Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
147s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240522.1-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240522.1-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
25/01/2025, 19:13
Behavioral task
behavioral1
Sample
boatnet.x86.elf
Resource
ubuntu2204-amd64-20240522.1-en
ubuntu-22.04-amd64
6 signatures
150 seconds
General
-
Target
boatnet.x86.elf
-
Size
20KB
-
MD5
371a8089f0d9b997dede00d908f2d729
-
SHA1
4dc06821ff7cec56b2bc31f788084bc1e12af2d7
-
SHA256
02062dff2765a4d772fa31daea8de2db65ea363cebf6662fda7426fe56c93a2e
-
SHA512
ca1706b263af403bad3872fe29977b6c78725e707eaa0fb2d4f613bfb0f7dcf75a3196a444f49ed6eeac8120df8132b073b94ee2b0d6b6f77055d6200f65d754
-
SSDEEP
384:M0sLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaHhib+502F2vwA9dWuMW21bAK1oTm:k98o08kxofBE+ZkXaEbp2F2TWul0c5Qv
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc File opened for modification /dev/watchdog File opened for modification /dev/misc/watchdog -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc File opened for modification /sbin/watchdog File opened for modification /bin/watchdog -
description ioc File opened for reading /proc/610/cmdline File opened for reading /proc/1646/cmdline File opened for reading /proc/984/cmdline File opened for reading /proc/1076/cmdline File opened for reading /proc/1174/cmdline File opened for reading /proc/1437/cmdline File opened for reading /proc/1570/cmdline File opened for reading /proc/415/cmdline File opened for reading /proc/632/cmdline File opened for reading /proc/1094/cmdline File opened for reading /proc/1167/cmdline File opened for reading /proc/1191/cmdline File opened for reading /proc/1499/cmdline File opened for reading /proc/425/cmdline File opened for reading /proc/772/cmdline File opened for reading /proc/1143/cmdline File opened for reading /proc/1170/cmdline File opened for reading /proc/1218/cmdline File opened for reading /proc/1501/cmdline File opened for reading /proc/1574/cmdline File opened for reading /proc/963/cmdline File opened for reading /proc/1635/cmdline File opened for reading /proc/1249/cmdline File opened for reading /proc/452/cmdline File opened for reading /proc/630/cmdline File opened for reading /proc/1412/cmdline File opened for reading /proc/498/cmdline File opened for reading /proc/830/cmdline File opened for reading /proc/1213/cmdline File opened for reading /proc/594/cmdline File opened for reading /proc/1518/cmdline File opened for reading /proc/656/cmdline File opened for reading /proc/735/cmdline File opened for reading /proc/1033/cmdline File opened for reading /proc/1050/cmdline File opened for reading /proc/1382/cmdline File opened for reading /proc/408/cmdline File opened for reading /proc/762/cmdline File opened for reading /proc/1085/cmdline File opened for reading /proc/1252/cmdline File opened for reading /proc/1555/cmdline File opened for reading /proc/739/cmdline File opened for reading /proc/852/cmdline File opened for reading /proc/992/cmdline File opened for reading /proc/1108/cmdline File opened for reading /proc/1169/cmdline File opened for reading /proc/1217/cmdline File opened for reading /proc/1440/cmdline File opened for reading /proc/1059/cmdline File opened for reading /proc/1111/cmdline File opened for reading /proc/414/cmdline File opened for reading /proc/643/cmdline File opened for reading /proc/749/cmdline File opened for reading /proc/1235/cmdline File opened for reading /proc/1601/cmdline File opened for reading /proc/528/cmdline File opened for reading /proc/613/cmdline File opened for reading /proc/1013/cmdline File opened for reading /proc/1066/cmdline File opened for reading /proc/1554/cmdline File opened for reading /proc/426/cmdline File opened for reading /proc/660/cmdline File opened for reading /proc/868/cmdline File opened for reading /proc/1163/cmdline