Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
debian-12_armhf -
resource
debian12-armhf-20240221-en -
resource tags
arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
30/01/2025, 03:07
Behavioral task
behavioral1
Sample
52cb4ae51f95198c9e4ba8f27366c72b27d5d1f759a3235ac578d9ad0cdd1b40.elf
Resource
debian12-armhf-20240221-en
General
-
Target
52cb4ae51f95198c9e4ba8f27366c72b27d5d1f759a3235ac578d9ad0cdd1b40.elf
-
Size
45KB
-
MD5
2535d0ba29f1ba80df0e2358fbf3322d
-
SHA1
c3abc6119a0d947d1597d46d01638799bc603a74
-
SHA256
52cb4ae51f95198c9e4ba8f27366c72b27d5d1f759a3235ac578d9ad0cdd1b40
-
SHA512
b0572e2fc5e36fb374e5c81d6aa61d19d65f9b78f0027ee107ffbb1613653acb73f0ffc275c275333cfeb14e8593aa8e804c56d877cf40f73e7b4e81a705dbbe
-
SSDEEP
768:ap/KgJ62FIp5Ydq19552zXvIqhUvjMVcitdljLaBulp99q3UELiX4ezjo1GK63RJ:alKgM2s2a95ozwPjccMjGBunQLiJjo7Q
Malware Config
Extracted
mirai
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 52cb4ae51f95198c9e4ba8f27366c72b27d5d1f759a3235ac578d9ad0cdd1b40.elf File opened for modification /dev/misc/watchdog 52cb4ae51f95198c9e4ba8f27366c72b27d5d1f759a3235ac578d9ad0cdd1b40.elf -
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 52cb4ae51f95198c9e4ba8f27366c72b27d5d1f759a3235ac578d9ad0cdd1b40.elf File opened for modification /bin/watchdog 52cb4ae51f95198c9e4ba8f27366c72b27d5d1f759a3235ac578d9ad0cdd1b40.elf -
description ioc Process File opened for reading /proc/self/exe 52cb4ae51f95198c9e4ba8f27366c72b27d5d1f759a3235ac578d9ad0cdd1b40.elf File opened for reading /proc/644/cmdline 52cb4ae51f95198c9e4ba8f27366c72b27d5d1f759a3235ac578d9ad0cdd1b40.elf File opened for reading /proc/662/cmdline 52cb4ae51f95198c9e4ba8f27366c72b27d5d1f759a3235ac578d9ad0cdd1b40.elf File opened for reading /proc/675/cmdline 52cb4ae51f95198c9e4ba8f27366c72b27d5d1f759a3235ac578d9ad0cdd1b40.elf File opened for reading /proc/696/cmdline 52cb4ae51f95198c9e4ba8f27366c72b27d5d1f759a3235ac578d9ad0cdd1b40.elf File opened for reading /proc/710/cmdline 52cb4ae51f95198c9e4ba8f27366c72b27d5d1f759a3235ac578d9ad0cdd1b40.elf File opened for reading /proc/627/cmdline 52cb4ae51f95198c9e4ba8f27366c72b27d5d1f759a3235ac578d9ad0cdd1b40.elf File opened for reading /proc/643/cmdline 52cb4ae51f95198c9e4ba8f27366c72b27d5d1f759a3235ac578d9ad0cdd1b40.elf File opened for reading /proc/659/cmdline 52cb4ae51f95198c9e4ba8f27366c72b27d5d1f759a3235ac578d9ad0cdd1b40.elf File opened for reading /proc/701/cmdline 52cb4ae51f95198c9e4ba8f27366c72b27d5d1f759a3235ac578d9ad0cdd1b40.elf File opened for reading /proc/702/cmdline 52cb4ae51f95198c9e4ba8f27366c72b27d5d1f759a3235ac578d9ad0cdd1b40.elf File opened for reading /proc/726/cmdline 52cb4ae51f95198c9e4ba8f27366c72b27d5d1f759a3235ac578d9ad0cdd1b40.elf