Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
155s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
23/03/2025, 21:28
Behavioral task
behavioral1
Sample
parm6.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
6 signatures
150 seconds
General
-
Target
parm6.elf
-
Size
57KB
-
MD5
606118045fee881480d6a73e8aae9050
-
SHA1
e4ad3d8ef8f6544d06cc843be692e98fe68f7586
-
SHA256
297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d
-
SHA512
ed68171461e0d24b39cd6ebbe19406bfa9010b6ee288c73fe322a547308ea41800500d0b3850e9a9ceabc90925e3708555e71ddbf96a9b670f80313c7009d390
-
SSDEEP
1536:ePS4tG8FL/+wTpnv2UilmIPL1ERbiEVuXgX:ePltG8dfBv2yYL1ERH5X
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
MIRAI
Signatures
-
Mirai family
-
Deletes itself 1 IoCs
pid Process 648 parm6.elf -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog parm6.elf File opened for modification /dev/misc/watchdog parm6.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself eq31hh5a2a58kh058latjwfu 648 parm6.elf -
description ioc Process File opened for reading /proc/44cmdline parm6.elf File opened for reading /proc/222s�"cmdline parm6.elf File opened for reading /proc/6666�5cmdline parm6.elf File opened for reading /proc/7777�6cmdline parm6.elf File opened for reading /proc/6666V5cmdline parm6.elf File opened for reading /proc/6666}5cmdline parm6.elf File opened for reading /proc/66668cmdline parm6.elf File opened for reading /proc/6666�8cmdline parm6.elf File opened for reading /proc/111m�"cmdline parm6.elf File opened for reading /proc/5555�0cmdline parm6.elf File opened for reading /proc/7777�6cmdline parm6.elf File opened for reading /proc/7777 7cmdline parm6.elf File opened for reading /proc/6666/stat parm6.elf File opened for reading /proc/66665cmdline parm6.elf File opened for reading /proc/7777/exe parm6.elf File opened for reading /proc/222cmdline parm6.elf File opened for reading /proc/1111x-cmdline parm6.elf File opened for reading /proc/1111A$cmdline parm6.elf File opened for reading /proc/88/stat parm6.elf File opened for reading /proc/77774cmdline parm6.elf File opened for reading /proc/6666�8cmdline parm6.elf File opened for reading /proc/22cmdline parm6.elf File opened for reading /proc/111c�"cmdline parm6.elf File opened for reading /proc/55cmdline parm6.elf File opened for reading /proc/6666�4cmdline parm6.elf File opened for reading /proc/7777�7cmdline parm6.elf File opened for reading /proc/66665cmdline parm6.elf File opened for reading /proc/6666�5cmdline parm6.elf File opened for reading /proc/7777C7cmdline parm6.elf File opened for reading /proc/777/stat parm6.elf File opened for reading /proc/77772cmdline parm6.elf File opened for reading /proc/66661cmdline parm6.elf File opened for reading /proc/1111y-cmdline parm6.elf File opened for reading /proc/66664cmdline parm6.elf File opened for reading /proc/7777�6cmdline parm6.elf File opened for reading /proc/7777g7cmdline parm6.elf File opened for reading /proc/7777�7cmdline parm6.elf File opened for reading /proc/6666�7cmdline parm6.elf File opened for reading /proc/6666C8cmdline parm6.elf File opened for reading /proc/6666I6cmdline parm6.elf File opened for reading /proc/6666:cmdline parm6.elf File opened for reading /proc/7777}7cmdline parm6.elf File opened for reading /proc/55551cmdline parm6.elf File opened for reading /proc/33/stat parm6.elf File opened for reading /proc/44/stat parm6.elf File opened for reading /proc/6666�5cmdline parm6.elf File opened for reading /proc/6666;cmdline parm6.elf File opened for reading /proc/66662cmdline parm6.elf File opened for reading /proc/6666=8cmdline parm6.elf File opened for reading /proc/99/stat parm6.elf File opened for reading /proc/222/stat parm6.elf File opened for reading /proc/999/stat parm6.elf File opened for reading /proc/7777 7cmdline parm6.elf File opened for reading /proc/7777)7cmdline parm6.elf File opened for reading /proc/6666�5cmdline parm6.elf File opened for reading /proc/66666cmdline parm6.elf File opened for reading /proc/1111�"cmdline parm6.elf File opened for reading /proc/33cmdline parm6.elf File opened for reading /proc/6666b5cmdline parm6.elf File opened for reading /proc/6666c5cmdline parm6.elf File opened for reading /proc/7777�6cmdline parm6.elf File opened for reading /proc/3333|-cmdline parm6.elf File opened for reading /proc/6666|5cmdline parm6.elf File opened for reading /proc/7777�7cmdline parm6.elf