Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
debian-9_armhf -
resource
debian9-armhf-20240729-en -
resource tags
arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
06/03/2025, 03:17
Behavioral task
behavioral1
Sample
donk.arm.elf
Resource
debian9-armhf-20240729-en
5 signatures
150 seconds
General
-
Target
donk.arm.elf
-
Size
75KB
-
MD5
2d38d7340cb17560cf125e7621363649
-
SHA1
1359736f18292f843b2599513e970ae368d5dc60
-
SHA256
800c00819cdf420a0b6530d37f91c88426c5ad07d503c98aaab7265d7e1cdfeb
-
SHA512
cb65f60a4157b03b44ecabfe6c84219eb8d29611640a929cece3da6ce7a0e1e8ad4d6c14713d7650be6683256a840fb951f6f5c3223ea19adb6a4e82706e6a6f
-
SSDEEP
1536:Ndrd7rjAOFzZ5+/RjBO48JIy3eflwtzUAFgNva7410Um5:Ndrd6V8JreWtA7a4Jm
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog donk.arm.elf File opened for modification /dev/misc/watchdog donk.arm.elf -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp donk.arm.elf -
Writes file to system bin folder 1 IoCs
description ioc Process File opened for modification /sbin/watchdog donk.arm.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself Gb}DD]bbXb\PD 660 donk.arm.elf -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp donk.arm.elf