Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
46s -
max time network
157s -
platform
debian-12_armhf -
resource
debian12-armhf-20240221-en -
resource tags
arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
04/03/2025, 00:08
Behavioral task
behavioral1
Sample
arm7.elf
Resource
debian12-armhf-20240221-en
General
-
Target
arm7.elf
-
Size
176KB
-
MD5
6d9b4dcc2c4b2637afc33319812aa90f
-
SHA1
d80a6578c832c51f43492e2be770d2945816fdb8
-
SHA256
2ff81e6c4d5d914652cf18225e6dfbdd6e70b03eb94b7218eb3ecd1a1d9fcf09
-
SHA512
d84acabcbe7243b1b2e0c08ec52683cb393dd7a97ab5b5c880b5a30415365e67aeff69c22d5438250b90674f8bcbdf5d93e0a4ecbf55367bce4e8e92f820455d
-
SSDEEP
3072:nXsaq0wQFD2URQlMpChL6fmffpagi/12kwwT738vRRIx+ZI1M/9TnMRQ:nXsaLwQFyURmMA6Mpagi/12NwM5ax+ZX
Malware Config
Signatures
-
Contacts a large (199340) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog arm7.elf File opened for modification /dev/misc/watchdog arm7.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself KcfvGwPntLTEeaQ 706 arm7.elf -
description ioc Process File opened for reading /proc/636/cmdline arm7.elf File opened for reading /proc/727/cmdline arm7.elf File opened for reading /proc/761/cmdline arm7.elf File opened for reading /proc/684/cmdline arm7.elf File opened for reading /proc/729/cmdline arm7.elf File opened for reading /proc/626/cmdline arm7.elf File opened for reading /proc/705/cmdline arm7.elf File opened for reading /proc/714/cmdline arm7.elf File opened for reading /proc/703/cmdline arm7.elf File opened for reading /proc/713/cmdline arm7.elf File opened for reading /proc/764/cmdline arm7.elf File opened for reading /proc/710/cmdline arm7.elf File opened for reading /proc/715/cmdline arm7.elf File opened for reading /proc/716/cmdline arm7.elf File opened for reading /proc/717/cmdline arm7.elf File opened for reading /proc/735/cmdline arm7.elf File opened for reading /proc/763/cmdline arm7.elf File opened for reading /proc/468/cmdline arm7.elf File opened for reading /proc/666/cmdline arm7.elf File opened for reading /proc/698/cmdline arm7.elf File opened for reading /proc/749/cmdline arm7.elf File opened for reading /proc/750/cmdline arm7.elf File opened for reading /proc/680/cmdline arm7.elf File opened for reading /proc/681/cmdline arm7.elf File opened for reading /proc/707/cmdline arm7.elf File opened for reading /proc/711/cmdline arm7.elf File opened for reading /proc/712/cmdline arm7.elf File opened for reading /proc/762/cmdline arm7.elf File opened for reading /proc/465/cmdline arm7.elf File opened for reading /proc/704/cmdline arm7.elf File opened for reading /proc/709/cmdline arm7.elf File opened for reading /proc/756/cmdline arm7.elf