Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
11/03/2025, 04:50
Behavioral task
behavioral1
Sample
b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
11 signatures
150 seconds
General
-
Target
b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
-
Size
36KB
-
MD5
60dcb6b17e4c2bfe8538c546e0891790
-
SHA1
fa479fa7ca6381d2ffeea8ae216c0fc599069850
-
SHA256
b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35
-
SHA512
c3c8381f3ebf9a281b706d144219fb392df46756f9f40f0526fed0ff0c9e9e67e5073f43a14b1139991313d615cde048ef0288c63a5cfc6e44a19249eaf9603a
-
SSDEEP
768:6tpf5yjepoCyNjwxBbPct5sUIlP4XEA7bNPMfA9tbU6IL4C:2f5yC+NUxB7ct5kPQEmMI9tJ/
Score
9/10
Malware Config
Signatures
-
Contacts a large (14593) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for modification /dev/misc/watchdog b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf -
Renames itself 1 IoCs
pid Process 674 b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 152.53.15.127 -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads process memory 1 TTPs 64 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/782/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/784/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/706/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/714/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/716/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/724/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/726/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/785/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/790/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/791/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/700/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/713/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/730/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/742/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/754/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/764/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/781/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/803/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/710/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/718/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/725/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/747/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/768/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/787/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/793/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/794/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/704/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/733/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/737/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/745/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/748/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/751/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/755/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/760/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/697/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/709/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/771/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/795/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/808/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/811/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/705/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/734/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/767/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/780/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/805/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/806/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/715/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/723/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/740/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/763/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/770/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/772/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/774/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/797/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/722/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/708/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/694/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/699/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/717/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/736/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/786/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/809/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/701/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/702/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself atd 674 b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf -
description ioc Process File opened for reading /proc/781/cmdline b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/98/comm b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/150/comm b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/280/comm b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/488/status b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/793/cmdline b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/7/comm b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/26/comm b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/488/comm b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/722/cmdline b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/742/cmdline b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/780/cmdline b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/805/cmdline b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/145/comm b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/703/cmdline b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/705/cmdline b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/755/cmdline b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/791/cmdline b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/27/comm b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/28/comm b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/9/comm b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/self/maps b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/730/cmdline b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/733/cmdline b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/751/cmdline b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/15/comm b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/29/comm b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/629/comm b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/167/status b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/441/status b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/712/cmdline b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/799/cmdline b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/14/comm b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/281/comm b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/719/cmdline b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/721/cmdline b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/11/comm b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/41/comm b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/667/comm b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/717/cmdline b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/744/cmdline b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/758/cmdline b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/767/cmdline b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/785/cmdline b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/4/comm b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/12/comm b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/108/comm b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/326/status b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/660/status b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/727/cmdline b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/772/cmdline b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/797/cmdline b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/109/comm b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/702/cmdline b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/714/cmdline b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/734/cmdline b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/737/cmdline b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/43/comm b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/669/comm b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/698/cmdline b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/716/cmdline b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/724/cmdline b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/746/cmdline b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf File opened for reading /proc/765/cmdline b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
Processes
-
/tmp/b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf/tmp/b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf1⤵
- Modifies Watchdog functionality
- Renames itself
- Enumerates active TCP sockets
- Reads process memory
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:674