Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240611-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
01/02/2025, 13:42
Behavioral task
behavioral1
Sample
splmips.elf
Resource
debian9-mipsbe-20240611-en
General
-
Target
splmips.elf
-
Size
70KB
-
MD5
fb5e5245688736e9d13c832465292e6a
-
SHA1
e31e6863abf4610186c14e5bb868152ed902ffeb
-
SHA256
65797db0f0c80761c8f733de64d0f44431ecf18af76702319b84b34dd9111c99
-
SHA512
134df4aebe6543768eb0c6034fc66840bf41d858bb97f5ae3c41898ced3b51252e1e3d2544f79b59652f3df7c0838a27475d02057bb3af710ca283af4d2a6e29
-
SSDEEP
1536:xvfwnX7GltwnKn4Qp9WF7h9ibxU5jZ6i0nyAcx:tInX78twufXu5ci+yTx
Malware Config
Signatures
-
Contacts a large (44375) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes itself 1 IoCs
pid Process 712 splmips.elf -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog splmips.elf File opened for modification /dev/misc/watchdog splmips.elf -
Renames itself 1 IoCs
pid Process 712 splmips.elf -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 152.53.15.127 -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp splmips.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads process memory 1 TTPs 54 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/739/maps splmips.elf File opened for reading /proc/782/maps splmips.elf File opened for reading /proc/805/maps splmips.elf File opened for reading /proc/753/maps splmips.elf File opened for reading /proc/768/maps splmips.elf File opened for reading /proc/772/maps splmips.elf File opened for reading /proc/756/maps splmips.elf File opened for reading /proc/787/maps splmips.elf File opened for reading /proc/791/maps splmips.elf File opened for reading /proc/815/maps splmips.elf File opened for reading /proc/818/maps splmips.elf File opened for reading /proc/757/maps splmips.elf File opened for reading /proc/764/maps splmips.elf File opened for reading /proc/797/maps splmips.elf File opened for reading /proc/809/maps splmips.elf File opened for reading /proc/745/maps splmips.elf File opened for reading /proc/749/maps splmips.elf File opened for reading /proc/758/maps splmips.elf File opened for reading /proc/761/maps splmips.elf File opened for reading /proc/811/maps splmips.elf File opened for reading /proc/776/maps splmips.elf File opened for reading /proc/789/maps splmips.elf File opened for reading /proc/802/maps splmips.elf File opened for reading /proc/752/maps splmips.elf File opened for reading /proc/795/maps splmips.elf File opened for reading /proc/803/maps splmips.elf File opened for reading /proc/770/maps splmips.elf File opened for reading /proc/777/maps splmips.elf File opened for reading /proc/779/maps splmips.elf File opened for reading /proc/812/maps splmips.elf File opened for reading /proc/740/maps splmips.elf File opened for reading /proc/746/maps splmips.elf File opened for reading /proc/780/maps splmips.elf File opened for reading /proc/744/maps splmips.elf File opened for reading /proc/750/maps splmips.elf File opened for reading /proc/774/maps splmips.elf File opened for reading /proc/798/maps splmips.elf File opened for reading /proc/742/maps splmips.elf File opened for reading /proc/793/maps splmips.elf File opened for reading /proc/799/maps splmips.elf File opened for reading /proc/760/maps splmips.elf File opened for reading /proc/766/maps splmips.elf File opened for reading /proc/785/maps splmips.elf File opened for reading /proc/786/maps splmips.elf File opened for reading /proc/813/maps splmips.elf File opened for reading /proc/743/maps splmips.elf File opened for reading /proc/762/maps splmips.elf File opened for reading /proc/792/maps splmips.elf File opened for reading /proc/748/maps splmips.elf File opened for reading /proc/773/maps splmips.elf File opened for reading /proc/754/maps splmips.elf File opened for reading /proc/801/maps splmips.elf File opened for reading /proc/807/maps splmips.elf File opened for reading /proc/817/maps splmips.elf -
Changes its process name 1 IoCs
description pid Process Changes the process name, possibly in an attempt to hide itself 712 splmips.elf -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp splmips.elf -
description ioc Process File opened for reading /proc/376/status splmips.elf File opened for reading /proc/418/status splmips.elf File opened for reading /proc/754/cmdline splmips.elf File opened for reading /proc/818/cmdline splmips.elf File opened for reading /proc/385/status splmips.elf File opened for reading /proc/766/cmdline splmips.elf File opened for reading /proc/803/cmdline splmips.elf File opened for reading /proc/782/cmdline splmips.elf File opened for reading /proc/785/cmdline splmips.elf File opened for reading /proc/791/cmdline splmips.elf File opened for reading /proc/343/status splmips.elf File opened for reading /proc/773/cmdline splmips.elf File opened for reading /proc/780/cmdline splmips.elf File opened for reading /proc/748/cmdline splmips.elf File opened for reading /proc/772/cmdline splmips.elf File opened for reading /proc/787/cmdline splmips.elf File opened for reading /proc/792/cmdline splmips.elf File opened for reading /proc/674/status splmips.elf File opened for reading /proc/690/status splmips.elf File opened for reading /proc/744/cmdline splmips.elf File opened for reading /proc/809/cmdline splmips.elf File opened for reading /proc/392/status splmips.elf File opened for reading /proc/679/status splmips.elf File opened for reading /proc/776/cmdline splmips.elf File opened for reading /proc/817/cmdline splmips.elf File opened for reading /proc/176/status splmips.elf File opened for reading /proc/770/cmdline splmips.elf File opened for reading /proc/797/cmdline splmips.elf File opened for reading /proc/self/maps splmips.elf File opened for reading /proc/774/cmdline splmips.elf File opened for reading /proc/793/cmdline splmips.elf File opened for reading /proc/156/status splmips.elf File opened for reading /proc/251/status splmips.elf File opened for reading /proc/713/status splmips.elf File opened for reading /proc/339/status splmips.elf File opened for reading /proc/739/cmdline splmips.elf File opened for reading /proc/779/cmdline splmips.elf File opened for reading /proc/798/cmdline splmips.elf File opened for reading /proc/680/status splmips.elf File opened for reading /proc/750/cmdline splmips.elf File opened for reading /proc/789/cmdline splmips.elf File opened for reading /proc/743/cmdline splmips.elf File opened for reading /proc/745/cmdline splmips.elf File opened for reading /proc/752/cmdline splmips.elf File opened for reading /proc/762/cmdline splmips.elf File opened for reading /proc/764/cmdline splmips.elf File opened for reading /proc/337/status splmips.elf File opened for reading /proc/703/status splmips.elf File opened for reading /proc/742/cmdline splmips.elf File opened for reading /proc/777/cmdline splmips.elf File opened for reading /proc/761/cmdline splmips.elf File opened for reading /proc/786/cmdline splmips.elf File opened for reading /proc/807/cmdline splmips.elf File opened for reading /proc/341/status splmips.elf File opened for reading /proc/704/status splmips.elf File opened for reading /proc/740/cmdline splmips.elf File opened for reading /proc/760/cmdline splmips.elf File opened for reading /proc/746/cmdline splmips.elf File opened for reading /proc/749/cmdline splmips.elf File opened for reading /proc/753/cmdline splmips.elf File opened for reading /proc/801/cmdline splmips.elf File opened for reading /proc/805/cmdline splmips.elf File opened for reading /proc/670/status splmips.elf File opened for reading /proc/757/cmdline splmips.elf -
System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 712 splmips.elf