Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
14/01/2025, 03:07
Behavioral task
behavioral1
Sample
b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
6 signatures
150 seconds
General
-
Target
b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf
-
Size
60KB
-
MD5
a1d8acd50352d19c0b991bc9ae10ffa1
-
SHA1
df680fe26cb56d44506355ff773f9aed9210d6e4
-
SHA256
b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d
-
SHA512
180b51edd2ccd594fd4b1a25b3d1ada3b555315291f9bb9cec59273dbcec13869d66357bf043285bb9c4963f41c3cecd19cd224db85009caa25f521fc7e44fea
-
SSDEEP
1536:Y7XduYshWhq/HIEy6Og3Nwz9hAyoELSM5Tfv83KJGTb6R4k:qdpssMPR9w4yLLXTX83K0Tb6R3
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for modification /dev/misc/watchdog b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for modification /bin/watchdog b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf -
description ioc Process File opened for reading /proc/28/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/106/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/275/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/587/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/13/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/15/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/17/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/25/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/585/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/10/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/26/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/140/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/148/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/166/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/214/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/632/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/6/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/27/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/42/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/139/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/136/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/626/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/5/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/7/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/76/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/98/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/267/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/299/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/588/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/274/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/633/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/18/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/29/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/314/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/41/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/109/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/303/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/583/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/2/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/21/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/22/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/23/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/4/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/14/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/631/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/1/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/20/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/162/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/278/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/12/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/19/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/619/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/296/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/630/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/11/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/16/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/24/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/108/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/8/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/9/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/636/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/43/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/567/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf File opened for reading /proc/625/status b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d.elf