Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
122s -
platform
linux_mips -
resource
debian9-mipsbe-en-20211208 -
resource tags
arch:mipsimage:debian9-mipsbe-en-20211208kernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
11/10/2023, 23:04
Static task
static1
Behavioral task
behavioral1
Sample
timer.sh
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral2
Sample
timer.sh
Resource
debian9-armhf-20230831-en
Behavioral task
behavioral3
Sample
timer.sh
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral4
Sample
timer.sh
Resource
debian9-mipsel-20230831-en
General
-
Target
timer.sh
-
Size
1KB
-
MD5
4c59290399e5f4051d24999fa1dc64f2
-
SHA1
2f90e1631643e4dcb342f6181d1488459bfff0a0
-
SHA256
d9d004e55744800cf40a6a448fa3ca1f6fd691786b6bbf79c583f90cc22b6139
-
SHA512
56aeb169e1c7ead2becfc35938e7c6a04fe44a00bb0a1aa0312ed220ec800807e21a0f02dcc1283a2d21234a36d26e7fe85231ae664b6f043d7530e7d7e31e45
Malware Config
Signatures
-
Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/filesystems find
Processes
-
/tmp/timer.sh/tmp/timer.sh1⤵PID:325
-
/bin/rmrm -rf "/root/Documents/*"2⤵PID:327
-
-
/bin/rmrm -rf "/root/Desktop/*"2⤵PID:331
-
-
/bin/rmrm -rf "/root/Downloads/*"2⤵PID:332
-
-
/usr/bin/findfind . -type f2⤵
- Reads runtime system information
PID:333
-
-
/usr/bin/basenamebasename ./timer.sh2⤵PID:334
-
-
/usr/bin/clearclear2⤵PID:335
-
-
/bin/sleepsleep 12⤵PID:336
-
-
/usr/bin/clearclear2⤵PID:337
-
-
/bin/sleepsleep 12⤵PID:338
-
-
/usr/bin/clearclear2⤵PID:339
-
-
/bin/sleepsleep 12⤵PID:340
-
-
/usr/bin/clearclear2⤵PID:341
-
-
/bin/sleepsleep 12⤵PID:342
-
-
/usr/bin/clearclear2⤵PID:343
-
-
/bin/sleepsleep 12⤵PID:344
-
-
/usr/bin/clearclear2⤵PID:345
-
-
/bin/sleepsleep 12⤵PID:346
-
-
/usr/bin/clearclear2⤵PID:347
-
-
/bin/sleepsleep 12⤵PID:348
-
-
/usr/bin/clearclear2⤵PID:349
-
-
/bin/sleepsleep 12⤵PID:350
-
-
/usr/bin/clearclear2⤵PID:351
-
-
/bin/sleepsleep 12⤵PID:352
-
-
/usr/bin/clearclear2⤵PID:353
-
-
/bin/sleepsleep 12⤵PID:354
-
-
/usr/bin/clearclear2⤵PID:355
-
-
/bin/sleepsleep 12⤵PID:356
-
-
/usr/bin/clearclear2⤵PID:357
-
-
/bin/sleepsleep 12⤵PID:358
-
-
/usr/bin/clearclear2⤵PID:359
-
-
/bin/sleepsleep 12⤵PID:360
-
-
/usr/bin/clearclear2⤵PID:361
-
-
/bin/sleepsleep 12⤵PID:362
-
-
/usr/bin/clearclear2⤵PID:363
-
-
/bin/sleepsleep 12⤵PID:367
-
-
/usr/bin/clearclear2⤵PID:368
-
-
/bin/sleepsleep 12⤵PID:369
-
-
/usr/bin/clearclear2⤵PID:370
-
-
/bin/sleepsleep 12⤵PID:371
-
-
/usr/bin/clearclear2⤵PID:372
-
-
/bin/sleepsleep 12⤵PID:373
-
-
/usr/bin/clearclear2⤵PID:374
-
-
/bin/sleepsleep 12⤵PID:375
-
-
/usr/bin/clearclear2⤵PID:376
-
-
/bin/sleepsleep 12⤵PID:377
-
-
/usr/bin/clearclear2⤵PID:378
-
-
/bin/sleepsleep 12⤵PID:379
-
-
/usr/bin/clearclear2⤵PID:380
-
-
/bin/sleepsleep 12⤵PID:381
-
-
/usr/bin/clearclear2⤵PID:382
-
-
/bin/sleepsleep 12⤵PID:383
-
-
/usr/bin/clearclear2⤵PID:384
-
-
/bin/sleepsleep 12⤵PID:385
-
-
/usr/bin/clearclear2⤵PID:386
-
-
/bin/sleepsleep 12⤵PID:387
-
-
/usr/bin/clearclear2⤵PID:388
-
-
/bin/sleepsleep 12⤵PID:389
-
-
/usr/bin/clearclear2⤵PID:390
-
-
/bin/sleepsleep 12⤵PID:391
-
-
/usr/bin/clearclear2⤵PID:392
-
-
/bin/sleepsleep 12⤵PID:393
-
-
/usr/bin/clearclear2⤵PID:394
-
-
/bin/sleepsleep 12⤵PID:395
-
-
/usr/bin/clearclear2⤵PID:396
-
-
/bin/sleepsleep 12⤵PID:397
-
-
/usr/bin/clearclear2⤵PID:398
-
-
/bin/sleepsleep 12⤵PID:399
-
-
/usr/bin/clearclear2⤵PID:400
-
-
/bin/sleepsleep 12⤵PID:401
-
-
/usr/bin/clearclear2⤵PID:402
-
-
/bin/sleepsleep 12⤵PID:403
-
-
/usr/bin/clearclear2⤵PID:404
-
-
/bin/sleepsleep 12⤵PID:405
-
-
/usr/bin/clearclear2⤵PID:406
-
-
/bin/sleepsleep 12⤵PID:407
-
-
/usr/bin/clearclear2⤵PID:408
-
-
/bin/sleepsleep 12⤵PID:409
-
-
/usr/bin/clearclear2⤵PID:410
-
-
/bin/sleepsleep 12⤵PID:411
-
-
/usr/bin/clearclear2⤵PID:412
-
-
/bin/sleepsleep 12⤵PID:413
-
-
/usr/bin/clearclear2⤵PID:414
-
-
/bin/sleepsleep 12⤵PID:415
-
-
/usr/bin/clearclear2⤵PID:416
-
-
/bin/sleepsleep 12⤵PID:417
-
-
/usr/bin/clearclear2⤵PID:418
-
-
/bin/sleepsleep 12⤵PID:419
-
-
/usr/bin/clearclear2⤵PID:420
-
-
/bin/sleepsleep 12⤵PID:421
-
-
/usr/bin/clearclear2⤵PID:422
-
-
/bin/sleepsleep 12⤵PID:423
-
-
/usr/bin/clearclear2⤵PID:424
-
-
/bin/sleepsleep 12⤵PID:425
-
-
/usr/bin/clearclear2⤵PID:426
-
-
/bin/sleepsleep 12⤵PID:427
-
-
/usr/bin/clearclear2⤵PID:428
-
-
/bin/sleepsleep 12⤵PID:429
-
-
/usr/bin/clearclear2⤵PID:430
-
-
/bin/sleepsleep 12⤵PID:431
-
-
/usr/bin/clearclear2⤵PID:432
-
-
/bin/sleepsleep 12⤵PID:433
-
-
/usr/bin/clearclear2⤵PID:434
-
-
/bin/sleepsleep 12⤵PID:435
-
-
/usr/bin/clearclear2⤵PID:436
-
-
/bin/sleepsleep 12⤵PID:437
-
-
/usr/bin/clearclear2⤵PID:438
-
-
/bin/sleepsleep 12⤵PID:439
-
-
/usr/bin/clearclear2⤵PID:440
-
-
/bin/sleepsleep 12⤵PID:441
-
-
/usr/bin/clearclear2⤵PID:442
-
-
/bin/sleepsleep 12⤵PID:443
-
-
/usr/bin/clearclear2⤵PID:444
-
-
/bin/sleepsleep 12⤵PID:445
-
-
/usr/bin/clearclear2⤵PID:446
-
-
/bin/sleepsleep 12⤵PID:447
-
-
/usr/bin/clearclear2⤵PID:448
-
-
/bin/sleepsleep 12⤵PID:449
-
-
/usr/bin/clearclear2⤵PID:450
-
-
/bin/sleepsleep 12⤵PID:451
-
-
/usr/bin/clearclear2⤵PID:452
-
-
/bin/sleepsleep 12⤵PID:453
-
-
/usr/bin/clearclear2⤵PID:456
-
-
/bin/sleepsleep 12⤵PID:460
-
-
/usr/bin/clearclear2⤵PID:474
-
-
/bin/sleepsleep 12⤵PID:478
-
-
/usr/bin/clearclear2⤵PID:483
-
-
/bin/sleepsleep 12⤵PID:485
-
-
/usr/bin/clearclear2⤵PID:486
-
-
/bin/sleepsleep 12⤵PID:487
-
-
/usr/bin/clearclear2⤵PID:488
-
-
/bin/sleepsleep 12⤵PID:489
-
-
/usr/bin/clearclear2⤵PID:490
-
-
/bin/sleepsleep 12⤵PID:491
-
-
/usr/bin/clearclear2⤵PID:492
-
-
/bin/sleepsleep 12⤵PID:496
-
-
/usr/bin/clearclear2⤵PID:502
-
-
/bin/sleepsleep 12⤵PID:506
-
-
/usr/bin/clearclear2⤵PID:513
-
-
/bin/sleepsleep 12⤵PID:517
-
-
/usr/bin/clearclear2⤵PID:524
-
-
/bin/sleepsleep 12⤵PID:527
-
-
/usr/bin/clearclear2⤵PID:537
-
-
/bin/sleepsleep 12⤵PID:541
-
-
/usr/bin/clearclear2⤵PID:547
-
-
/bin/sleepsleep 12⤵PID:548
-