Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
158s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
24/03/2025, 04:01
Behavioral task
behavioral1
Sample
297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
6 signatures
150 seconds
General
-
Target
297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf
-
Size
57KB
-
MD5
606118045fee881480d6a73e8aae9050
-
SHA1
e4ad3d8ef8f6544d06cc843be692e98fe68f7586
-
SHA256
297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d
-
SHA512
ed68171461e0d24b39cd6ebbe19406bfa9010b6ee288c73fe322a547308ea41800500d0b3850e9a9ceabc90925e3708555e71ddbf96a9b670f80313c7009d390
-
SSDEEP
1536:ePS4tG8FL/+wTpnv2UilmIPL1ERbiEVuXgX:ePltG8dfBv2yYL1ERH5X
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
MIRAI
Signatures
-
Mirai family
-
Deletes itself 1 IoCs
pid Process 648 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for modification /dev/misc/watchdog 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself p728dfavjfju4w6827cj4j15ldbccf1t 648 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf -
description ioc Process File opened for reading /proc/1111�3cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/222/stat 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/6666�4cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/7777G6cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/77774cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/66cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/5555/stat 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/7777�5cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/6666�4cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/6666�4cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/7777�5cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/77776cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/66662cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/6666�3cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/66665cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/7777�5cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/7777�5cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/7777_6cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/99/stat 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/6666t4cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/66665cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/7777�5cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/7777)6cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/6666>8cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/1111�"cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/6666J4cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/6666�4cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/7777�5cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/7777;6cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/6666�7cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/6666�4cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/2222+cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/5555�/cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/6666�8cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/44/stat 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/6666U4cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/6666�6cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/self/exe 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/33cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/6666�3cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/6666�4cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/7777.5cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/7777-6cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/5555 /cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/66667cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/6666�4cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/7777�5cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/66669cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/2222*cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/7777a6cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/6666 9cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/1111�3cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/6666�4cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/7777�5cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/7777/stat 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/6666;7cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/222cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/444s�"cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/2222�)cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/3333cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/7777�5cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/6666�8cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/6666�9cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf File opened for reading /proc/5555 3cmdline 297399048d5f4b335008cc03664cf20426dbe14543f9eb049f4f59ade2d0f61d.elf