Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
105s -
max time network
150s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20240523-en -
resource tags
arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system -
submitted
16/01/2025, 02:01
Behavioral task
behavioral1
Sample
04112cfea5c0f9bfcebbb0de9b42645b81de8bef4028bfd315d43b3daee49674.elf
Resource
ubuntu2404-amd64-20240523-en
General
-
Target
04112cfea5c0f9bfcebbb0de9b42645b81de8bef4028bfd315d43b3daee49674.elf
-
Size
49KB
-
MD5
8009c6add42a8503ba07974025f30f7f
-
SHA1
3aa5119043c6f2bdd546d4963dc1d0ee478f2f8c
-
SHA256
04112cfea5c0f9bfcebbb0de9b42645b81de8bef4028bfd315d43b3daee49674
-
SHA512
2b2ccc906038410349d406cfde4a83153f8da6f19c33ab24c22b6e8d112a3769e72e8a49656c55489b90d06dba267ad8f59b6ec30e42dedb8075302e3b2b8162
-
SSDEEP
1536:z2Cjz+rGHUo+iwYRkawchfD1EPtAFQPfkq:Vj6iHUmwYqs1EPtjfk
Malware Config
Signatures
-
Contacts a large (113356) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 04112cfea5c0f9bfcebbb0de9b42645b81de8bef4028bfd315d43b3daee49674.elf File opened for modification /dev/misc/watchdog 04112cfea5c0f9bfcebbb0de9b42645b81de8bef4028bfd315d43b3daee49674.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /var/Sofia 2489 04112cfea5c0f9bfcebbb0de9b42645b81de8bef4028bfd315d43b3daee49674.elf