Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
23/03/2025, 21:28
Behavioral task
behavioral1
Sample
parm7.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
6 signatures
150 seconds
General
-
Target
parm7.elf
-
Size
57KB
-
MD5
54df6b48d75c9577b17343f47d909729
-
SHA1
02ede141fc2e93e0aeb2c885517cfade324acc55
-
SHA256
6ac918962c801644c0a8773801657cdee81180ae46a417f7171ac196e9a84856
-
SHA512
89aaa5a55a46e093a49f55fd52054830d8353e210b9e29855a57de4c1bec6c3f3d0aeb3959c181324656cb3d71b3d894a4805c80aaf575b65900a9dff284f9fd
-
SSDEEP
768:e9SZLq7S4tG8w+LrjGEsJwTptVGqB7oOzAjlmI79U9q3UELiNwj8/5XDWBYVt6uD:ePS4tG8FL/+wTpnv2UilmIPLCYYH9rX
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
MIRAI
Signatures
-
Mirai family
-
Deletes itself 1 IoCs
pid Process 660 parm7.elf -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog parm7.elf File opened for modification /dev/misc/watchdog parm7.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself n8t5q58trhg6w1cl 660 parm7.elf -
description ioc Process File opened for reading /proc/2222P*cmdline parm7.elf File opened for reading /proc/666654cmdline parm7.elf File opened for reading /proc/1111P*cmdline parm7.elf File opened for reading /proc/7777R5cmdline parm7.elf File opened for reading /proc/7777�5cmdline parm7.elf File opened for reading /proc/7777N6cmdline parm7.elf File opened for reading /proc/7777�6cmdline parm7.elf File opened for reading /proc/88ll�"cmdline parm7.elf File opened for reading /proc/222s�"cmdline parm7.elf File opened for reading /proc/6666�4cmdline parm7.elf File opened for reading /proc/7777\6cmdline parm7.elf File opened for reading /proc/6666�5cmdline parm7.elf File opened for reading /proc/7777O7cmdline parm7.elf File opened for reading /proc/7777l7cmdline parm7.elf File opened for reading /proc/7777u8cmdline parm7.elf File opened for reading /proc/99cmdline parm7.elf File opened for reading /proc/111�"cmdline parm7.elf File opened for reading /proc/6666:4cmdline parm7.elf File opened for reading /proc/6666�4cmdline parm7.elf File opened for reading /proc/6666�4cmdline parm7.elf File opened for reading /proc/6666�4cmdline parm7.elf File opened for reading /proc/7777E7cmdline parm7.elf File opened for reading /proc/7777h7cmdline parm7.elf File opened for reading /proc/111�"cmdline parm7.elf File opened for reading /proc/222�"cmdline parm7.elf File opened for reading /proc/222v�"cmdline parm7.elf File opened for reading /proc/666634cmdline parm7.elf File opened for reading /proc/6666�4cmdline parm7.elf File opened for reading /proc/666605cmdline parm7.elf File opened for reading /proc/999s�"cmdline parm7.elf File opened for reading /proc/11cmdline parm7.elf File opened for reading /proc/44cmdline parm7.elf File opened for reading /proc/3333-4cmdline parm7.elf File opened for reading /proc/6666�4cmdline parm7.elf File opened for reading /proc/6666�4cmdline parm7.elf File opened for reading /proc/77775cmdline parm7.elf File opened for reading /proc/7777Z6cmdline parm7.elf File opened for reading /proc/7777C9cmdline parm7.elf File opened for reading /proc/33cmdline parm7.elf File opened for reading /proc/66cmdline parm7.elf File opened for reading /proc/1111*4cmdline parm7.elf File opened for reading /proc/6666�4cmdline parm7.elf File opened for reading /proc/7777�6cmdline parm7.elf File opened for reading /proc/7777�9cmdline parm7.elf File opened for reading /proc/6666�4cmdline parm7.elf File opened for reading /proc/7777>6cmdline parm7.elf File opened for reading /proc/7777�7cmdline parm7.elf File opened for reading /proc/1111�"cmdline parm7.elf File opened for reading /proc/7777\5cmdline parm7.elf File opened for reading /proc/7777�5cmdline parm7.elf File opened for reading /proc/77777cmdline parm7.elf File opened for reading /proc/77779cmdline parm7.elf File opened for reading /proc/111c�"cmdline parm7.elf File opened for reading /proc/4444cmdline parm7.elf File opened for reading /proc/66665cmdline parm7.elf File opened for reading /proc/6666"5cmdline parm7.elf File opened for reading /proc/77777cmdline parm7.elf File opened for reading /proc/88cmdline parm7.elf File opened for reading /proc/22cmdline parm7.elf File opened for reading /proc/6666q4cmdline parm7.elf File opened for reading /proc/7777D5cmdline parm7.elf File opened for reading /proc/777746cmdline parm7.elf File opened for reading /proc/222s�"cmdline parm7.elf File opened for reading /proc/7777v5cmdline parm7.elf