Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
11/03/2025, 04:18
Behavioral task
behavioral1
Sample
a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
6 signatures
150 seconds
General
-
Target
a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf
-
Size
73KB
-
MD5
b03d3fdd1b0541d70bf20333bc29d6da
-
SHA1
3524cacc0f59f1764e28279e4e65ac94c63b9281
-
SHA256
a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd
-
SHA512
e09fdcb7e943b7deceb815334b739d11c7c60a460b5a67e24628a8092ee7ddc5327eeff1988dab39e0bb812d6e56df39f8defa0f0fabe958f048c6fc428c17b4
-
SSDEEP
1536:/RnShVB6RcsK06pvJiYgP/rhYm1lekVuTjCdzISjM9U9lEUiqhnFsHV:oVBhsmvJirP9HjxVuTjCdzISjwohnFu
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for modification /dev/misc/watchdog a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf -
Renames itself 1 IoCs
pid Process 649 a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 168.235.111.72 -
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself oom_reaper 649 a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf -
description ioc Process File opened for reading /proc/9/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/25/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/105/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/403/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/644/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/16/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/137/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/648/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/21/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/270/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/297/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/389/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/26/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/28/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/214/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/2/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/6/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/14/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/17/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/165/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/29/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/282/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/1/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/3/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/7/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/8/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/24/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/19/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/97/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/441/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/4/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/269/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/635/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/20/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/43/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/75/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/283/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/311/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/647/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/23/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/27/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/42/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/604/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/649/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/148/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/267/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/642/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/12/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/13/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/22/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/41/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/107/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/108/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/131/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/316/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/11/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/299/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/641/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/646/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/5/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/10/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/15/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/18/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf File opened for reading /proc/439/comm a1d4783a0f02214fea4f9554f62dd48a055a8578ed7084d9486989e8d2d807cd.elf