Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

djobgbiuie.virus

ubuntu-18.04-amd64

7

Analysis

  • max time kernel
    0s
  • max time network
    125s
  • platform
    linux_amd64
  • resource
    ubuntu1804-amd64-en-20211208
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    29/09/2022, 05:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    djobgbiuie.virus

  • Size

    647KB

  • MD5

    2b083aaf4c29ab9952be58294a5fea6f

  • SHA1

    742cc974582435a39f871a843a1509ee2326dca4

  • SHA256

    ab3c8f59b3b6a17814c71012cfb0cba141fcf1fe7a6fbbeada59023ed5342e67

  • SHA512

    78942fb4e91e9221e4296db70790cca085e2d63c0a10032595b5c72970d34ff9adefe62e056e97e0c63ecfa9aa9bdf7e669a02d81176b1fd7ff280c6663f0862

  • SSDEEP

    12288:RBRO1UmJJ0nHgBL9YfJip2qm+x4h1Tonbp6y07l7mtBDvnD/u9hMHDB:RBRpmJ+HyL9AiAqm+x4h1mb6wvnDWXMN

Score
7/10
persistence

Malware Config

Signatures

  • Creates/modifies Cron job 1 TTPs 2 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence
  • Modifies rc script 1 TTPs 12 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  • Unexpected DNS network traffic destination 38 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Write file to user bin folder 1 TTPs 1 IoCs
  • Reads runtime system information 7 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/djobgbiuie.virus
    /tmp/djobgbiuie.virus
    1⤵
      PID:571
    • /boot/okmjfjzjci
      /boot/okmjfjzjci
      1⤵
        PID:574
      • /bin/chkconfig
        chkconfig --add okmjfjzjci
        1⤵
          PID:577
        • /sbin/chkconfig
          chkconfig --add okmjfjzjci
          1⤵
            PID:577
          • /usr/bin/chkconfig
            chkconfig --add okmjfjzjci
            1⤵
              PID:577
            • /usr/sbin/chkconfig
              chkconfig --add okmjfjzjci
              1⤵
                PID:577
              • /usr/local/bin/chkconfig
                chkconfig --add okmjfjzjci
                1⤵
                  PID:577
                • /usr/local/sbin/chkconfig
                  chkconfig --add okmjfjzjci
                  1⤵
                    PID:577
                  • /usr/X11R6/bin/chkconfig
                    chkconfig --add okmjfjzjci
                    1⤵
                      PID:577
                    • /bin/sh
                      sh -c "sed -i '/\\/etc\\/cron.hourly\\/cron.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/cron.sh' >> /etc/crontab"
                      1⤵
                      • Creates/modifies Cron job
                      PID:580
                      • /bin/sed
                        sed -i "/\\/etc\\/cron.hourly\\/cron.sh/d" /etc/crontab
                        2⤵
                        • Creates/modifies Cron job
                        • Reads runtime system information
                        PID:581
                    • /bin/update-rc.d
                      update-rc.d okmjfjzjci defaults
                      1⤵
                        PID:579
                      • /sbin/update-rc.d
                        update-rc.d okmjfjzjci defaults
                        1⤵
                          PID:579
                        • /usr/bin/update-rc.d
                          update-rc.d okmjfjzjci defaults
                          1⤵
                            PID:579
                          • /usr/sbin/update-rc.d
                            update-rc.d okmjfjzjci defaults
                            1⤵
                            • Modifies rc script
                            • Write file to user bin folder
                            PID:579
                            • /bin/systemctl
                              systemctl daemon-reload
                              2⤵
                              • Reads runtime system information
                              PID:584
                          • /boot/hcombbpcrc
                            /boot/hcombbpcrc "ls -la" 575
                            1⤵
                              PID:586
                            • /boot/xfhspuicqd
                              /boot/xfhspuicqd top 575
                              1⤵
                                PID:608
                              • /boot/pdvtarlvjf
                                /boot/pdvtarlvjf id 575
                                1⤵
                                  PID:611
                                • /boot/pvodliyyus
                                  /boot/pvodliyyus su 575
                                  1⤵
                                    PID:614
                                  • /boot/qavglsixdg
                                    /boot/qavglsixdg "netstat -an" 575
                                    1⤵
                                      PID:617
                                    • /boot/fymnbkeknk
                                      /boot/fymnbkeknk "ps -ef" 575
                                      1⤵
                                        PID:620
                                      • /boot/cueafdhiyu
                                        /boot/cueafdhiyu su 575
                                        1⤵
                                          PID:623
                                        • /boot/sdqygpkjsl
                                          /boot/sdqygpkjsl "netstat -antop" 575
                                          1⤵
                                            PID:626
                                          • /boot/awedlqcnvs
                                            /boot/awedlqcnvs whoami 575
                                            1⤵
                                              PID:629
                                            • /boot/vgjsrfvoom
                                              /boot/vgjsrfvoom whoami 575
                                              1⤵
                                                PID:632
                                              • /boot/zcdxkhmsco
                                                /boot/zcdxkhmsco pwd 575
                                                1⤵
                                                  PID:635
                                                • /boot/wdfhxggmdl
                                                  /boot/wdfhxggmdl ls 575
                                                  1⤵
                                                    PID:638
                                                  • /boot/ojqhagdqgg
                                                    /boot/ojqhagdqgg "netstat -an" 575
                                                    1⤵
                                                      PID:641
                                                    • /boot/bjwvbwcetn
                                                      /boot/bjwvbwcetn "echo \"find\"" 575
                                                      1⤵
                                                        PID:644
                                                      • /boot/geskklsblh
                                                        /boot/geskklsblh "route -n" 575
                                                        1⤵
                                                          PID:662
                                                        • /boot/qjiftbkbbr
                                                          /boot/qjiftbkbbr "ps -ef" 575
                                                          1⤵
                                                            PID:665
                                                          • /boot/dcbfvbwrxi
                                                            /boot/dcbfvbwrxi gnome-terminal 575
                                                            1⤵
                                                              PID:668
                                                            • /boot/xsaxodykaw
                                                              /boot/xsaxodykaw "cd /etc" 575
                                                              1⤵
                                                                PID:671
                                                              • /boot/hhtwspxhot
                                                                /boot/hhtwspxhot bash 575
                                                                1⤵
                                                                  PID:674
                                                                • /boot/ybdkuaxpad
                                                                  /boot/ybdkuaxpad "cd /etc" 575
                                                                  1⤵
                                                                    PID:677
                                                                  • /boot/tobvchhphq
                                                                    /boot/tobvchhphq uptime 575
                                                                    1⤵
                                                                      PID:680
                                                                    • /boot/fiahnhaxoz
                                                                      /boot/fiahnhaxoz "ls -la" 575
                                                                      1⤵
                                                                        PID:683
                                                                      • /boot/dgudhazxzi
                                                                        /boot/dgudhazxzi gnome-terminal 575
                                                                        1⤵
                                                                          PID:686
                                                                        • /boot/iekfniqymo
                                                                          /boot/iekfniqymo top 575
                                                                          1⤵
                                                                            PID:689

                                                                          Network

                                                                          MITRE ATT&CK Enterprise v6

                                                                          Replay Monitor

                                                                          Loading Replay Monitor...

                                                                          Downloads