Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240418-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
03/01/2025, 04:37
General
-
Target
d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
-
Size
169KB
-
MD5
cac7a8f8c4b3cd1f2c1bd1f187c617eb
-
SHA1
3bbe81657aed5d688bda2b3456faab369abf1732
-
SHA256
d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f
-
SHA512
2df8eeab046c7d33adecc5a2edadc923985b577cd05dc8775623ebeff0621f8cc44ee7b1bef6ec32bde337f1d4355e1f4b335c35d30633b5d53b17a503dfd3ce
-
SSDEEP
1536:Cl2JvnXPvLrQuchMJdDNsCK9H1R8cA2iQembSM+xV7TfF+hPyO0Hb/zMt/Y:Cgv/fcwZsCK9VRhAX+bShFSP0HbbMlY
Malware Config
Extracted
Family
latentbot
C2
botnetdolly.zapto.org
Signatures
-
Latentbot family
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a- M"! 729 d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf -
description ioc Process File opened for reading /proc/14/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/709/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/735/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/742/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/779/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/807/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/18/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/67/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/740/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/792/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/810/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/813/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/21/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/37/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/327/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/783/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/816/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/114/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/752/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/756/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/4/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/5/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/164/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/759/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/784/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/811/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/72/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/762/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/776/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/782/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/821/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/834/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/10/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/24/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/104/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/379/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/781/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/826/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/833/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/23/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/758/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/780/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/801/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/16/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/74/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/373/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/665/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/721/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/731/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/761/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/789/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/12/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/68/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/320/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/743/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/806/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/818/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/829/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/7/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/77/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/720/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/734/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/36/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf File opened for reading /proc/81/cmdline d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf