Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
124s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20221111-en -
resource tags
arch:mipselimage:debian9-mipsel-20221111-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
04/02/2023, 19:36
Static task
static1
Behavioral task
behavioral1
Sample
e603944aceb5c0885a8627de12f36b159bbf2f05
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral2
Sample
e603944aceb5c0885a8627de12f36b159bbf2f05
Resource
debian9-armhf-20221111-en
Behavioral task
behavioral3
Sample
e603944aceb5c0885a8627de12f36b159bbf2f05
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral4
Sample
e603944aceb5c0885a8627de12f36b159bbf2f05
Resource
debian9-mipsel-20221111-en
General
-
Target
e603944aceb5c0885a8627de12f36b159bbf2f05
-
Size
3KB
-
MD5
d0d36f169f1458806053aae482af5010
-
SHA1
e603944aceb5c0885a8627de12f36b159bbf2f05
-
SHA256
10c3b6b03a9bf105d264a8e7f30dcab0a6c59a414529b0af0a6bd9f1d2984459
-
SHA512
982abe39731d8cc852c25650740ff73975c10d19027eccf610401260e2f508334f1de656f8dd332fa698dccc9f7d3bda610c8b9e84d276036a6e9408d826229a
Malware Config
Signatures
-
Writes file to system bin folder 1 TTPs 1 IoCs
description ioc Process /bin/auto-backup.sh /bin/auto-backup.sh sh -
Reads CPU attributes 1 TTPs 2 IoCs
description ioc Process /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process /proc/23/stat /proc/23/stat ps /proc/13/stat /proc/13/stat ps /proc/23/status /proc/23/status ps /proc/82/stat /proc/82/stat ps /proc/219/status /proc/219/status ps /proc/9/status /proc/9/status ps /proc/325/status /proc/325/status ps /proc/3/stat /proc/3/stat ps /proc/15/status /proc/15/status ps /proc/36/stat /proc/36/stat ps /proc/325/stat /proc/325/stat ps /proc/16/status /proc/16/status ps /proc/349/stat /proc/349/stat ps /proc/70/stat /proc/70/stat ps /proc/117/stat /proc/117/stat ps /proc/275/status /proc/275/status ps /proc/6/status /proc/6/status ps /proc/247/status /proc/247/status ps /proc/215/stat /proc/215/stat ps /proc/293/stat /proc/293/stat ps /proc/19/status /proc/19/status ps /proc/24/stat /proc/24/stat ps /proc/323/stat /proc/323/stat ps /proc/333/status /proc/333/status ps /proc/23/status /proc/23/status ps /proc/69/status /proc/69/status ps /proc/247/status /proc/247/status ps /proc/286/status /proc/286/status ps /proc/81/stat /proc/81/stat ps /proc/2/status /proc/2/status ps /proc/294/status /proc/294/status ps /proc/13/status /proc/13/status ps /proc/15/stat /proc/15/stat ps /proc/72/status /proc/72/status ps /proc/78/stat /proc/78/stat ps /proc/116/status /proc/116/status ps /proc/8/stat /proc/8/stat ps /proc/24/status /proc/24/status ps /proc/83/status /proc/83/status ps /proc/293/status /proc/293/status ps /proc/83/status /proc/83/status ps /proc/8/status /proc/8/status ps /proc/16/stat /proc/16/stat ps /proc/19/stat /proc/19/stat ps /proc/159/stat /proc/159/stat ps /proc/1/stat /proc/1/stat ps /proc/159/status /proc/159/status ps /proc/252/stat /proc/252/stat ps /proc/286/stat /proc/286/stat ps /proc/252/stat /proc/252/stat ps /proc/sys/kernel/pid_max /proc/sys/kernel/pid_max ps /proc/73/status /proc/73/status ps /proc/336/stat /proc/336/stat ps /proc/350/stat /proc/350/stat ps /proc/75/stat /proc/75/stat ps /proc/meminfo /proc/meminfo ps /proc/4/status /proc/4/status ps /proc/82/stat /proc/82/stat ps /proc/17/stat /proc/17/stat ps /proc/76/stat /proc/76/stat ps /proc/106/stat /proc/106/stat ps /proc/72/stat /proc/72/stat ps /proc/216/status /proc/216/status ps /proc/323/status /proc/323/status ps -
Writes file to tmp directory 8 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process /tmp/public.pem /tmp/public.pem rm /tmp/archieve.zip /tmp/archieve.zip rm /tmp/e603944aceb5c0885a8627de12f36b159bbf2f05 /tmp/e603944aceb5c0885a8627de12f36b159bbf2f05 rm /tmp/e603944aceb5c0885a8627de12f36b159bbf2f05 /tmp/e603944aceb5c0885a8627de12f36b159bbf2f05 e603944aceb5c0885a8627de12f36b159bbf2f05 /tmp/encrypt /tmp/encrypt rm /tmp/nohup.out /tmp/nohup.out rm /tmp/index.html /tmp/index.html rm /tmp/motd /tmp/motd rm
Processes
-
/tmp/e603944aceb5c0885a8627de12f36b159bbf2f05/tmp/e603944aceb5c0885a8627de12f36b159bbf2f051⤵
- Writes file to tmp directory
PID:325 -
/bin/chmodchmod +x /tmp//encrypt2⤵PID:340
-
-
/usr/bin/findfind /usr/lib/vmware -type f -name index.html2⤵PID:345
-
-
/bin/mvmv /etc/motd /etc/motd12⤵PID:346
-
-
/bin/cpcp /tmp//motd /etc/motd2⤵PID:347
-
-
/bin/find/bin/find / -name "*.log" -exec /bin/rm -rf "{}" ";"2⤵PID:348
-
-
/bin/rm/bin/rm -f /store/packages/vmtools.py2⤵PID:358
-
-
/bin/touch/bin/touch -r /etc/vmware/rhttpproxy/config.xml /etc/vmware/rhttpproxy/endpoints.conf2⤵PID:359
-
-
/bin/touch/bin/touch -r /etc/vmware/rhttpproxy/config.xml /bin/hostd-probe.sh2⤵PID:360
-
-
/bin/touch/bin/touch -r /etc/vmware/rhttpproxy/config.xml /etc/rc.local.d/local.sh2⤵PID:361
-
-
/bin/rm/bin/rm -f /tmp/encrypt /tmp/nohup.out /tmp/index.html /tmp/motd /tmp/public.pem /tmp/archieve.zip2⤵
- Writes file to tmp directory
PID:362
-
-
/bin/sh/bin/sh /bin/auto-backup.sh2⤵
- Writes file to system bin folder
PID:363
-
-
/bin/rm/bin/rm -- /tmp/e603944aceb5c0885a8627de12f36b159bbf2f052⤵
- Writes file to tmp directory
PID:364
-
-
/etc/init.d/SSH/etc/init.d/SSH start2⤵PID:365
-
-
/bin/grepgrep "Config File"1⤵PID:330
-
/usr/bin/awkawk "{print \$3}"1⤵PID:331
-
/usr/bin/awkawk "{print \$2}"1⤵PID:335
-
/bin/psps1⤵
- Reads CPU attributes
- Reads runtime system information
PID:333
-
/bin/grepgrep vmx1⤵PID:334
-
/usr/bin/awkawk "-F " "{print \$2}"1⤵PID:344
-
/bin/grepgrep /vmfs/volumes/1⤵PID:343
-
/bin/grep/bin/grep encrypt1⤵PID:351
-
/bin/ps/bin/ps1⤵
- Reads CPU attributes
- Reads runtime system information
PID:350
-
/bin/wc/bin/wc -l1⤵PID:353
-
/bin/grep/bin/grep -v grep1⤵PID:352
-
/bin/vmware/bin/vmware -l1⤵PID:355
-
/bin/wc/bin/wc -l1⤵PID:357
-
/bin/grep/bin/grep " 7."1⤵PID:356