Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
25047s -
max time network
151s -
platform
linux_amd64 -
resource
ubuntu1804-amd64-en-20211208 -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
24/09/2022, 14:21
Behavioral task
behavioral1
Sample
skidv2.x86_64-20220924-1421.elf
Resource
ubuntu1804-amd64-en-20211208
3 signatures
150 seconds
General
-
Target
skidv2.x86_64-20220924-1421.elf
-
Size
66KB
-
MD5
fc6d0f18c2b86e9b787b1a856c2e4d5f
-
SHA1
bb574e43a9784e5eff1771b4745094338feeb8ed
-
SHA256
685a6fbeb5fb12719e1efb48f2c5fc6a4f86a4b6950fa1bf214140b409b36422
-
SHA512
ef508290b3e7bbd0de5fce8f4b714308bdb2a3d28fa75d6fdd9038c8ee21a5b25db18d682e3596e34d0e6d546ab1fb863cca357651a06f17ee93af9b6ab53298
-
SSDEEP
1536:pUluhdikJUVWMxMa0cFdy3cwpwVp5bqlG3I9lau6YLYbqFUm/VLt:iuhdiaUMSMa0Kact5WlG3Iz6YLYDm/Vh
Score
7/10
Malware Config
Signatures
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc /proc/net/tcp /proc/net/tcp -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc /proc/net/tcp /proc/net/tcp -
Reads runtime system information 24 IoCs
Reads data from /proc virtual filesystem.
description ioc Process /proc/565/fd /proc/565/fd Process not Found /proc/filesystems /proc/filesystems mkdir /proc/261/fd /proc/261/fd Process not Found /proc/352/fd /proc/352/fd Process not Found /proc/358/fd /proc/358/fd Process not Found /proc/383/fd /proc/383/fd Process not Found /proc/389/fd /proc/389/fd Process not Found /proc/ /proc/ Process not Found /proc/333/fd /proc/333/fd Process not Found /proc/422/fd /proc/422/fd Process not Found /proc/424/fd /proc/424/fd Process not Found /proc/460/fd /proc/460/fd Process not Found /proc/600/fd /proc/600/fd Process not Found /proc/filesystems /proc/filesystems mv /proc/331/fd /proc/331/fd Process not Found /proc/355/fd /proc/355/fd Process not Found /proc/599/fd /proc/599/fd Process not Found /proc/382/fd /proc/382/fd Process not Found /proc/1/fd /proc/1/fd Process not Found /proc/250/fd /proc/250/fd Process not Found /proc/262/fd /proc/262/fd Process not Found /proc/350/fd /proc/350/fd Process not Found /proc/357/fd /proc/357/fd Process not Found /proc/366/fd /proc/366/fd Process not Found
Processes
-
/tmp/skidv2.x86_64-20220924-1421.elf/tmp/skidv2.x86_64-20220924-1421.elf1⤵PID:593
-
/bin/shsh -c "rm -rf bin/busybox && mkdir bin; >bin/busybox && mv /tmp/skidv2.x86_64-20220924-1421.elf bin/busybox; chmod 777 bin/busybox"1⤵PID:594
-
/bin/rmrm -rf bin/busybox2⤵PID:595
-
-
/bin/mkdirmkdir bin2⤵
- Reads runtime system information
PID:596
-
-
/bin/mvmv /tmp/skidv2.x86_64-20220924-1421.elf bin/busybox2⤵
- Reads runtime system information
PID:597
-
-
/bin/chmodchmod 777 bin/busybox2⤵PID:598
-