Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
157s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
09/01/2025, 02:41
Behavioral task
behavioral1
Sample
938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
6 signatures
150 seconds
General
-
Target
938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf
-
Size
243KB
-
MD5
b95548c193633e706a824fbcbed52c35
-
SHA1
ef5a58c1525ba8e4aa33dfee59ecdf90ddb27a82
-
SHA256
938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621
-
SHA512
85e4ebdec316fb6d3937f45a4b5374e6b230c61cd77d1d04e2263d1c915e7147cdb1368dadecd49873108268668fb448e0933b97562b378ae3085ab9dde02703
-
SSDEEP
3072:9boCUNokVwXspoqKdMz+3W6cCLVvVTUcP/Tcme4caQB2v8d3JNx:eVGqeMzkldVT5cme4caQB2v8d3JNx
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for modification /dev/misc/watchdog 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/route 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself sshd 660 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/route 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf -
description ioc Process File opened for reading /proc/708/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/693/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/767/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/738/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/749/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/751/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/773/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/601/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/681/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/687/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/724/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/4/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/295/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/741/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/744/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/279/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/659/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/742/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/729/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/732/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/757/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/9/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/29/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/654/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/661/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/658/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/701/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/715/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/730/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/6/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/671/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/697/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/726/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/603/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/684/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/692/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/698/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/702/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/43/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/328/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/651/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/675/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/713/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/722/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/745/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/737/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/768/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/772/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/11/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/155/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/720/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/13/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/23/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/229/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/680/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/696/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/718/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/723/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/15/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/24/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/145/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/674/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/110/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf File opened for reading /proc/728/cmdline 938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf
Processes
-
/tmp/938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf/tmp/938468c9008f1062c0a29e894166ffe43760f4f1c110d430a02caf900c545621.elf1⤵
- Modifies Watchdog functionality
- Reads system routing table
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:660