Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
10s -
platform
debian-12_mipsel -
resource
debian12-mipsel-20240418-en -
resource tags
arch:mipselimage:debian12-mipsel-20240418-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem -
submitted
26/01/2025, 03:38
Behavioral task
behavioral1
Sample
697730bed4e894e2e9d7264e5194517534b0c2b0c028f83cd36afecf55707336.elf
Resource
debian12-mipsel-20240418-en
5 signatures
150 seconds
General
-
Target
697730bed4e894e2e9d7264e5194517534b0c2b0c028f83cd36afecf55707336.elf
-
Size
24KB
-
MD5
a3150482007ef3f4948803962aaeae5c
-
SHA1
9d213caf06bdb09f518ddf05fc5375de763a10fd
-
SHA256
697730bed4e894e2e9d7264e5194517534b0c2b0c028f83cd36afecf55707336
-
SHA512
2596cb864fab8c389d5e6883e127ef892f4e97b6eda4d8b6bc27ab8478377d11b58c2f740d75b83b835be14755c5290dcd09a2bb6f2b66b89a7e4fb6fec7abae
-
SSDEEP
768:oCrQlS07dEv0UXqUhvQE+CXQKMQKCXBpMZqEWv/:/QlS07FUXqIYSXQKqu0q9
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 697730bed4e894e2e9d7264e5194517534b0c2b0c028f83cd36afecf55707336.elf File opened for modification /dev/misc/watchdog 697730bed4e894e2e9d7264e5194517534b0c2b0c028f83cd36afecf55707336.elf -
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 697730bed4e894e2e9d7264e5194517534b0c2b0c028f83cd36afecf55707336.elf File opened for modification /bin/watchdog 697730bed4e894e2e9d7264e5194517534b0c2b0c028f83cd36afecf55707336.elf -
description ioc Process File opened for reading /proc/717/cmdline 697730bed4e894e2e9d7264e5194517534b0c2b0c028f83cd36afecf55707336.elf File opened for reading /proc/718/cmdline 697730bed4e894e2e9d7264e5194517534b0c2b0c028f83cd36afecf55707336.elf File opened for reading /proc/732/cmdline 697730bed4e894e2e9d7264e5194517534b0c2b0c028f83cd36afecf55707336.elf File opened for reading /proc/672/cmdline 697730bed4e894e2e9d7264e5194517534b0c2b0c028f83cd36afecf55707336.elf File opened for reading /proc/710/cmdline 697730bed4e894e2e9d7264e5194517534b0c2b0c028f83cd36afecf55707336.elf File opened for reading /proc/673/cmdline 697730bed4e894e2e9d7264e5194517534b0c2b0c028f83cd36afecf55707336.elf File opened for reading /proc/688/cmdline 697730bed4e894e2e9d7264e5194517534b0c2b0c028f83cd36afecf55707336.elf File opened for reading /proc/800/cmdline 697730bed4e894e2e9d7264e5194517534b0c2b0c028f83cd36afecf55707336.elf File opened for reading /proc/401/cmdline 697730bed4e894e2e9d7264e5194517534b0c2b0c028f83cd36afecf55707336.elf File opened for reading /proc/427/cmdline 697730bed4e894e2e9d7264e5194517534b0c2b0c028f83cd36afecf55707336.elf File opened for reading /proc/721/cmdline 697730bed4e894e2e9d7264e5194517534b0c2b0c028f83cd36afecf55707336.elf File opened for reading /proc/733/cmdline 697730bed4e894e2e9d7264e5194517534b0c2b0c028f83cd36afecf55707336.elf File opened for reading /proc/792/cmdline 697730bed4e894e2e9d7264e5194517534b0c2b0c028f83cd36afecf55707336.elf File opened for reading /proc/816/cmdline 697730bed4e894e2e9d7264e5194517534b0c2b0c028f83cd36afecf55707336.elf File opened for reading /proc/435/cmdline 697730bed4e894e2e9d7264e5194517534b0c2b0c028f83cd36afecf55707336.elf File opened for reading /proc/690/cmdline 697730bed4e894e2e9d7264e5194517534b0c2b0c028f83cd36afecf55707336.elf File opened for reading /proc/704/cmdline 697730bed4e894e2e9d7264e5194517534b0c2b0c028f83cd36afecf55707336.elf File opened for reading /proc/747/cmdline 697730bed4e894e2e9d7264e5194517534b0c2b0c028f83cd36afecf55707336.elf File opened for reading /proc/753/cmdline 697730bed4e894e2e9d7264e5194517534b0c2b0c028f83cd36afecf55707336.elf File opened for reading /proc/796/cmdline 697730bed4e894e2e9d7264e5194517534b0c2b0c028f83cd36afecf55707336.elf File opened for reading /proc/421/cmdline 697730bed4e894e2e9d7264e5194517534b0c2b0c028f83cd36afecf55707336.elf File opened for reading /proc/698/cmdline 697730bed4e894e2e9d7264e5194517534b0c2b0c028f83cd36afecf55707336.elf