Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
152s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240611-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
13/01/2025, 09:32
Behavioral task
behavioral1
Sample
elitebotnet.mips.elf
Resource
debian9-mipsbe-20240611-en
General
-
Target
elitebotnet.mips.elf
-
Size
97KB
-
MD5
0589b3d263957e51899c048a347b5e0a
-
SHA1
253025ae97055316ad0bc4f9dd4c680e0a9af96a
-
SHA256
9701f870720ee716c02d544e6f148075d2798254cae3ad4263df3ef2c82b15d3
-
SHA512
82160c65efc3ed2086d4729ae7e97f98b9d237a1631421fd951db790be438db9432045ee16363da9c1070356d7d8227991711908674347edd9a4f3dc8f049284
-
SSDEEP
3072:kQW/HIc4mbkqFAuGz+8iYzfbNcQwbZnGN:kL/oqFAu6fTzfnwRGN
Malware Config
Signatures
-
Contacts a large (23673) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
File and Directory Permissions Modification 1 TTPs 2 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 715 sh 724 chmod -
Modifies rc script 2 TTPs 1 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
description ioc Process File opened for modification /etc/rc.local elitebotnet.mips.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /bin/systemd 713 elitebotnet.mips.elf -
description ioc Process File opened for reading /proc/filesystems mv File opened for reading /proc/filesystems mkdir -
System Network Configuration Discovery 1 TTPs 2 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 713 elitebotnet.mips.elf 720 mv -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/bin/systemd sh
Processes
-
/tmp/elitebotnet.mips.elf/tmp/elitebotnet.mips.elf1⤵
- Modifies rc script
- Changes its process name
- System Network Configuration Discovery
PID:713 -
/bin/shsh -c "rm -rf bin/systemd && mkdir bin; >bin/systemd && mv /tmp/elitebotnet.mips.elf bin/systemd; chmod 777 bin/systemd"2⤵
- File and Directory Permissions Modification
- Writes file to tmp directory
PID:715 -
/bin/rmrm -rf bin/systemd3⤵PID:716
-
-
/bin/mkdirmkdir bin3⤵
- Reads runtime system information
PID:718
-
-
/bin/mvmv /tmp/elitebotnet.mips.elf bin/systemd3⤵
- Reads runtime system information
- System Network Configuration Discovery
PID:720
-
-
/bin/chmodchmod 777 bin/systemd3⤵
- File and Directory Permissions Modification
PID:724
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Privilege Escalation
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92B
MD54b6879140e52fbe7db2b19ed17257289
SHA1eae5c280884c94f4ccf32c28daf35bc5bf7450a3
SHA2565f7fcb731652c445d5087088154f690c89443715a65b1cbdb78cf70ab3370931
SHA512736545b3ce791eb8b7402ffe064f66069abd9601039ae0c62eed71540fd14d95acf2dc7c27d5ebf451314c4de1220923901b6eb60098881e1709209fae45d7cc