Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
156s -
platform
debian-12_armhf -
resource
debian12-armhf-20240221-en -
resource tags
arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
27/01/2025, 04:22
Behavioral task
behavioral1
Sample
8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf
Resource
debian12-armhf-20240221-en
debian-12-armhf
3 signatures
150 seconds
General
-
Target
8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf
-
Size
204KB
-
MD5
ad9cdc44bc20120c61e41bf542552924
-
SHA1
d4ce210d33252ce2aa67e4e72d072e02122b4df7
-
SHA256
8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed
-
SHA512
1c8c9fe31685c09523e10e034d8fa94bb0132af1270f33c593908bee763b58d6b5df29bc89f51196ecc562bad22430e67f6393cf4a4d1f22db364e453812c5c2
-
SSDEEP
6144:Rdq+j3uigacvucaDxoWCZGq8kvVpM+uxGM/RzMIQ:R/j3u2aucadoWCZHP9p2xf/uIQ
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 711 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself httpd 708 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf -
description ioc Process File opened for reading /proc/333s�/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/1111�2/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/7777</cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/3333fffffff/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/3333-5/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/6666�;/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/44/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/3333D7/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/7777C</cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/11/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/111c}/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/1111)</cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/111c{/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/222/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/222v�/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/333s�/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/33335/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/6666></cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/33/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/77/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/7777@</cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/7777A</cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/222/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/333�/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/3333�4/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/2222*</cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/6666�;/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/7777/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/66/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/222m�/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/222�/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/444d�/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/444/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/555/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/1111[0/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/2222r4/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/3333�4/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/3333�4/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/6666?</cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/7777</cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/77776</cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/111u/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/222l�/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/222c�/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/333/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/4444�8/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/99ssi/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/333�/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/444s�/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/88/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/111/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/111us/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/777/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/3333G5/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/1111�/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/6666�;/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/6666�;/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/55/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/2222�3/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/4444c7/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/6666�8/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/22/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/111k/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf File opened for reading /proc/555k�/cmdline 8361bc3712d0e9a5df09df0f3fce016699b33996ec50bc4a75ddbec71127f9ed.elf