Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
149s -
platform
linux_amd64 -
resource
ubuntu1804-amd64-en-20211208 -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
23/08/2023, 10:50
Static task
static1
Behavioral task
behavioral1
Sample
cundi.x86.elf
Resource
ubuntu1804-amd64-en-20211208
ubuntu-18.04-amd64
3 signatures
150 seconds
General
-
Target
cundi.x86.elf
-
Size
78KB
-
MD5
6951a73ae432cd64dfff7ce52fa6e8ae
-
SHA1
58dfe1232b76f54444aecade7d70a2164ff36f2d
-
SHA256
31c8b46354df03310f0cafef45fbb2f8fb741a10f98c9aebcd52321b729b5623
-
SHA512
2814b5a3b8bd62124142c6152e9d4032124643c449cd49f756fcb375dcff78a973e5b9fbc4bb0c9af76823f875d507a731e8145fe9676e7c92e2d49be78a3ba0
-
SSDEEP
1536:ui0zO1nGPoKB5KAnkUhlpdtqNEloSjot0rkCeya:f0zknQoKHSUHLt6k1js
Score
7/10
Malware Config
Signatures
-
Changes its process name 1 IoCs
description pid Process Changes the process name, possibly in an attempt to hide itself 597 cundi.x86.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/667/cmdline File opened for reading /proc/14/cmdline File opened for reading /proc/34/cmdline File opened for reading /proc/81/cmdline File opened for reading /proc/389/cmdline File opened for reading /proc/634/cmdline File opened for reading /proc/665/cmdline File opened for reading /proc/3/cmdline File opened for reading /proc/22/cmdline File opened for reading /proc/85/cmdline File opened for reading /proc/595/cmdline File opened for reading /proc/672/cmdline File opened for reading /proc/682/cmdline File opened for reading /proc/722/cmdline File opened for reading /proc/29/cmdline File opened for reading /proc/126/cmdline File opened for reading /proc/168/cmdline File opened for reading /proc/250/cmdline File opened for reading /proc/593/cmdline File opened for reading /proc/616/cmdline File opened for reading /proc/8/cmdline File opened for reading /proc/32/cmdline File opened for reading /proc/382/cmdline File opened for reading /proc/610/cmdline File opened for reading /proc/651/cmdline File opened for reading /proc/694/cmdline File opened for reading /proc/167/cmdline File opened for reading /proc/175/cmdline File opened for reading /proc/180/cmdline File opened for reading /proc/565/cmdline File opened for reading /proc/618/cmdline File opened for reading /proc/643/cmdline File opened for reading /proc/711/cmdline File opened for reading /proc/5/cmdline File opened for reading /proc/350/cmdline File opened for reading /proc/697/cmdline File opened for reading /proc/717/cmdline File opened for reading /proc/18/cmdline File opened for reading /proc/261/cmdline File opened for reading /proc/331/cmdline File opened for reading /proc/642/cmdline File opened for reading /proc/645/cmdline File opened for reading /proc/660/cmdline File opened for reading /proc/80/cmdline File opened for reading /proc/615/cmdline File opened for reading /proc/637/cmdline File opened for reading /proc/641/cmdline File opened for reading /proc/700/cmdline File opened for reading /proc/26/cmdline File opened for reading /proc/35/cmdline File opened for reading /proc/358/cmdline File opened for reading /proc/367/cmdline File opened for reading /proc/676/cmdline File opened for reading /proc/695/cmdline File opened for reading /proc/704/cmdline File opened for reading /proc/6/cmdline File opened for reading /proc/16/cmdline File opened for reading /proc/83/cmdline File opened for reading /proc/424/cmdline File opened for reading /proc/636/cmdline File opened for reading /proc/656/cmdline File opened for reading /proc/712/cmdline File opened for reading /proc/19/cmdline File opened for reading /proc/98/cmdline