Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
102s -
platform
linux_amd64 -
resource
ubuntu1804-amd64-en-20211208 -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
05/02/2023, 07:01
Static task
static1
Behavioral task
behavioral1
Sample
e603944aceb5c0885a8627de12f36b159bbf2f05
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral2
Sample
e603944aceb5c0885a8627de12f36b159bbf2f05
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral3
Sample
e603944aceb5c0885a8627de12f36b159bbf2f05
Resource
debian9-mipsbe-20221111-en
Behavioral task
behavioral4
Sample
e603944aceb5c0885a8627de12f36b159bbf2f05
Resource
debian9-mipsel-en-20211208
General
-
Target
e603944aceb5c0885a8627de12f36b159bbf2f05
-
Size
3KB
-
MD5
d0d36f169f1458806053aae482af5010
-
SHA1
e603944aceb5c0885a8627de12f36b159bbf2f05
-
SHA256
10c3b6b03a9bf105d264a8e7f30dcab0a6c59a414529b0af0a6bd9f1d2984459
-
SHA512
982abe39731d8cc852c25650740ff73975c10d19027eccf610401260e2f508334f1de656f8dd332fa698dccc9f7d3bda610c8b9e84d276036a6e9408d826229a
Malware Config
Signatures
-
Writes file to system bin folder 1 TTPs 1 IoCs
description ioc Process /bin/auto-backup.sh /bin/auto-backup.sh sh -
Reads CPU attributes 1 TTPs 2 IoCs
description ioc Process /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process /proc/358/stat /proc/358/stat ps /proc/366/status /proc/366/status ps /proc/78/stat /proc/78/stat ps /proc/166/status /proc/166/status ps /proc/83/stat /proc/83/stat ps /proc/167/status /proc/167/status ps /proc/32/stat /proc/32/stat ps /proc/352/stat /proc/352/stat ps /proc/31/stat /proc/31/stat ps /proc/13/status /proc/13/status ps /proc/32/status /proc/32/status ps /proc/165/stat /proc/165/stat ps /proc/422/stat /proc/422/stat ps /proc/565/status /proc/565/status ps /proc/409/stat /proc/409/stat ps /proc/1/status /proc/1/status ps /proc/9/stat /proc/9/stat ps /proc/81/status /proc/81/status ps /proc/170/stat /proc/170/stat ps /proc/meminfo /proc/meminfo ps /proc/30/stat /proc/30/stat ps /proc/sys/kernel/pid_max /proc/sys/kernel/pid_max ps /proc/22/status /proc/22/status ps /proc/22/status /proc/22/status ps /proc/83/status /proc/83/status ps /proc/164/status /proc/164/status ps /proc/178/stat /proc/178/stat ps /proc/2/stat /proc/2/stat ps /proc/203/stat /proc/203/stat ps /proc/27/stat /proc/27/stat ps /proc/78/status /proc/78/status ps /proc/26/stat /proc/26/stat ps /proc/262/stat /proc/262/stat ps /proc/1/status /proc/1/status ps /proc/172/status /proc/172/status ps /proc/250/status /proc/250/status ps /proc/8/stat /proc/8/stat ps /proc/78/stat /proc/78/stat ps /proc/126/status /proc/126/status ps /proc/176/status /proc/176/status ps /proc/389/stat /proc/389/stat ps /proc/15/status /proc/15/status ps /proc/21/stat /proc/21/stat ps /proc/89/status /proc/89/status ps /proc/165/stat /proc/165/stat ps /proc/174/stat /proc/174/stat ps /proc/250/status /proc/250/status ps /proc/3/status /proc/3/status ps /proc/36/status /proc/36/status ps /proc/14/stat /proc/14/stat ps /proc/355/status /proc/355/status ps /proc/355/stat /proc/355/stat ps /proc/591/status /proc/591/status ps /proc/126/stat /proc/126/stat ps /proc/176/stat /proc/176/stat ps /proc/355/stat /proc/355/stat ps /proc/20/status /proc/20/status ps /proc/168/stat /proc/168/stat ps /proc/172/status /proc/172/status ps /proc/565/stat /proc/565/stat ps /proc/603/stat /proc/603/stat ps /proc/164/stat /proc/164/stat ps /proc/166/status /proc/166/status ps /proc/84/status /proc/84/status ps -
Writes file to tmp directory 8 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process /tmp/public.pem /tmp/public.pem rm /tmp/archieve.zip /tmp/archieve.zip rm /tmp/e603944aceb5c0885a8627de12f36b159bbf2f05 /tmp/e603944aceb5c0885a8627de12f36b159bbf2f05 rm /tmp/e603944aceb5c0885a8627de12f36b159bbf2f05 /tmp/e603944aceb5c0885a8627de12f36b159bbf2f05 e603944aceb5c0885a8627de12f36b159bbf2f05 /tmp/encrypt /tmp/encrypt rm /tmp/nohup.out /tmp/nohup.out rm /tmp/index.html /tmp/index.html rm /tmp/motd /tmp/motd rm
Processes
-
/tmp/e603944aceb5c0885a8627de12f36b159bbf2f05/tmp/e603944aceb5c0885a8627de12f36b159bbf2f051⤵
- Writes file to tmp directory
PID:593 -
/bin/chmodchmod +x /tmp//encrypt2⤵PID:604
-
-
/usr/bin/findfind /usr/lib/vmware -type f -name index.html2⤵PID:609
-
-
/bin/mvmv /etc/motd /etc/motd12⤵PID:610
-
-
/bin/find/bin/find / -name "*.log" -exec /bin/rm -rf "{}" ";"2⤵PID:611
-
-
/bin/rm/bin/rm -f /store/packages/vmtools.py2⤵PID:621
-
-
/bin/touch/bin/touch -r /etc/vmware/rhttpproxy/config.xml /etc/vmware/rhttpproxy/endpoints.conf2⤵PID:622
-
-
/bin/touch/bin/touch -r /etc/vmware/rhttpproxy/config.xml /bin/hostd-probe.sh2⤵PID:623
-
-
/bin/touch/bin/touch -r /etc/vmware/rhttpproxy/config.xml /etc/rc.local.d/local.sh2⤵PID:624
-
-
/bin/rm/bin/rm -f /tmp/encrypt /tmp/nohup.out /tmp/index.html /tmp/motd /tmp/public.pem /tmp/archieve.zip2⤵
- Writes file to tmp directory
PID:625
-
-
/bin/sh/bin/sh /bin/auto-backup.sh2⤵
- Writes file to system bin folder
PID:626
-
-
/bin/rm/bin/rm -- /tmp/e603944aceb5c0885a8627de12f36b159bbf2f052⤵
- Writes file to tmp directory
PID:627
-
-
/etc/init.d/SSH/etc/init.d/SSH start2⤵PID:628
-
-
/bin/grepgrep "Config File"1⤵PID:598
-
/usr/bin/awkawk "{print \$3}"1⤵PID:599
-
/bin/grepgrep vmx1⤵PID:602
-
/bin/psps1⤵
- Reads CPU attributes
- Reads runtime system information
PID:601
-
/usr/bin/awkawk "{print \$2}"1⤵PID:603
-
/bin/grepgrep /vmfs/volumes/1⤵PID:607
-
/usr/bin/awkawk "-F " "{print \$2}"1⤵PID:608
-
/bin/ps/bin/ps1⤵
- Reads CPU attributes
- Reads runtime system information
PID:613
-
/bin/grep/bin/grep encrypt1⤵PID:614
-
/bin/grep/bin/grep -v grep1⤵PID:615
-
/bin/wc/bin/wc -l1⤵PID:616
-
/bin/vmware/bin/vmware -l1⤵PID:618
-
/bin/grep/bin/grep " 7."1⤵PID:619
-
/bin/wc/bin/wc -l1⤵PID:620