Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1s -
max time network
153s -
platform
linux_mips -
resource
debian9-mipsbe-en-20211208 -
resource tags
arch:mipsimage:debian9-mipsbe-en-20211208kernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
02/06/2023, 02:42
Static task
static1
Behavioral task
behavioral1
Sample
3ddb393c458586338cb6e96c50df64879ff07b44a252b2a6b60d6109fc00a40d.elf
Resource
debian9-mipsbe-en-20211208
1 signatures
150 seconds
General
-
Target
3ddb393c458586338cb6e96c50df64879ff07b44a252b2a6b60d6109fc00a40d.elf
-
Size
59KB
-
MD5
e9f15015de679ed7d7b2e6c4c34a2345
-
SHA1
9ad4464aa9b2558f32cfbf5500fe89d3f332ba2b
-
SHA256
3ddb393c458586338cb6e96c50df64879ff07b44a252b2a6b60d6109fc00a40d
-
SHA512
004e11c87aab10ab4da59a5ee8ef088023c4b776ba5185a9562fd02e6b55886e87fc6b05fa0c95dcca442d3073d923242262c37427170695da550d21620d20d3
-
SSDEEP
1536:lq5RThRNhRhR/RuhRF25t0KQ0oaeHkncHnK:0txQ0ouncq
Score
3/10
Malware Config
Signatures
-
Reads runtime system information 3 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/326/exe Process not Found File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mv
Processes
-
/tmp/3ddb393c458586338cb6e96c50df64879ff07b44a252b2a6b60d6109fc00a40d.elf/tmp/3ddb393c458586338cb6e96c50df64879ff07b44a252b2a6b60d6109fc00a40d.elf1⤵PID:324
-
/bin/shsh -c "mkdir /m5nykeim5t/ && >/m5nykeim5t/m5nykeim5t && cd /m5nykeim5t/ >/dev/null"1⤵PID:327
-
/bin/mkdirmkdir /m5nykeim5t/2⤵
- Reads runtime system information
PID:328
-
-
/bin/shsh -c "mv /tmp/3ddb393c458586338cb6e96c50df64879ff07b44a252b2a6b60d6109fc00a40d.elf /m5nykeim5t/m5nykeim5t && chmod 777 /m5nykeim5t/m5nykeim5t >/dev/null"1⤵PID:330
-
/bin/mvmv /tmp/3ddb393c458586338cb6e96c50df64879ff07b44a252b2a6b60d6109fc00a40d.elf /m5nykeim5t/m5nykeim5t2⤵
- Reads runtime system information
PID:333
-
-
/bin/chmodchmod 777 /m5nykeim5t/m5nykeim5t2⤵PID:334
-