Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    meowmips.elf

  • Size

    119KB

  • Sample

    250328-eh47va1ygz

  • MD5

    0c893d7bd9411398fd1f1fb4f625cf0c

  • SHA1

    b1829dbcc5aac316beaa75e85e49c555bc1c6143

  • SHA256

    445620c74ab4d7f8dc3bdee1a98076ca80381616e9067d6f64823c01cc8f3080

  • SHA512

    0be1e236898d7d5fc0c8867b4567367abc104b037da5d6ea1dc2bb432f7a24e7ca877dcb3f123925af86a4d9c0edd3c3a2a91f27c52cda3fb7241fc0645011e9

  • SSDEEP

    3072:73ZDhBdQilzIb5ZmSU8IlZPjlkdYfWppYwn39IZ5nqTE:jZDh3RNIbCNKzBN1A

Malware Config

Targets

    • Target

      meowmips.elf

    • Size

      119KB

    • MD5

      0c893d7bd9411398fd1f1fb4f625cf0c

    • SHA1

      b1829dbcc5aac316beaa75e85e49c555bc1c6143

    • SHA256

      445620c74ab4d7f8dc3bdee1a98076ca80381616e9067d6f64823c01cc8f3080

    • SHA512

      0be1e236898d7d5fc0c8867b4567367abc104b037da5d6ea1dc2bb432f7a24e7ca877dcb3f123925af86a4d9c0edd3c3a2a91f27c52cda3fb7241fc0645011e9

    • SSDEEP

      3072:73ZDhBdQilzIb5ZmSU8IlZPjlkdYfWppYwn39IZ5nqTE:jZDh3RNIbCNKzBN1A

    • Contacts a large (31295) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Renames itself

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Reads process memory

      Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

MITRE ATT&CK Enterprise v15

Tasks