Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
7s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240418-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
31/01/2025, 03:38
Behavioral task
behavioral1
Sample
2211135d60948b88524a9d37f12845dc9eeaa84eb0bb7c1df5f3e8184c408b53.elf
Resource
debian9-mipsbe-20240418-en
5 signatures
150 seconds
General
-
Target
2211135d60948b88524a9d37f12845dc9eeaa84eb0bb7c1df5f3e8184c408b53.elf
-
Size
30KB
-
MD5
4c4020a9ab6aba67a628cbeb31b0af3a
-
SHA1
55ceac92de276759af7f2e5d3827799a8819f687
-
SHA256
2211135d60948b88524a9d37f12845dc9eeaa84eb0bb7c1df5f3e8184c408b53
-
SHA512
10a7110a430c769598db741da2076e63f56b6de70f3bc8fd20c367f49e4b8533765c0b956f0971721bd0203628a82b7c1650d96bdae4a07c962c49d5f3e15a94
-
SSDEEP
768:dXCGiKumo7KL8P6VWe1pidAWk/XTM/GPfT1GrMJgGlzDpbuR1JNd:dXCGi/r9UWkbM/GPfT1bVJuN
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 2211135d60948b88524a9d37f12845dc9eeaa84eb0bb7c1df5f3e8184c408b53.elf File opened for modification /dev/misc/watchdog 2211135d60948b88524a9d37f12845dc9eeaa84eb0bb7c1df5f3e8184c408b53.elf -
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 2211135d60948b88524a9d37f12845dc9eeaa84eb0bb7c1df5f3e8184c408b53.elf File opened for modification /bin/watchdog 2211135d60948b88524a9d37f12845dc9eeaa84eb0bb7c1df5f3e8184c408b53.elf -
description ioc Process File opened for reading /proc/703/cmdline 2211135d60948b88524a9d37f12845dc9eeaa84eb0bb7c1df5f3e8184c408b53.elf File opened for reading /proc/715/cmdline 2211135d60948b88524a9d37f12845dc9eeaa84eb0bb7c1df5f3e8184c408b53.elf File opened for reading /proc/761/cmdline 2211135d60948b88524a9d37f12845dc9eeaa84eb0bb7c1df5f3e8184c408b53.elf File opened for reading /proc/769/cmdline 2211135d60948b88524a9d37f12845dc9eeaa84eb0bb7c1df5f3e8184c408b53.elf File opened for reading /proc/402/cmdline 2211135d60948b88524a9d37f12845dc9eeaa84eb0bb7c1df5f3e8184c408b53.elf File opened for reading /proc/674/cmdline 2211135d60948b88524a9d37f12845dc9eeaa84eb0bb7c1df5f3e8184c408b53.elf File opened for reading /proc/701/cmdline 2211135d60948b88524a9d37f12845dc9eeaa84eb0bb7c1df5f3e8184c408b53.elf File opened for reading /proc/760/cmdline 2211135d60948b88524a9d37f12845dc9eeaa84eb0bb7c1df5f3e8184c408b53.elf File opened for reading /proc/679/cmdline 2211135d60948b88524a9d37f12845dc9eeaa84eb0bb7c1df5f3e8184c408b53.elf File opened for reading /proc/702/cmdline 2211135d60948b88524a9d37f12845dc9eeaa84eb0bb7c1df5f3e8184c408b53.elf File opened for reading /proc/708/cmdline 2211135d60948b88524a9d37f12845dc9eeaa84eb0bb7c1df5f3e8184c408b53.elf File opened for reading /proc/696/cmdline 2211135d60948b88524a9d37f12845dc9eeaa84eb0bb7c1df5f3e8184c408b53.elf File opened for reading /proc/697/cmdline 2211135d60948b88524a9d37f12845dc9eeaa84eb0bb7c1df5f3e8184c408b53.elf File opened for reading /proc/765/cmdline 2211135d60948b88524a9d37f12845dc9eeaa84eb0bb7c1df5f3e8184c408b53.elf File opened for reading /proc/777/cmdline 2211135d60948b88524a9d37f12845dc9eeaa84eb0bb7c1df5f3e8184c408b53.elf File opened for reading /proc/661/cmdline 2211135d60948b88524a9d37f12845dc9eeaa84eb0bb7c1df5f3e8184c408b53.elf File opened for reading /proc/677/cmdline 2211135d60948b88524a9d37f12845dc9eeaa84eb0bb7c1df5f3e8184c408b53.elf File opened for reading /proc/680/cmdline 2211135d60948b88524a9d37f12845dc9eeaa84eb0bb7c1df5f3e8184c408b53.elf File opened for reading /proc/710/cmdline 2211135d60948b88524a9d37f12845dc9eeaa84eb0bb7c1df5f3e8184c408b53.elf File opened for reading /proc/793/cmdline 2211135d60948b88524a9d37f12845dc9eeaa84eb0bb7c1df5f3e8184c408b53.elf