Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

9

Static

static

.rsync/c/go

ubuntu-18.04-amd64

5

.rsync/c/go

debian-9-armhf

5

.rsync/c/go

debian-9-mips

5

.rsync/c/go

debian-9-mipsel

5

.rsync/c/l...c.so.6

ubuntu-18.04-amd64

.rsync/c/l...l.so.2

ubuntu-18.04-amd64

1

.rsync/c/l...s.so.2

ubuntu-18.04-amd64

1

.rsync/c/l...s.so.2

ubuntu-18.04-amd64

1

.rsync/c/l...d.so.0

ubuntu-18.04-amd64

.rsync/c/l....23.so

ubuntu-18.04-amd64

1

.rsync/c/l...v.so.2

ubuntu-18.04-amd64

1

.rsync/c/lib/32/tsm

ubuntu-18.04-amd64

1

.rsync/c/l...c.so.6

ubuntu-18.04-amd64

1

.rsync/c/l...l.so.2

ubuntu-18.04-amd64

1

.rsync/c/l...s.so.2

ubuntu-18.04-amd64

1

.rsync/c/l...s.so.2

ubuntu-18.04-amd64

1

.rsync/c/l...d.so.0

ubuntu-18.04-amd64

1

.rsync/c/l....23.so

ubuntu-18.04-amd64

1

.rsync/c/l...v.so.2

ubuntu-18.04-amd64

1

.rsync/c/lib/64/tsm

ubuntu-18.04-amd64

1

.rsync/c/run

ubuntu-18.04-amd64

9

.rsync/c/run

debian-9-armhf

9

.rsync/c/run

debian-9-mips

9

.rsync/c/run

debian-9-mipsel

9

.rsync/c/slow

ubuntu-18.04-amd64

5

.rsync/c/slow

debian-9-armhf

5

.rsync/c/slow

debian-9-mips

5

.rsync/c/slow

debian-9-mipsel

5

.rsync/c/tsm

ubuntu-18.04-amd64

5

.rsync/c/tsm

debian-9-armhf

5

.rsync/c/tsm

debian-9-mips

5

.rsync/c/tsm

debian-9-mipsel

5

Analysis

  • max time kernel
    0s
  • max time network
    103s
  • platform
    linux_amd64
  • resource
    ubuntu1804-amd64-en-20211208
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    06/01/2023, 07:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    .rsync/c/run

  • Size

    489B

  • MD5

    97a962fb5bd427e09547ecaaf850e034

  • SHA1

    3040ea8bc3226af1fc201c4fefcca17b62184bbe

  • SHA256

    5a1797ae845e8c80c771ece9174b93ad5d5a74e593fe3b508ba105830db5fd92

  • SHA512

    2ed6bad217478913a053fbcad37c904dddacee424ce39115c15019477870582b0d53da908783047cf9069df0a011387b3fba336385ff392ab0be84cd49d04001

Score
9/10
antivm

Malware Config

Signatures

  • Attempts to identify hypervisor via CPU configuration 1 TTPs 1 IoCs

    Checks CPU information for indicators that the system is a virtual machine.

    antivm
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/.rsync/c/run
    /tmp/.rsync/c/run
    1⤵
    • Writes file to tmp directory
    PID:580
    • /bin/uname
      uname -m
      2⤵
        PID:586
      • /bin/sleep
        sleep 15
        2⤵
          PID:587
        • ./stop
          ./stop
          2⤵
            PID:593
          • /bin/sleep
            sleep 3
            2⤵
              PID:594
            • /bin/sleep
              sleep 18
              2⤵
                PID:595
              • /usr/bin/nohup
                nohup ./go
                2⤵
                  PID:596
                • ./go
                  ./go
                  2⤵
                    PID:596
                • /bin/cat
                  cat /proc/cpuinfo
                  1⤵
                  • Attempts to identify hypervisor via CPU configuration
                  PID:582
                • /bin/grep
                  grep model
                  1⤵
                    PID:583
                  • /bin/grep
                    grep name
                    1⤵
                      PID:584
                    • /usr/bin/wc
                      wc -l
                      1⤵
                        PID:585

                      Network

                      MITRE ATT&CK Enterprise v6

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads