Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
debian-12_armhf -
resource
debian12-armhf-20240418-en -
resource tags
arch:armhfimage:debian12-armhf-20240418-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
04/02/2025, 04:25
Behavioral task
behavioral1
Sample
acd996e81a14dbf34e3656c6f8cc1ae548eaf659e6247296c7bae7ed3edeb093.elf
Resource
debian12-armhf-20240418-en
5 signatures
150 seconds
General
-
Target
acd996e81a14dbf34e3656c6f8cc1ae548eaf659e6247296c7bae7ed3edeb093.elf
-
Size
45KB
-
MD5
5e36c339a599116b0729e8cb030728a8
-
SHA1
7449c89cde70e13878fded3a3cfdcc30d5079bac
-
SHA256
acd996e81a14dbf34e3656c6f8cc1ae548eaf659e6247296c7bae7ed3edeb093
-
SHA512
ed722447e2cfb1c7012f5a25e3173d22e513f4e8777d052e9eb437de23ca41b965ceb8ccd92bf53c35bbb6dd4138e57cf2d3862065ba26838cb90cf1f6091b09
-
SSDEEP
768:D/TYCoIxdEk+AxoTZAZHFeq8b3a9q3UELbUXfi6nVMQHI4vcGpvQ:DECFd+A6YHAxPLRQZQ
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog acd996e81a14dbf34e3656c6f8cc1ae548eaf659e6247296c7bae7ed3edeb093.elf File opened for modification /dev/misc/watchdog acd996e81a14dbf34e3656c6f8cc1ae548eaf659e6247296c7bae7ed3edeb093.elf -
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /bin/watchdog acd996e81a14dbf34e3656c6f8cc1ae548eaf659e6247296c7bae7ed3edeb093.elf File opened for modification /sbin/watchdog acd996e81a14dbf34e3656c6f8cc1ae548eaf659e6247296c7bae7ed3edeb093.elf -
description ioc Process File opened for reading /proc/705/cmdline acd996e81a14dbf34e3656c6f8cc1ae548eaf659e6247296c7bae7ed3edeb093.elf File opened for reading /proc/628/cmdline acd996e81a14dbf34e3656c6f8cc1ae548eaf659e6247296c7bae7ed3edeb093.elf File opened for reading /proc/645/cmdline acd996e81a14dbf34e3656c6f8cc1ae548eaf659e6247296c7bae7ed3edeb093.elf File opened for reading /proc/663/cmdline acd996e81a14dbf34e3656c6f8cc1ae548eaf659e6247296c7bae7ed3edeb093.elf File opened for reading /proc/699/cmdline acd996e81a14dbf34e3656c6f8cc1ae548eaf659e6247296c7bae7ed3edeb093.elf File opened for reading /proc/704/cmdline acd996e81a14dbf34e3656c6f8cc1ae548eaf659e6247296c7bae7ed3edeb093.elf File opened for reading /proc/719/cmdline acd996e81a14dbf34e3656c6f8cc1ae548eaf659e6247296c7bae7ed3edeb093.elf File opened for reading /proc/self/exe acd996e81a14dbf34e3656c6f8cc1ae548eaf659e6247296c7bae7ed3edeb093.elf File opened for reading /proc/646/cmdline acd996e81a14dbf34e3656c6f8cc1ae548eaf659e6247296c7bae7ed3edeb093.elf File opened for reading /proc/661/cmdline acd996e81a14dbf34e3656c6f8cc1ae548eaf659e6247296c7bae7ed3edeb093.elf File opened for reading /proc/680/cmdline acd996e81a14dbf34e3656c6f8cc1ae548eaf659e6247296c7bae7ed3edeb093.elf File opened for reading /proc/712/cmdline acd996e81a14dbf34e3656c6f8cc1ae548eaf659e6247296c7bae7ed3edeb093.elf