Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
159s -
platform
debian-12_mipsel -
resource
debian12-mipsel-20240221-en -
resource tags
arch:mipselimage:debian12-mipsel-20240221-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem -
submitted
11/03/2025, 04:19
Behavioral task
behavioral1
Sample
a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf
Resource
debian12-mipsel-20240221-en
debian-12-mipsel
6 signatures
150 seconds
General
-
Target
a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf
-
Size
66KB
-
MD5
2e0d7252bae4a9e3039332fa15ea241c
-
SHA1
e6fd1144254105f7519f8e44871d36f527fc59e8
-
SHA256
a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0
-
SHA512
000f2cacc475c6411705ca35e7638259d6724633a091e6fcb7b7a21b44779fa71f34f12cfe0e6916a30d3cda279bcd44ab71ca1fbf0d04155dba30657be8d154
-
SSDEEP
768:XCBEtfJ+/PmzmeQ6jPMMLfOqB5EzeLneZReggk1GtBqJXiWUrzkEtHm:XCB+x+/PmblXWqBqqncRVgk1Gi6ztG
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for modification /dev/watchdog a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf -
Renames itself 1 IoCs
pid Process 739 a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 202.61.197.122 -
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself kworker/u2:5 739 a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf -
description ioc Process File opened for reading /proc/137/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/586/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/729/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/732/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/5/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/138/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/740/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/13/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/27/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/419/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/574/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/705/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/733/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/8/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/32/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/386/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/710/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/11/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/21/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/116/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/30/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/112/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/371/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/372/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/12/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/18/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/24/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/25/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/258/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/719/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/118/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/712/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/6/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/16/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/17/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/26/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/58/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/390/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/4/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/14/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/31/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/33/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/362/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/373/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/682/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/1/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/9/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/48/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/113/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/202/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/28/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/3/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/15/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/53/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/111/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/395/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/716/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/739/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/20/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/37/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/717/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/42/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/47/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf File opened for reading /proc/684/comm a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0.elf