Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
debian-12_armhf -
resource
debian12-armhf-20240221-en -
resource tags
arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
19/01/2025, 18:02
Behavioral task
behavioral1
Sample
boatnet.arm7.elf
Resource
debian12-armhf-20240221-en
5 signatures
150 seconds
General
-
Target
boatnet.arm7.elf
-
Size
52KB
-
MD5
b2c5f835d54c4829e8f062e3e0f4f8a6
-
SHA1
e3b0b074c60927ddee00eef66939dd93540bc158
-
SHA256
ef6879e75ae0fa91215a456ab9411576fb46d9e701c81c3dd03ae530b63d089f
-
SHA512
ec27677784dd7ce10ba8efed5b3d1e2dbb795bb6c037e10d5273b42fc1a5432055e7f78f97570359de3733c7b091fee7cfe6a542f46b046bb68f7578e1aa494b
-
SSDEEP
1536:qjzYAnr5oMZomQkE3dGQ+LLmyBGkKRKoMYj:d0VZHE3dGQ+L6dlMYj
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog boatnet.arm7.elf File opened for modification /dev/misc/watchdog boatnet.arm7.elf -
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog boatnet.arm7.elf File opened for modification /bin/watchdog boatnet.arm7.elf -
description ioc Process File opened for reading /proc/639/cmdline boatnet.arm7.elf File opened for reading /proc/680/cmdline boatnet.arm7.elf File opened for reading /proc/700/cmdline boatnet.arm7.elf File opened for reading /proc/705/cmdline boatnet.arm7.elf File opened for reading /proc/718/cmdline boatnet.arm7.elf File opened for reading /proc/638/cmdline boatnet.arm7.elf File opened for reading /proc/654/cmdline boatnet.arm7.elf File opened for reading /proc/655/cmdline boatnet.arm7.elf File opened for reading /proc/665/cmdline boatnet.arm7.elf File opened for reading /proc/706/cmdline boatnet.arm7.elf File opened for reading /proc/714/cmdline boatnet.arm7.elf File opened for reading /proc/self/exe boatnet.arm7.elf