Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240729-en -
resource tags
-
submitted
07/03/2025, 02:59
General
-
Target
1718d85cb454ebac1c8deefec3f4c5242497042dd97985d153db64d9bd0b1682.elf
-
Size
90KB
-
MD5
70b9033366aed23047d2c0ab3015eb14
-
SHA1
789e11f3441f9a59ea05f7533028f068f4681e37
-
SHA256
1718d85cb454ebac1c8deefec3f4c5242497042dd97985d153db64d9bd0b1682
-
SHA512
220c199bd209bc325039de75799b15254839da8c989c7346a9f112ee0e63d0006a9d9673edc336babd82702dbd7cf742090b26fd7051fe22d33dab72dc046008
-
SSDEEP
1536:fUNyqwipEXzKt4kKSdkVz+lW8RYExjSk7IB6FVEOnowRvJQEHx:8mkKSdG+lW8RYExjLM4VEOnowRvJrHx
Malware Config
Signatures
-
Contacts a large (23684) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Reads process memory 1 TTPs 17 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
-
Changes its process name 1 IoCs
-
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/1718d85cb454ebac1c8deefec3f4c5242497042dd97985d153db64d9bd0b1682.elf/tmp/1718d85cb454ebac1c8deefec3f4c5242497042dd97985d153db64d9bd0b1682.elf1⤵
- Modifies Watchdog functionality
- Reads process memory
- Changes its process name
- Writes file to tmp directory