Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
128s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240729-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240729-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
18/01/2025, 05:03
Behavioral task
behavioral1
Sample
dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf
Resource
ubuntu2204-amd64-20240729-en
ubuntu-22.04-amd64
6 signatures
150 seconds
General
-
Target
dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf
-
Size
20KB
-
MD5
313c4b235e0e62ca38eb04bfa7677e44
-
SHA1
c31d5d0c0fa4bfa4ea2837cede424504c68ccfd3
-
SHA256
dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4
-
SHA512
0bf52b087e48b6daac55f735ae5b5af7626322db3200e72c61755d6b80234c503a02f3e35b340b70d1731fdec2054f530251504dec55497ca5877f9233ff54ad
-
SSDEEP
384:Mg4Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAK/:M98o08kxofBE+ZkXaqGbp2F2TWul0c5u
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for modification /dev/misc/watchdog dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for modification /bin/watchdog dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf -
description ioc Process File opened for reading /proc/742/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/850/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/1105/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/1163/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/1485/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/451/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/1162/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/1450/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/503/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/1161/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/1183/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/1388/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/859/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/634/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/1066/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/1233/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/1247/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/1314/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/415/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/1145/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/610/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/594/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/1175/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/1376/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/528/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/1567/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/1351/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/868/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/413/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/771/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/980/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/723/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/1182/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/1437/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/1159/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/769/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/1141/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/1196/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/1062/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/1156/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/1317/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/1044/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/1562/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/426/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/1038/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/1164/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/996/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/613/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/1013/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/1096/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/1305/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/640/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/1167/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/1180/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/1200/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/754/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/746/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/828/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/857/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/1102/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/1419/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/411/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/776/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf File opened for reading /proc/957/cmdline dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4.elf