Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

5

1807c743b5...7d.elf

debian-12-armhf

10

Analysis

  • max time kernel
    136s
  • max time network
    157s
  • platform
    debian-12_armhf
  • resource
    debian12-armhf-20240221-en
  • resource tags

    arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
  • submitted
    05/01/2025, 01:20 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1807c743b59f7ca6ab655005a5cda2d2618b8b16392dc7104603ccb3a661257d.elf

  • Size

    43KB

  • MD5

    602191e10ba1c49583a045d17e08f1a4

  • SHA1

    4e6bca6853b6d328f9c9528258ba0374f6a67d7d

  • SHA256

    1807c743b59f7ca6ab655005a5cda2d2618b8b16392dc7104603ccb3a661257d

  • SHA512

    4a75e4a7523e73d003f752052d5dbd962cbcb4fbff562457d9ffdf570ef589c6c8f4362b3e72b097a6e743bd97e85d8bdb534e6840576ba16a6fd4b7974a81ae

  • SSDEEP

    768:3/ZyKJoofyfTtMLfclRAAO+jVbumZnLM3XgcTaWS5HOFcwGw9q3UEL+:hbjjOAgfnLGRMOC5L+

Score
10/10
mirailzrdbotnetdefense_evasiondiscovery

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • Mirai family
    mirai
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder 2 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/1807c743b59f7ca6ab655005a5cda2d2618b8b16392dc7104603ccb3a661257d.elf
    /tmp/1807c743b59f7ca6ab655005a5cda2d2618b8b16392dc7104603ccb3a661257d.elf
    1⤵
    • Modifies Watchdog functionality
    • Writes file to system bin folder
    • Reads runtime system information
    PID:710

Network

  • flag-us
    DNS
    debian12-armhf-20240221-en-8
    Remote address:
    1.1.1.1:53
    Request
    debian12-armhf-20240221-en-8
    IN AAAA
    Response
  • flag-us
    DNS
    debian12-armhf-20240221-en-8
    Remote address:
    1.1.1.1:53
    Request
    debian12-armhf-20240221-en-8
    IN A
    Response
  • flag-us
    DNS
    debian12-armhf-20240221-en-8
    Remote address:
    1.1.1.1:53
    Request
    debian12-armhf-20240221-en-8
    IN AAAA
    Response
  • flag-us
    DNS
    debian12-armhf-20240221-en-8
    Remote address:
    1.1.1.1:53
    Request
    debian12-armhf-20240221-en-8
    IN A
    Response
  • 141.11.33.73:3778
    903 B
     846 B
     17
    16
  • 141.11.33.73:3778
    851 B
     794 B
     16
    15
  • 1.1.1.1:53
    debian12-armhf-20240221-en-8
    dns
    74 B
     149 B
     1
    1

    DNS Request

    debian12-armhf-20240221-en-8

  • 1.1.1.1:53
    debian12-armhf-20240221-en-8
    dns
    74 B
     149 B
     1
    1

    DNS Request

    debian12-armhf-20240221-en-8

  • 1.1.1.1:53
    debian12-armhf-20240221-en-8
    dns
    74 B
     149 B
     1
    1

    DNS Request

    debian12-armhf-20240221-en-8

  • 1.1.1.1:53
    debian12-armhf-20240221-en-8
    dns
    74 B
     149 B
     1
    1

    DNS Request

    debian12-armhf-20240221-en-8

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.