Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
164s -
platform
debian-12_armhf -
resource
debian12-armhf-20240221-en -
resource tags
arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
09/01/2025, 02:22
Behavioral task
behavioral1
Sample
58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf
Resource
debian12-armhf-20240221-en
debian-12-armhf
6 signatures
150 seconds
General
-
Target
58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf
-
Size
302KB
-
MD5
f800aac19067dd0808e5b08b056bcf11
-
SHA1
14ebef4f03fea503330cd71255fbb1811628048b
-
SHA256
58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5
-
SHA512
0d85cd5ac1194b7676a863178d7eabec5481a553daa8b63691f298b060942111e2bfa2eaf3ca87d36da0c18c4e7a84679ca1183655d61850b435217243a1b219
-
SSDEEP
6144:3JmkqPEIC5aWGSWYZH6KIhmTMLVCdukqM/9jmi3wq09aMNS:gkKER5azSWYZaKimIZCTD/hmi3/09aMM
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for modification /dev/misc/watchdog 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/route 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /usr/sbin/dropbear 705 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/route 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf -
description ioc Process File opened for reading /proc/8/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/58/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/793/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/801/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/804/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/5/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/18/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/732/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/780/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/213/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/760/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/772/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/778/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/787/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/836/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/201/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/648/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/841/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/846/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/268/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/336/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/347/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/350/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/681/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/773/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/816/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/838/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/10/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/25/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/698/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/707/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/776/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/831/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/27/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/809/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/837/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/4/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/30/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/844/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/144/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/752/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/757/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/799/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/817/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/824/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/827/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/6/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/47/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/834/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/3/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/301/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/323/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/788/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/808/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/828/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/684/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/755/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/783/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/815/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/19/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/680/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/779/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/800/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf File opened for reading /proc/802/cmdline 58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf
Processes
-
/tmp/58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf/tmp/58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5.elf1⤵
- Modifies Watchdog functionality
- Reads system routing table
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:705