Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
154s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
10/03/2025, 23:08
Behavioral task
behavioral1
Sample
arm.elf
Resource
debian9-armhf-20240611-en
General
-
Target
arm.elf
-
Size
60KB
-
MD5
35c215d8e2b2ea03a8a191fb3723195a
-
SHA1
c38bcfc3d7050edeff1b7dbffd85d07348bb01e9
-
SHA256
c4fd68b20997f3c8a60dbadf177b3309d465f0a8bb0ad9b33b4c70ee74dc3a90
-
SHA512
ea5a9fda95965b6eb55c47eefe2b42a9234d13c8d05556e72e916f98a626a0a835fa7f7828d4051b6056d639b06bec0136afa9ac3157736702b94c0ed9effdf8
-
SSDEEP
1536:shzX+4Y8vHslnlyyMybOk7SMj8+JdzXbBRc:kzX+4Z4lFORMjfdzXo
Malware Config
Signatures
-
Contacts a large (76426) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog arm.elf File opened for modification /dev/misc/watchdog arm.elf -
Renames itself 1 IoCs
pid Process 660 arm.elf -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 81.169.136.222 -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp arm.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads process memory 1 TTPs 64 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/754/maps arm.elf File opened for reading /proc/755/maps arm.elf File opened for reading /proc/783/maps arm.elf File opened for reading /proc/679/maps arm.elf File opened for reading /proc/699/maps arm.elf File opened for reading /proc/707/maps arm.elf File opened for reading /proc/740/maps arm.elf File opened for reading /proc/742/maps arm.elf File opened for reading /proc/766/maps arm.elf File opened for reading /proc/690/maps arm.elf File opened for reading /proc/704/maps arm.elf File opened for reading /proc/711/maps arm.elf File opened for reading /proc/714/maps arm.elf File opened for reading /proc/763/maps arm.elf File opened for reading /proc/768/maps arm.elf File opened for reading /proc/775/maps arm.elf File opened for reading /proc/791/maps arm.elf File opened for reading /proc/693/maps arm.elf File opened for reading /proc/727/maps arm.elf File opened for reading /proc/738/maps arm.elf File opened for reading /proc/745/maps arm.elf File opened for reading /proc/750/maps arm.elf File opened for reading /proc/772/maps arm.elf File opened for reading /proc/681/maps arm.elf File opened for reading /proc/697/maps arm.elf File opened for reading /proc/784/maps arm.elf File opened for reading /proc/788/maps arm.elf File opened for reading /proc/689/maps arm.elf File opened for reading /proc/718/maps arm.elf File opened for reading /proc/736/maps arm.elf File opened for reading /proc/767/maps arm.elf File opened for reading /proc/769/maps arm.elf File opened for reading /proc/790/maps arm.elf File opened for reading /proc/687/maps arm.elf File opened for reading /proc/691/maps arm.elf File opened for reading /proc/724/maps arm.elf File opened for reading /proc/725/maps arm.elf File opened for reading /proc/728/maps arm.elf File opened for reading /proc/773/maps arm.elf File opened for reading /proc/789/maps arm.elf File opened for reading /proc/695/maps arm.elf File opened for reading /proc/700/maps arm.elf File opened for reading /proc/703/maps arm.elf File opened for reading /proc/715/maps arm.elf File opened for reading /proc/720/maps arm.elf File opened for reading /proc/726/maps arm.elf File opened for reading /proc/735/maps arm.elf File opened for reading /proc/737/maps arm.elf File opened for reading /proc/678/maps arm.elf File opened for reading /proc/680/maps arm.elf File opened for reading /proc/696/maps arm.elf File opened for reading /proc/722/maps arm.elf File opened for reading /proc/741/maps arm.elf File opened for reading /proc/764/maps arm.elf File opened for reading /proc/771/maps arm.elf File opened for reading /proc/774/maps arm.elf File opened for reading /proc/684/maps arm.elf File opened for reading /proc/686/maps arm.elf File opened for reading /proc/694/maps arm.elf File opened for reading /proc/702/maps arm.elf File opened for reading /proc/713/maps arm.elf File opened for reading /proc/733/maps arm.elf File opened for reading /proc/785/maps arm.elf File opened for reading /proc/787/maps arm.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself (sd-pam) 660 arm.elf -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp arm.elf -
description ioc Process File opened for reading /proc/767/cmdline arm.elf File opened for reading /proc/782/cmdline arm.elf File opened for reading /proc/306/comm arm.elf File opened for reading /proc/329/comm arm.elf File opened for reading /proc/687/cmdline arm.elf File opened for reading /proc/715/cmdline arm.elf File opened for reading /proc/16/comm arm.elf File opened for reading /proc/304/comm arm.elf File opened for reading /proc/779/cmdline arm.elf File opened for reading /proc/786/cmdline arm.elf File opened for reading /proc/167/comm arm.elf File opened for reading /proc/304/status arm.elf File opened for reading /proc/318/status arm.elf File opened for reading /proc/720/cmdline arm.elf File opened for reading /proc/731/cmdline arm.elf File opened for reading /proc/771/cmdline arm.elf File opened for reading /proc/785/cmdline arm.elf File opened for reading /proc/706/cmdline arm.elf File opened for reading /proc/709/cmdline arm.elf File opened for reading /proc/775/cmdline arm.elf File opened for reading /proc/29/comm arm.elf File opened for reading /proc/287/comm arm.elf File opened for reading /proc/719/cmdline arm.elf File opened for reading /proc/789/cmdline arm.elf File opened for reading /proc/689/cmdline arm.elf File opened for reading /proc/690/cmdline arm.elf File opened for reading /proc/222/comm arm.elf File opened for reading /proc/318/comm arm.elf File opened for reading /proc/4/comm arm.elf File opened for reading /proc/18/comm arm.elf File opened for reading /proc/679/cmdline arm.elf File opened for reading /proc/707/cmdline arm.elf File opened for reading /proc/695/cmdline arm.elf File opened for reading /proc/8/comm arm.elf File opened for reading /proc/10/comm arm.elf File opened for reading /proc/653/status arm.elf File opened for reading /proc/736/cmdline arm.elf File opened for reading /proc/773/cmdline arm.elf File opened for reading /proc/28/comm arm.elf File opened for reading /proc/764/cmdline arm.elf File opened for reading /proc/398/status arm.elf File opened for reading /proc/677/cmdline arm.elf File opened for reading /proc/718/cmdline arm.elf File opened for reading /proc/722/cmdline arm.elf File opened for reading /proc/727/cmdline arm.elf File opened for reading /proc/776/cmdline arm.elf File opened for reading /proc/27/comm arm.elf File opened for reading /proc/25/comm arm.elf File opened for reading /proc/155/comm arm.elf File opened for reading /proc/288/comm arm.elf File opened for reading /proc/659/comm arm.elf File opened for reading /proc/688/cmdline arm.elf File opened for reading /proc/726/cmdline arm.elf File opened for reading /proc/730/cmdline arm.elf File opened for reading /proc/6/comm arm.elf File opened for reading /proc/41/comm arm.elf File opened for reading /proc/656/comm arm.elf File opened for reading /proc/222/status arm.elf File opened for reading /proc/684/cmdline arm.elf File opened for reading /proc/696/cmdline arm.elf File opened for reading /proc/721/cmdline arm.elf File opened for reading /proc/723/cmdline arm.elf File opened for reading /proc/11/comm arm.elf File opened for reading /proc/650/status arm.elf