Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
128s -
max time network
162s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
11/03/2025, 04:01
Behavioral task
behavioral1
Sample
8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf
Resource
debian9-armhf-20240611-en
General
-
Target
8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf
-
Size
51KB
-
MD5
b1e5cd6656d464d23fe45ad11bf71c6e
-
SHA1
baa24baeff643c4987a700cf78ac9b3c4f174bab
-
SHA256
8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b
-
SHA512
89e133983892bed2ec7c17d6be24c4daa92b2c4461d5b8a867d7fc991a1f64a53be48a8b378704898910d6ea5d418edf2c6aad5f3326209b1eaba5701c8cde07
-
SSDEEP
768:gz/VLG4Kc9tJRaY/39XHSxFjqRsQo8CZya5NPWgt5tA1xz9NsI4X0s46gl:WVatk39XwjqSvZya5Fjt5AZM
Malware Config
Signatures
-
Contacts a large (162264) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for modification /dev/misc/watchdog 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf -
Renames itself 1 IoCs
pid Process 651 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf -
Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 202.61.197.122 Destination IP 194.36.144.87 Destination IP 194.36.144.87 Destination IP 194.36.144.87 Destination IP 194.36.144.87 Destination IP 194.36.144.87 -
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself bioset 651 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf -
description ioc Process File opened for reading /proc/389/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/16/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/165/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/214/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/267/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/441/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/7/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/131/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/21/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/270/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/2/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/24/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/107/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/137/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/139/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/646/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/5/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/6/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/26/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/105/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/299/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/651/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/8/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/20/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/108/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/269/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/282/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/297/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/439/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/604/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/11/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/27/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/28/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/75/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/316/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/403/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/649/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/3/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/10/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/19/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/42/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/1/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/22/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/148/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/13/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/637/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/17/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/29/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/41/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/14/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/15/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/25/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/9/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/97/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/280/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/23/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/311/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/643/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/644/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/4/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/12/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/18/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/648/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf File opened for reading /proc/650/comm 8bf0617c8eb0d23754ee49c36c72e01c06d256a3782cee83b5b500b80aa6b92b.elf