened for reading /proc/671/cmdline bot.arm5.elf File opened for reading /proc/728/cmdline bot.arm5.elf File opened for reading /proc/740/cmdline bot.arm5.elf File opened for reading /proc/29/cmdline bot.arm5.elf File opened for reading /proc/634/cmdline bot.arm5.elf File opened for reading /proc/665/cmdline bot.arm5.elf File opened for reading /proc/716/cmdline bot.arm5.elf File opened for reading /proc/767/cmdline bot.arm5.elf File opened for reading /proc/6/cmdline bot.arm5.elf File opened for reading /proc/588/cmdline bot.arm5.elf File opened for reading /proc/691/cmdline bot.arm5.elf File opened for reading /proc/723/cmdline bot.arm5.elf File opened for reading /proc/14/cmdline bot.arm5.elf File opened for reading /proc/275/cmdline bot.arm5.elf File opened for reading /proc/630/cmdline bot.arm5.elf File opened for reading /proc/718/cmdline bot.arm5.elf File opened for reading /proc/639/cmdline bot.arm5.elf File opened for reading /proc/645/cmdline bot.arm5.elf File opened for reading /proc/759/cmdline bot.arm5.elf File opened for reading /proc/43/cmdline bot.arm5.elf File opened for reading /proc/648/cmdline bot.arm5.elf File opened for reading /proc/655/cmdline bot.arm5.elf File opened for reading /proc/710/cmdline bot.arm5.elf File opened for reading /proc/623/cmdline bot.arm5.elf File opened for reading /proc/652/cmdline bot.arm5.elf File opened for reading /proc/654/cmdline bot.arm5.elf File opened for reading /proc/658/cmdline bot.arm5.elf File opened for reading /proc/739/cmdline bot.arm5.elf File opened for reading /proc/276/cmdline bot.arm5.elf File opened for reading /proc/635/cmdline bot.arm5.elf