Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
135s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
14/01/2025, 02:50
Behavioral task
behavioral1
Sample
898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
3 signatures
150 seconds
General
-
Target
898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf
-
Size
73KB
-
MD5
a2451f6bd0eb6b177d5f40d71e0e4059
-
SHA1
fc3baa30b559b41ce64fef7eda787f37bb43077e
-
SHA256
898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787
-
SHA512
8ed3383b471ccad5c5919e2c4aac64573d12decee13b6d25a643c4e2b48701952a462647247d657fa22a941eeff6b4b97695ddd77c00445df27dd75ee45d07cb
-
SSDEEP
1536:6SYXBbpKbF+5AQZKOtRDXVFxKbgMj+B3bEKoui0QOo/Y0TB3:SbobF+5QOth3AbgMj+xbyuPXopt3
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for modification /dev/misc/watchdog 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/4/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/153/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/155/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/160/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/435/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/468/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/664/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/1009/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/1471/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/1478/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/20/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/29/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/165/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/168/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/158/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/1167/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/1226/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/9/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/16/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/162/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/502/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/529/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/1469/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/166/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/1121/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/82/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/1141/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/1479/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/2/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/267/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/319/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/645/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/1004/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/154/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/1364/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/13/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/167/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/559/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/586/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/940/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/28/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/35/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/318/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/444/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/451/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/536/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/1232/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/1258/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/198/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/952/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/1125/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/947/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/1033/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/1186/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/1243/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/1337/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/85/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/157/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/701/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/1139/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/1144/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/1172/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/1177/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf File opened for reading /proc/10/cmdline 898aabc9633231e530c8a5ce539c80b11535aacbc9f28740cf42016eee0fc787.elf