Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    debian-12_mipsel
  • resource
    debian12-mipsel-20240418-en
  • resource tags

    arch:mipselimage:debian12-mipsel-20240418-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem
  • submitted
    03/01/2025, 04:37

General

  • Target

    d5794810b14d56b5c362fa09e568829516a8214f8ac70f3c441a951541e802db.elf

  • Size

    173KB

  • MD5

    0723004002bfea8e35c5db69285d93d2

  • SHA1

    4a5c2368378ecfa3f3d5746115ef6f055b3afa1b

  • SHA256

    d5794810b14d56b5c362fa09e568829516a8214f8ac70f3c441a951541e802db

  • SHA512

    f4ecad1fefb5149a67c577d7a1305491a2db9c222018947d356e505cee69ba6b93ac99b73697d0bab5b41e0d283942631779bc9748aa429b49fe9ab8d7b5ba82

  • SSDEEP

    3072:ueEksFM+wX5OpaVR8H3NaMZOTTMJxt9U+7fKbgE:ueEnO+wXZVWdaMATwJHy+u8

Malware Config

Extracted

Family

latentbot

C2

botnetdolly.zapto.org

Signatures

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

  • Latentbot family
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Changes its process name 1 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/d5794810b14d56b5c362fa09e568829516a8214f8ac70f3c441a951541e802db.elf
    /tmp/d5794810b14d56b5c362fa09e568829516a8214f8ac70f3c441a951541e802db.elf
    1⤵
    • Changes its process name
    • Reads runtime system information
    PID:744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads