Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
7s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240729-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
26/01/2025, 03:29
Behavioral task
behavioral1
Sample
5366ef37d482d37f05ed7b3138b83579dd35c0a47e21bf5df63c9a7b24be40ac.elf
Resource
debian9-mipsbe-20240729-en
General
-
Target
5366ef37d482d37f05ed7b3138b83579dd35c0a47e21bf5df63c9a7b24be40ac.elf
-
Size
23KB
-
MD5
a707c2e2633e0a7e1802bc418d61cff7
-
SHA1
41bda3be4058fe487cec6ccd716354d4c5fb6e16
-
SHA256
5366ef37d482d37f05ed7b3138b83579dd35c0a47e21bf5df63c9a7b24be40ac
-
SHA512
61eb40201080dbc1cc649197a0be1d781c082e92014ae4383bd6a5d5f55a3fa1887f17359a40116849e5e97c97c9d0c0b2a818250437ddac17c93d7ea0f98f8d
-
SSDEEP
384:neD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtuidlmdzJgGlzDpH7uNj1JA0:neD8ZSWvZHZbs1row697qohQvg9nizJ+
Malware Config
Extracted
mirai
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 5366ef37d482d37f05ed7b3138b83579dd35c0a47e21bf5df63c9a7b24be40ac.elf File opened for modification /dev/misc/watchdog 5366ef37d482d37f05ed7b3138b83579dd35c0a47e21bf5df63c9a7b24be40ac.elf -
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 5366ef37d482d37f05ed7b3138b83579dd35c0a47e21bf5df63c9a7b24be40ac.elf File opened for modification /bin/watchdog 5366ef37d482d37f05ed7b3138b83579dd35c0a47e21bf5df63c9a7b24be40ac.elf -
description ioc Process File opened for reading /proc/705/cmdline 5366ef37d482d37f05ed7b3138b83579dd35c0a47e21bf5df63c9a7b24be40ac.elf File opened for reading /proc/763/cmdline 5366ef37d482d37f05ed7b3138b83579dd35c0a47e21bf5df63c9a7b24be40ac.elf File opened for reading /proc/664/cmdline 5366ef37d482d37f05ed7b3138b83579dd35c0a47e21bf5df63c9a7b24be40ac.elf File opened for reading /proc/674/cmdline 5366ef37d482d37f05ed7b3138b83579dd35c0a47e21bf5df63c9a7b24be40ac.elf File opened for reading /proc/675/cmdline 5366ef37d482d37f05ed7b3138b83579dd35c0a47e21bf5df63c9a7b24be40ac.elf File opened for reading /proc/697/cmdline 5366ef37d482d37f05ed7b3138b83579dd35c0a47e21bf5df63c9a7b24be40ac.elf File opened for reading /proc/669/cmdline 5366ef37d482d37f05ed7b3138b83579dd35c0a47e21bf5df63c9a7b24be40ac.elf File opened for reading /proc/698/cmdline 5366ef37d482d37f05ed7b3138b83579dd35c0a47e21bf5df63c9a7b24be40ac.elf File opened for reading /proc/711/cmdline 5366ef37d482d37f05ed7b3138b83579dd35c0a47e21bf5df63c9a7b24be40ac.elf File opened for reading /proc/759/cmdline 5366ef37d482d37f05ed7b3138b83579dd35c0a47e21bf5df63c9a7b24be40ac.elf File opened for reading /proc/771/cmdline 5366ef37d482d37f05ed7b3138b83579dd35c0a47e21bf5df63c9a7b24be40ac.elf File opened for reading /proc/667/cmdline 5366ef37d482d37f05ed7b3138b83579dd35c0a47e21bf5df63c9a7b24be40ac.elf File opened for reading /proc/692/cmdline 5366ef37d482d37f05ed7b3138b83579dd35c0a47e21bf5df63c9a7b24be40ac.elf File opened for reading /proc/696/cmdline 5366ef37d482d37f05ed7b3138b83579dd35c0a47e21bf5df63c9a7b24be40ac.elf File opened for reading /proc/746/cmdline 5366ef37d482d37f05ed7b3138b83579dd35c0a47e21bf5df63c9a7b24be40ac.elf File opened for reading /proc/691/cmdline 5366ef37d482d37f05ed7b3138b83579dd35c0a47e21bf5df63c9a7b24be40ac.elf File opened for reading /proc/702/cmdline 5366ef37d482d37f05ed7b3138b83579dd35c0a47e21bf5df63c9a7b24be40ac.elf