Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
103s -
max time network
103s -
platform
linux_amd64 -
resource
ubuntu1804-amd64-en-20211208 -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
11/10/2023, 23:04
Static task
static1
Behavioral task
behavioral1
Sample
timer.sh
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral2
Sample
timer.sh
Resource
debian9-armhf-20230831-en
Behavioral task
behavioral3
Sample
timer.sh
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral4
Sample
timer.sh
Resource
debian9-mipsel-20230831-en
General
-
Target
timer.sh
-
Size
1KB
-
MD5
4c59290399e5f4051d24999fa1dc64f2
-
SHA1
2f90e1631643e4dcb342f6181d1488459bfff0a0
-
SHA256
d9d004e55744800cf40a6a448fa3ca1f6fd691786b6bbf79c583f90cc22b6139
-
SHA512
56aeb169e1c7ead2becfc35938e7c6a04fe44a00bb0a1aa0312ed220ec800807e21a0f02dcc1283a2d21234a36d26e7fe85231ae664b6f043d7530e7d7e31e45
Malware Config
Signatures
-
Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/filesystems find
Processes
-
/tmp/timer.sh/tmp/timer.sh1⤵PID:597
-
/bin/rmrm -rf "/root/Documents/*"2⤵PID:598
-
-
/bin/rmrm -rf "/root/Desktop/*"2⤵PID:599
-
-
/bin/rmrm -rf "/root/Downloads/*"2⤵PID:600
-
-
/usr/bin/findfind . -type f2⤵
- Reads runtime system information
PID:601
-
-
/usr/bin/basenamebasename ./timer.sh2⤵PID:602
-
-
/usr/bin/clearclear2⤵PID:603
-
-
/bin/sleepsleep 12⤵PID:604
-
-
/usr/bin/clearclear2⤵PID:610
-
-
/bin/sleepsleep 12⤵PID:611
-
-
/usr/bin/clearclear2⤵PID:612
-
-
/bin/sleepsleep 12⤵PID:613
-
-
/usr/bin/clearclear2⤵PID:614
-
-
/bin/sleepsleep 12⤵PID:615
-
-
/usr/bin/clearclear2⤵PID:616
-
-
/bin/sleepsleep 12⤵PID:617
-
-
/usr/bin/clearclear2⤵PID:618
-
-
/bin/sleepsleep 12⤵PID:619
-
-
/usr/bin/clearclear2⤵PID:620
-
-
/bin/sleepsleep 12⤵PID:621
-
-
/usr/bin/clearclear2⤵PID:622
-
-
/bin/sleepsleep 12⤵PID:623
-
-
/usr/bin/clearclear2⤵PID:624
-
-
/bin/sleepsleep 12⤵PID:625
-
-
/usr/bin/clearclear2⤵PID:626
-
-
/bin/sleepsleep 12⤵PID:627
-
-
/usr/bin/clearclear2⤵PID:628
-
-
/bin/sleepsleep 12⤵PID:629
-
-
/usr/bin/clearclear2⤵PID:630
-
-
/bin/sleepsleep 12⤵PID:631
-
-
/usr/bin/clearclear2⤵PID:632
-
-
/bin/sleepsleep 12⤵PID:633
-
-
/usr/bin/clearclear2⤵PID:634
-
-
/bin/sleepsleep 12⤵PID:635
-
-
/usr/bin/clearclear2⤵PID:636
-
-
/bin/sleepsleep 12⤵PID:637
-
-
/usr/bin/clearclear2⤵PID:638
-
-
/bin/sleepsleep 12⤵PID:639
-
-
/usr/bin/clearclear2⤵PID:640
-
-
/bin/sleepsleep 12⤵PID:641
-
-
/usr/bin/clearclear2⤵PID:642
-
-
/bin/sleepsleep 12⤵PID:643
-
-
/usr/bin/clearclear2⤵PID:644
-
-
/bin/sleepsleep 12⤵PID:645
-
-
/usr/bin/clearclear2⤵PID:646
-
-
/bin/sleepsleep 12⤵PID:647
-
-
/usr/bin/clearclear2⤵PID:648
-
-
/bin/sleepsleep 12⤵PID:649
-
-
/usr/bin/clearclear2⤵PID:650
-
-
/bin/sleepsleep 12⤵PID:651
-
-
/usr/bin/clearclear2⤵PID:652
-
-
/bin/sleepsleep 12⤵PID:653
-
-
/usr/bin/clearclear2⤵PID:654
-
-
/bin/sleepsleep 12⤵PID:655
-
-
/usr/bin/clearclear2⤵PID:658
-
-
/bin/sleepsleep 12⤵PID:659
-
-
/usr/bin/clearclear2⤵PID:660
-
-
/bin/sleepsleep 12⤵PID:661
-
-
/usr/bin/clearclear2⤵PID:662
-
-
/bin/sleepsleep 12⤵PID:663
-
-
/usr/bin/clearclear2⤵PID:664
-
-
/bin/sleepsleep 12⤵PID:665
-
-
/usr/bin/clearclear2⤵PID:666
-
-
/bin/sleepsleep 12⤵PID:667
-
-
/usr/bin/clearclear2⤵PID:668
-
-
/bin/sleepsleep 12⤵PID:669
-
-
/usr/bin/clearclear2⤵PID:670
-
-
/bin/sleepsleep 12⤵PID:671
-
-
/usr/bin/clearclear2⤵PID:672
-
-
/bin/sleepsleep 12⤵PID:673
-
-
/usr/bin/clearclear2⤵PID:674
-
-
/bin/sleepsleep 12⤵PID:675
-
-
/usr/bin/clearclear2⤵PID:676
-
-
/bin/sleepsleep 12⤵PID:677
-
-
/usr/bin/clearclear2⤵PID:678
-
-
/bin/sleepsleep 12⤵PID:679
-
-
/usr/bin/clearclear2⤵PID:680
-
-
/bin/sleepsleep 12⤵PID:681
-
-
/usr/bin/clearclear2⤵PID:682
-
-
/bin/sleepsleep 12⤵PID:683
-
-
/usr/bin/clearclear2⤵PID:684
-
-
/bin/sleepsleep 12⤵PID:685
-
-
/usr/bin/clearclear2⤵PID:686
-
-
/bin/sleepsleep 12⤵PID:687
-
-
/usr/bin/clearclear2⤵PID:688
-
-
/bin/sleepsleep 12⤵PID:689
-
-
/usr/bin/clearclear2⤵PID:690
-
-
/bin/sleepsleep 12⤵PID:691
-
-
/usr/bin/clearclear2⤵PID:692
-
-
/bin/sleepsleep 12⤵PID:693
-
-
/usr/bin/clearclear2⤵PID:694
-
-
/bin/sleepsleep 12⤵PID:695
-
-
/usr/bin/clearclear2⤵PID:696
-
-
/bin/sleepsleep 12⤵PID:697
-
-
/usr/bin/clearclear2⤵PID:698
-
-
/bin/sleepsleep 12⤵PID:699
-
-
/usr/bin/clearclear2⤵PID:700
-
-
/bin/sleepsleep 12⤵PID:701
-
-
/usr/bin/clearclear2⤵PID:702
-
-
/bin/sleepsleep 12⤵PID:703
-
-
/usr/bin/clearclear2⤵PID:704
-
-
/bin/sleepsleep 12⤵PID:705
-
-
/usr/bin/clearclear2⤵PID:706
-
-
/bin/sleepsleep 12⤵PID:707
-
-
/usr/bin/clearclear2⤵PID:708
-
-
/bin/sleepsleep 12⤵PID:709
-
-
/usr/bin/clearclear2⤵PID:710
-
-
/bin/sleepsleep 12⤵PID:711
-
-
/usr/bin/clearclear2⤵PID:712
-
-
/bin/sleepsleep 12⤵PID:713
-
-
/usr/bin/clearclear2⤵PID:714
-
-
/bin/sleepsleep 12⤵PID:715
-
-
/usr/bin/clearclear2⤵PID:716
-
-
/bin/sleepsleep 12⤵PID:717
-
-
/usr/bin/clearclear2⤵PID:718
-
-
/bin/sleepsleep 12⤵PID:719
-
-
/usr/bin/clearclear2⤵PID:720
-
-
/bin/sleepsleep 12⤵PID:721
-
-
/usr/bin/clearclear2⤵PID:722
-
-
/bin/sleepsleep 12⤵PID:723
-
-
/usr/bin/clearclear2⤵PID:724
-
-
/bin/sleepsleep 12⤵PID:725
-
-
/usr/bin/clearclear2⤵PID:726
-
-
/bin/sleepsleep 12⤵PID:727
-
-
/usr/bin/clearclear2⤵PID:728
-
-
/bin/sleepsleep 12⤵PID:729
-
-
/usr/bin/clearclear2⤵PID:730
-
-
/bin/sleepsleep 12⤵PID:731
-
-
/usr/bin/clearclear2⤵PID:732
-
-
/bin/sleepsleep 12⤵PID:733
-
-
/usr/bin/clearclear2⤵PID:734
-
-
/bin/sleepsleep 12⤵PID:735
-
-
/usr/bin/clearclear2⤵PID:736
-
-
/bin/sleepsleep 12⤵PID:737
-
-
/usr/bin/clearclear2⤵PID:738
-
-
/bin/sleepsleep 12⤵PID:739
-
-
/usr/bin/clearclear2⤵PID:740
-
-
/bin/sleepsleep 12⤵PID:741
-
-
/usr/bin/clearclear2⤵PID:742
-
-
/bin/sleepsleep 12⤵PID:743
-
-
/usr/bin/clearclear2⤵PID:744
-
-
/bin/sleepsleep 12⤵PID:745
-
-
/usr/bin/clearclear2⤵PID:746
-
-
/bin/sleepsleep 12⤵PID:747
-
-
/usr/bin/clearclear2⤵PID:748
-
-
/bin/sleepsleep 12⤵PID:749
-
-
/usr/bin/clearclear2⤵PID:750
-
-
/bin/sleepsleep 12⤵PID:751
-
-
/usr/bin/clearclear2⤵PID:752
-
-
/bin/sleepsleep 12⤵PID:753
-
-
/usr/bin/clearclear2⤵PID:754
-
-
/bin/sleepsleep 12⤵PID:755
-
-
/usr/bin/clearclear2⤵PID:756
-
-
/bin/sleepsleep 12⤵PID:757
-
-
/usr/bin/clearclear2⤵PID:758
-
-
/bin/sleepsleep 12⤵PID:759
-
-
/usr/bin/clearclear2⤵PID:760
-
-
/bin/sleepsleep 12⤵PID:761
-
-
/usr/bin/clearclear2⤵PID:762
-
-
/bin/sleepsleep 12⤵PID:763
-
-
/usr/bin/clearclear2⤵PID:764
-
-
/bin/sleepsleep 12⤵PID:765
-
-
/usr/bin/clearclear2⤵PID:766
-
-
/bin/sleepsleep 12⤵PID:767
-
-
/usr/bin/clearclear2⤵PID:768
-
-
/bin/sleepsleep 12⤵PID:769
-
-
/usr/bin/clearclear2⤵PID:770
-
-
/bin/sleepsleep 12⤵PID:771
-
-
/usr/bin/clearclear2⤵PID:772
-
-
/bin/sleepsleep 12⤵PID:773
-
-
/usr/bin/clearclear2⤵PID:774
-
-
/bin/sleepsleep 12⤵PID:775
-
-
/usr/bin/clearclear2⤵PID:776
-
-
/bin/sleepsleep 12⤵PID:777
-
-
/usr/bin/clearclear2⤵PID:778
-
-
/bin/sleepsleep 12⤵PID:779
-
-
/usr/bin/clearclear2⤵PID:780
-
-
/bin/sleepsleep 12⤵PID:781
-
-
/usr/bin/clearclear2⤵PID:782
-
-
/bin/sleepsleep 12⤵PID:783
-
-
/usr/bin/clearclear2⤵PID:784
-
-
/bin/sleepsleep 12⤵PID:785
-
-
/usr/bin/clearclear2⤵PID:786
-
-
/bin/sleepsleep 12⤵PID:787
-
-
/usr/bin/clearclear2⤵PID:788
-
-
/bin/sleepsleep 12⤵PID:789
-
-
/usr/bin/clearclear2⤵PID:790
-
-
/bin/sleepsleep 12⤵PID:791
-
-
/usr/bin/clearclear2⤵PID:792
-
-
/bin/sleepsleep 12⤵PID:793
-
-
/usr/bin/clearclear2⤵PID:794
-
-
/bin/sleepsleep 12⤵PID:795
-
-
/usr/bin/clearclear2⤵PID:796
-