Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
126s -
platform
debian-9_armhf -
resource
debian9-armhf-20230831-en -
resource tags
arch:armhfimage:debian9-armhf-20230831-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
11/10/2023, 23:04
Static task
static1
Behavioral task
behavioral1
Sample
timer.sh
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral2
Sample
timer.sh
Resource
debian9-armhf-20230831-en
Behavioral task
behavioral3
Sample
timer.sh
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral4
Sample
timer.sh
Resource
debian9-mipsel-20230831-en
General
-
Target
timer.sh
-
Size
1KB
-
MD5
4c59290399e5f4051d24999fa1dc64f2
-
SHA1
2f90e1631643e4dcb342f6181d1488459bfff0a0
-
SHA256
d9d004e55744800cf40a6a448fa3ca1f6fd691786b6bbf79c583f90cc22b6139
-
SHA512
56aeb169e1c7ead2becfc35938e7c6a04fe44a00bb0a1aa0312ed220ec800807e21a0f02dcc1283a2d21234a36d26e7fe85231ae664b6f043d7530e7d7e31e45
Malware Config
Signatures
-
Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/filesystems find
Processes
-
/tmp/timer.sh/tmp/timer.sh1⤵PID:367
-
/bin/rmrm -rf "/root/Documents/*"2⤵PID:368
-
-
/bin/rmrm -rf "/root/Desktop/*"2⤵PID:372
-
-
/bin/rmrm -rf "/root/Downloads/*"2⤵PID:373
-
-
/usr/bin/findfind . -type f2⤵
- Reads runtime system information
PID:374
-
-
/usr/bin/basenamebasename ./timer.sh2⤵PID:375
-
-
/usr/bin/clearclear2⤵PID:376
-
-
/bin/sleepsleep 12⤵PID:377
-
-
/usr/bin/clearclear2⤵PID:378
-
-
/bin/sleepsleep 12⤵PID:379
-
-
/usr/bin/clearclear2⤵PID:380
-
-
/bin/sleepsleep 12⤵PID:381
-
-
/usr/bin/clearclear2⤵PID:382
-
-
/bin/sleepsleep 12⤵PID:383
-
-
/usr/bin/clearclear2⤵PID:384
-
-
/bin/sleepsleep 12⤵PID:385
-
-
/usr/bin/clearclear2⤵PID:386
-
-
/bin/sleepsleep 12⤵PID:387
-
-
/usr/bin/clearclear2⤵PID:388
-
-
/bin/sleepsleep 12⤵PID:389
-
-
/usr/bin/clearclear2⤵PID:392
-
-
/bin/sleepsleep 12⤵PID:393
-
-
/usr/bin/clearclear2⤵PID:394
-
-
/bin/sleepsleep 12⤵PID:395
-
-
/usr/bin/clearclear2⤵PID:396
-
-
/bin/sleepsleep 12⤵PID:397
-
-
/usr/bin/clearclear2⤵PID:398
-
-
/bin/sleepsleep 12⤵PID:399
-
-
/usr/bin/clearclear2⤵PID:400
-
-
/bin/sleepsleep 12⤵PID:401
-
-
/usr/bin/clearclear2⤵PID:402
-
-
/bin/sleepsleep 12⤵PID:403
-
-
/usr/bin/clearclear2⤵PID:404
-
-
/bin/sleepsleep 12⤵PID:405
-
-
/usr/bin/clearclear2⤵PID:406
-
-
/bin/sleepsleep 12⤵PID:407
-
-
/usr/bin/clearclear2⤵PID:408
-
-
/bin/sleepsleep 12⤵PID:409
-
-
/usr/bin/clearclear2⤵PID:412
-
-
/bin/sleepsleep 12⤵PID:413
-
-
/usr/bin/clearclear2⤵PID:414
-
-
/bin/sleepsleep 12⤵PID:415
-
-
/usr/bin/clearclear2⤵PID:416
-
-
/bin/sleepsleep 12⤵PID:417
-
-
/usr/bin/clearclear2⤵PID:418
-
-
/bin/sleepsleep 12⤵PID:419
-
-
/usr/bin/clearclear2⤵PID:420
-
-
/bin/sleepsleep 12⤵PID:421
-
-
/usr/bin/clearclear2⤵PID:422
-
-
/bin/sleepsleep 12⤵PID:423
-
-
/usr/bin/clearclear2⤵PID:424
-
-
/bin/sleepsleep 12⤵PID:425
-
-
/usr/bin/clearclear2⤵PID:426
-
-
/bin/sleepsleep 12⤵PID:427
-
-
/usr/bin/clearclear2⤵PID:431
-
-
/bin/sleepsleep 12⤵PID:432
-
-
/usr/bin/clearclear2⤵PID:435
-
-
/bin/sleepsleep 12⤵PID:436
-
-
/usr/bin/clearclear2⤵PID:437
-
-
/bin/sleepsleep 12⤵PID:438
-
-
/usr/bin/clearclear2⤵PID:439
-
-
/bin/sleepsleep 12⤵PID:440
-
-
/usr/bin/clearclear2⤵PID:441
-
-
/bin/sleepsleep 12⤵PID:442
-
-
/usr/bin/clearclear2⤵PID:443
-
-
/bin/sleepsleep 12⤵PID:444
-
-
/usr/bin/clearclear2⤵PID:445
-
-
/bin/sleepsleep 12⤵PID:446
-
-
/usr/bin/clearclear2⤵PID:447
-
-
/bin/sleepsleep 12⤵PID:448
-
-
/usr/bin/clearclear2⤵PID:449
-
-
/bin/sleepsleep 12⤵PID:450
-
-
/usr/bin/clearclear2⤵PID:451
-
-
/bin/sleepsleep 12⤵PID:452
-
-
/usr/bin/clearclear2⤵PID:454
-
-
/bin/sleepsleep 12⤵PID:456
-
-
/usr/bin/clearclear2⤵PID:457
-
-
/bin/sleepsleep 12⤵PID:458
-
-
/usr/bin/clearclear2⤵PID:459
-
-
/bin/sleepsleep 12⤵PID:460
-
-
/usr/bin/clearclear2⤵PID:461
-
-
/bin/sleepsleep 12⤵PID:462
-
-
/usr/bin/clearclear2⤵PID:463
-
-
/bin/sleepsleep 12⤵PID:464
-
-
/usr/bin/clearclear2⤵PID:465
-
-
/bin/sleepsleep 12⤵PID:466
-
-
/usr/bin/clearclear2⤵PID:467
-
-
/bin/sleepsleep 12⤵PID:468
-
-
/usr/bin/clearclear2⤵PID:469
-
-
/bin/sleepsleep 12⤵PID:470
-
-
/usr/bin/clearclear2⤵PID:471
-
-
/bin/sleepsleep 12⤵PID:472
-
-
/usr/bin/clearclear2⤵PID:474
-
-
/bin/sleepsleep 12⤵PID:475
-
-
/usr/bin/clearclear2⤵PID:477
-
-
/bin/sleepsleep 12⤵PID:478
-
-
/usr/bin/clearclear2⤵PID:479
-
-
/bin/sleepsleep 12⤵PID:480
-
-
/usr/bin/clearclear2⤵PID:481
-
-
/bin/sleepsleep 12⤵PID:482
-
-
/usr/bin/clearclear2⤵PID:483
-
-
/bin/sleepsleep 12⤵PID:484
-
-
/usr/bin/clearclear2⤵PID:485
-
-
/bin/sleepsleep 12⤵PID:486
-
-
/usr/bin/clearclear2⤵PID:487
-
-
/bin/sleepsleep 12⤵PID:488
-
-
/usr/bin/clearclear2⤵PID:489
-
-
/bin/sleepsleep 12⤵PID:490
-
-
/usr/bin/clearclear2⤵PID:491
-
-
/bin/sleepsleep 12⤵PID:492
-
-
/usr/bin/clearclear2⤵PID:493
-
-
/bin/sleepsleep 12⤵PID:495
-
-
/usr/bin/clearclear2⤵PID:497
-
-
/bin/sleepsleep 12⤵PID:498
-
-
/usr/bin/clearclear2⤵PID:499
-
-
/bin/sleepsleep 12⤵PID:500
-
-
/usr/bin/clearclear2⤵PID:501
-
-
/bin/sleepsleep 12⤵PID:502
-
-
/usr/bin/clearclear2⤵PID:503
-
-
/bin/sleepsleep 12⤵PID:504
-
-
/usr/bin/clearclear2⤵PID:505
-
-
/bin/sleepsleep 12⤵PID:506
-
-
/usr/bin/clearclear2⤵PID:507
-
-
/bin/sleepsleep 12⤵PID:508
-
-
/usr/bin/clearclear2⤵PID:509
-
-
/bin/sleepsleep 12⤵PID:510
-
-
/usr/bin/clearclear2⤵PID:511
-
-
/bin/sleepsleep 12⤵PID:512
-
-
/usr/bin/clearclear2⤵PID:513
-
-
/bin/sleepsleep 12⤵PID:514
-
-
/usr/bin/clearclear2⤵PID:517
-
-
/bin/sleepsleep 12⤵PID:518
-
-
/usr/bin/clearclear2⤵PID:519
-
-
/bin/sleepsleep 12⤵PID:520
-
-
/usr/bin/clearclear2⤵PID:521
-
-
/bin/sleepsleep 12⤵PID:522
-
-
/usr/bin/clearclear2⤵PID:523
-
-
/bin/sleepsleep 12⤵PID:524
-
-
/usr/bin/clearclear2⤵PID:525
-
-
/bin/sleepsleep 12⤵PID:526
-
-
/usr/bin/clearclear2⤵PID:527
-
-
/bin/sleepsleep 12⤵PID:528
-
-
/usr/bin/clearclear2⤵PID:529
-
-
/bin/sleepsleep 12⤵PID:530
-
-
/usr/bin/clearclear2⤵PID:531
-
-
/bin/sleepsleep 12⤵PID:532
-
-
/usr/bin/clearclear2⤵PID:533
-
-
/bin/sleepsleep 12⤵PID:534
-
-
/usr/bin/clearclear2⤵PID:537
-
-
/bin/sleepsleep 12⤵PID:538
-
-
/usr/bin/clearclear2⤵PID:539
-
-
/bin/sleepsleep 12⤵PID:540
-
-
/usr/bin/clearclear2⤵PID:541
-
-
/bin/sleepsleep 12⤵PID:542
-
-
/usr/bin/clearclear2⤵PID:543
-
-
/bin/sleepsleep 12⤵PID:544
-
-
/usr/bin/clearclear2⤵PID:545
-
-
/bin/sleepsleep 12⤵PID:546
-
-
/usr/bin/clearclear2⤵PID:547
-
-
/bin/sleepsleep 12⤵PID:548
-
-
/usr/bin/clearclear2⤵PID:549
-
-
/bin/sleepsleep 12⤵PID:550
-
-
/usr/bin/clearclear2⤵PID:551
-
-
/bin/sleepsleep 12⤵PID:552
-
-
/usr/bin/clearclear2⤵PID:553
-
-
/bin/sleepsleep 12⤵PID:554
-
-
/usr/bin/clearclear2⤵PID:556
-
-
/bin/sleepsleep 12⤵PID:558
-
-
/usr/bin/clearclear2⤵PID:559
-
-
/bin/sleepsleep 12⤵PID:560
-
-
/usr/bin/clearclear2⤵PID:561
-
-
/bin/sleepsleep 12⤵PID:562
-
-
/usr/bin/clearclear2⤵PID:563
-
-
/bin/sleepsleep 12⤵PID:564
-
-
/usr/bin/clearclear2⤵PID:565
-
-
/bin/sleepsleep 12⤵PID:566
-
-
/usr/bin/clearclear2⤵PID:567
-
-
/bin/sleepsleep 12⤵PID:568
-
-
/usr/bin/clearclear2⤵PID:569
-
-
/bin/sleepsleep 12⤵PID:570
-
-
/usr/bin/clearclear2⤵PID:571
-
-
/bin/sleepsleep 12⤵PID:572
-
-
/usr/bin/clearclear2⤵PID:573
-
-
/bin/sleepsleep 12⤵PID:574
-
-
/usr/bin/clearclear2⤵PID:576
-
-
/bin/sleepsleep 12⤵PID:577
-
-
/usr/bin/clearclear2⤵PID:579
-
-
/bin/sleepsleep 12⤵PID:580
-
-
/usr/bin/clearclear2⤵PID:581
-
-
/bin/sleepsleep 12⤵PID:582
-
-
/usr/bin/clearclear2⤵PID:583
-
-
/bin/sleepsleep 12⤵PID:584
-
-
/usr/bin/clearclear2⤵PID:585
-
-
/bin/sleepsleep 12⤵PID:586
-
-
/usr/bin/clearclear2⤵PID:587
-
-
/bin/sleepsleep 12⤵PID:588
-
-
/usr/bin/clearclear2⤵PID:589
-
-
/bin/sleepsleep 12⤵PID:590
-
-
/usr/bin/clearclear2⤵PID:591
-
-
/bin/sleepsleep 12⤵PID:592
-
-
/usr/bin/clearclear2⤵PID:593
-
-
/bin/sleepsleep 12⤵PID:594
-
-
/usr/bin/clearclear2⤵PID:595
-
-
/bin/sleepsleep 12⤵PID:596
-
-
/usr/bin/clearclear2⤵PID:599
-
-
/bin/sleepsleep 12⤵PID:600
-
-
/usr/bin/clearclear2⤵PID:601
-
-
/bin/sleepsleep 12⤵PID:602
-
-
/usr/bin/clearclear2⤵PID:603
-
-
/bin/sleepsleep 12⤵PID:604
-
-
/usr/bin/clearclear2⤵PID:605
-
-
/bin/sleepsleep 12⤵PID:606
-
-
/usr/bin/clearclear2⤵PID:607
-
-
/bin/sleepsleep 12⤵PID:608
-
-
/usr/bin/clearclear2⤵PID:609
-
-
/bin/sleepsleep 12⤵PID:610
-
-
/usr/bin/clearclear2⤵PID:611
-
-
/bin/sleepsleep 12⤵PID:612
-
-
/usr/bin/clearclear2⤵PID:613
-
-
/bin/sleepsleep 12⤵PID:614
-
-
/usr/bin/clearclear2⤵PID:615
-
-
/bin/sleepsleep 12⤵PID:616
-
-
/usr/bin/clearclear2⤵PID:619
-
-
/bin/sleepsleep 12⤵PID:620
-
-
/usr/bin/clearclear2⤵PID:621
-
-
/bin/sleepsleep 12⤵PID:622
-
-
/usr/bin/clearclear2⤵PID:623
-
-
/bin/sleepsleep 12⤵PID:624
-
-
/usr/bin/clearclear2⤵PID:625
-
-
/bin/sleepsleep 12⤵PID:626
-
-
/usr/bin/clearclear2⤵PID:627
-
-
/bin/sleepsleep 12⤵PID:628
-
-
/usr/bin/clearclear2⤵PID:629
-
-
/bin/sleepsleep 12⤵PID:630
-
-
/usr/bin/clearclear2⤵PID:631
-
-
/bin/sleepsleep 12⤵PID:632
-
-
/usr/bin/clearclear2⤵PID:633
-
-
/bin/sleepsleep 12⤵PID:634
-
-
/usr/bin/clearclear2⤵PID:635
-
-
/bin/sleepsleep 12⤵PID:636
-
-
/usr/bin/clearclear2⤵PID:639
-
-
/bin/sleepsleep 12⤵PID:640
-
-
/usr/bin/clearclear2⤵PID:641
-
-
/bin/sleepsleep 12⤵PID:642
-
-
/usr/bin/clearclear2⤵PID:643
-
-
/bin/sleepsleep 12⤵PID:644
-
-
/usr/bin/clearclear2⤵PID:645
-
-
/bin/sleepsleep 12⤵PID:646
-
-
/usr/bin/clearclear2⤵PID:647
-
-
/bin/sleepsleep 12⤵PID:648
-
-
/usr/bin/clearclear2⤵PID:649
-
-
/bin/sleepsleep 12⤵PID:650
-
-
/usr/bin/clearclear2⤵PID:651
-
-
/bin/sleepsleep 12⤵PID:652
-
-
/usr/bin/clearclear2⤵PID:653
-
-
/bin/sleepsleep 12⤵PID:654
-
-
/usr/bin/clearclear2⤵PID:655
-
-
/bin/sleepsleep 12⤵PID:656
-
-
/usr/bin/clearclear2⤵PID:659
-
-
/bin/sleepsleep 12⤵PID:660
-
-
/usr/bin/clearclear2⤵PID:661
-
-
/bin/sleepsleep 12⤵PID:662
-
-
/usr/bin/clearclear2⤵PID:663
-
-
/bin/sleepsleep 12⤵PID:664
-
-
/usr/bin/clearclear2⤵PID:665
-
-
/bin/sleepsleep 12⤵PID:666
-
-
/usr/bin/clearclear2⤵PID:668
-