Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
debian-12_armhf -
resource
debian12-armhf-20240418-en -
resource tags
arch:armhfimage:debian12-armhf-20240418-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
07/01/2025, 19:49
Behavioral task
behavioral1
Sample
botnet.arm7.elf
Resource
debian12-armhf-20240418-en
General
-
Target
botnet.arm7.elf
-
Size
61KB
-
MD5
ffef5c30d386027b9550b1aa067f7e36
-
SHA1
a79592292918cfebf554e70a7c3795389dc24a2d
-
SHA256
4835ef813a9ef7190525293c8f32d9c2fe3c088574ccd6c06ac2738d60ff43f2
-
SHA512
ee0771af44083d0acba51a1812e8b2476836045e61e30e37aa69099c47188feaa6828f1186bb48040db829ebebfd24fe0c2ba94486ec412b880081e4ae8c6a9e
-
SSDEEP
768:3nmRXdVfdG9KPFTnvOE3M/qiYk9mkLtd64de5GrN44KUyasZSDq3UI7wNG6XqAK7:3n4VdG9KJnvu/qiv16bffNhy0A13s/g4
Malware Config
Extracted
mirai
MIRAI
raw.igxhost.ru
Signatures
-
Mirai family
-
Contacts a large (23679) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
File and Directory Permissions Modification 1 TTPs 2 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 707 sh 722 chmod -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /bin/systemd 704 botnet.arm7.elf -
description ioc Process File opened for reading /proc/self/exe botnet.arm7.elf File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mv -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/bin/systemd sh
Processes
-
/tmp/botnet.arm7.elf/tmp/botnet.arm7.elf1⤵
- Changes its process name
- Reads runtime system information
PID:704 -
/bin/sh/bin/sh -c "rm -rf bin/systemd && mkdir bin; >bin/systemd && mv /tmp/botnet.arm7.elf bin/systemd; chmod 777 bin/systemd"2⤵
- File and Directory Permissions Modification
- Writes file to tmp directory
PID:707 -
/usr/bin/rmrm -rf bin/systemd3⤵PID:709
-
-
/usr/bin/mkdirmkdir bin3⤵
- Reads runtime system information
PID:713
-
-
/usr/bin/mvmv /tmp/botnet.arm7.elf bin/systemd3⤵
- Reads runtime system information
PID:715
-
-
/usr/bin/chmodchmod 777 bin/systemd3⤵
- File and Directory Permissions Modification
PID:722
-
-