Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20230831-en -
resource tags
arch:mipselimage:debian9-mipsel-20230831-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
11/10/2023, 23:04
Static task
static1
Behavioral task
behavioral1
Sample
timer.sh
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral2
Sample
timer.sh
Resource
debian9-armhf-20230831-en
Behavioral task
behavioral3
Sample
timer.sh
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral4
Sample
timer.sh
Resource
debian9-mipsel-20230831-en
General
-
Target
timer.sh
-
Size
1KB
-
MD5
4c59290399e5f4051d24999fa1dc64f2
-
SHA1
2f90e1631643e4dcb342f6181d1488459bfff0a0
-
SHA256
d9d004e55744800cf40a6a448fa3ca1f6fd691786b6bbf79c583f90cc22b6139
-
SHA512
56aeb169e1c7ead2becfc35938e7c6a04fe44a00bb0a1aa0312ed220ec800807e21a0f02dcc1283a2d21234a36d26e7fe85231ae664b6f043d7530e7d7e31e45
Malware Config
Signatures
-
Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/filesystems find
Processes
-
/tmp/timer.sh/tmp/timer.sh1⤵PID:346
-
/bin/rmrm -rf "/root/Documents/*"2⤵PID:347
-
-
/bin/rmrm -rf "/root/Desktop/*"2⤵PID:348
-
-
/bin/rmrm -rf "/root/Downloads/*"2⤵PID:350
-
-
/usr/bin/findfind . -type f2⤵
- Reads runtime system information
PID:353
-
-
/usr/bin/basenamebasename ./timer.sh2⤵PID:354
-
-
/usr/bin/clearclear2⤵PID:355
-
-
/bin/sleepsleep 12⤵PID:356
-
-
/usr/bin/clearclear2⤵PID:357
-
-
/bin/sleepsleep 12⤵PID:358
-
-
/usr/bin/clearclear2⤵PID:359
-
-
/bin/sleepsleep 12⤵PID:360
-
-
/usr/bin/clearclear2⤵PID:361
-
-
/bin/sleepsleep 12⤵PID:362
-
-
/usr/bin/clearclear2⤵PID:363
-
-
/bin/sleepsleep 12⤵PID:364
-
-
/usr/bin/clearclear2⤵PID:365
-
-
/bin/sleepsleep 12⤵PID:366
-
-
/usr/bin/clearclear2⤵PID:367
-
-
/bin/sleepsleep 12⤵PID:368
-
-
/usr/bin/clearclear2⤵PID:369
-
-
/bin/sleepsleep 12⤵PID:370
-
-
/usr/bin/clearclear2⤵PID:371
-
-
/bin/sleepsleep 12⤵PID:372
-
-
/usr/bin/clearclear2⤵PID:373
-
-
/bin/sleepsleep 12⤵PID:374
-
-
/usr/bin/clearclear2⤵PID:375
-
-
/bin/sleepsleep 12⤵PID:376
-
-
/usr/bin/clearclear2⤵PID:377
-
-
/bin/sleepsleep 12⤵PID:378
-
-
/usr/bin/clearclear2⤵PID:379
-
-
/bin/sleepsleep 12⤵PID:380
-
-
/usr/bin/clearclear2⤵PID:381
-
-
/bin/sleepsleep 12⤵PID:382
-
-
/usr/bin/clearclear2⤵PID:383
-
-
/bin/sleepsleep 12⤵PID:384
-
-
/usr/bin/clearclear2⤵PID:385
-
-
/bin/sleepsleep 12⤵PID:386
-
-
/usr/bin/clearclear2⤵PID:387
-
-
/bin/sleepsleep 12⤵PID:388
-
-
/usr/bin/clearclear2⤵PID:389
-
-
/bin/sleepsleep 12⤵PID:393
-
-
/usr/bin/clearclear2⤵PID:394
-
-
/bin/sleepsleep 12⤵PID:395
-
-
/usr/bin/clearclear2⤵PID:396
-
-
/bin/sleepsleep 12⤵PID:397
-
-
/usr/bin/clearclear2⤵PID:398
-
-
/bin/sleepsleep 12⤵PID:399
-
-
/usr/bin/clearclear2⤵PID:400
-
-
/bin/sleepsleep 12⤵PID:401
-
-
/usr/bin/clearclear2⤵PID:402
-
-
/bin/sleepsleep 12⤵PID:403
-
-
/usr/bin/clearclear2⤵PID:404
-
-
/bin/sleepsleep 12⤵PID:405
-
-
/usr/bin/clearclear2⤵PID:406
-
-
/bin/sleepsleep 12⤵PID:407
-
-
/usr/bin/clearclear2⤵PID:408
-
-
/bin/sleepsleep 12⤵PID:409
-
-
/usr/bin/clearclear2⤵PID:410
-
-
/bin/sleepsleep 12⤵PID:411
-
-
/usr/bin/clearclear2⤵PID:412
-
-
/bin/sleepsleep 12⤵PID:413
-
-
/usr/bin/clearclear2⤵PID:414
-
-
/bin/sleepsleep 12⤵PID:415
-
-
/usr/bin/clearclear2⤵PID:416
-
-
/bin/sleepsleep 12⤵PID:417
-
-
/usr/bin/clearclear2⤵PID:418
-
-
/bin/sleepsleep 12⤵PID:419
-
-
/usr/bin/clearclear2⤵PID:420
-
-
/bin/sleepsleep 12⤵PID:421
-
-
/usr/bin/clearclear2⤵PID:422
-
-
/bin/sleepsleep 12⤵PID:423
-
-
/usr/bin/clearclear2⤵PID:424
-
-
/bin/sleepsleep 12⤵PID:425
-
-
/usr/bin/clearclear2⤵PID:426
-
-
/bin/sleepsleep 12⤵PID:427
-
-
/usr/bin/clearclear2⤵PID:428
-
-
/bin/sleepsleep 12⤵PID:429
-
-
/usr/bin/clearclear2⤵PID:430
-
-
/bin/sleepsleep 12⤵PID:431
-
-
/usr/bin/clearclear2⤵PID:432
-
-
/bin/sleepsleep 12⤵PID:433
-
-
/usr/bin/clearclear2⤵PID:434
-
-
/bin/sleepsleep 12⤵PID:435
-
-
/usr/bin/clearclear2⤵PID:436
-
-
/bin/sleepsleep 12⤵PID:437
-
-
/usr/bin/clearclear2⤵PID:438
-
-
/bin/sleepsleep 12⤵PID:439
-
-
/usr/bin/clearclear2⤵PID:440
-
-
/bin/sleepsleep 12⤵PID:441
-
-
/usr/bin/clearclear2⤵PID:442
-
-
/bin/sleepsleep 12⤵PID:443
-
-
/usr/bin/clearclear2⤵PID:444
-
-
/bin/sleepsleep 12⤵PID:445
-
-
/usr/bin/clearclear2⤵PID:446
-
-
/bin/sleepsleep 12⤵PID:447
-
-
/usr/bin/clearclear2⤵PID:448
-
-
/bin/sleepsleep 12⤵PID:449
-
-
/usr/bin/clearclear2⤵PID:450
-
-
/bin/sleepsleep 12⤵PID:451
-
-
/usr/bin/clearclear2⤵PID:452
-
-
/bin/sleepsleep 12⤵PID:453
-
-
/usr/bin/clearclear2⤵PID:454
-
-
/bin/sleepsleep 12⤵PID:455
-
-
/usr/bin/clearclear2⤵PID:456
-
-
/bin/sleepsleep 12⤵PID:457
-
-
/usr/bin/clearclear2⤵PID:458
-
-
/bin/sleepsleep 12⤵PID:459
-
-
/usr/bin/clearclear2⤵PID:460
-
-
/bin/sleepsleep 12⤵PID:461
-
-
/usr/bin/clearclear2⤵PID:462
-
-
/bin/sleepsleep 12⤵PID:463
-
-
/usr/bin/clearclear2⤵PID:464
-
-
/bin/sleepsleep 12⤵PID:465
-
-
/usr/bin/clearclear2⤵PID:466
-
-
/bin/sleepsleep 12⤵PID:467
-
-
/usr/bin/clearclear2⤵PID:468
-
-
/bin/sleepsleep 12⤵PID:469
-
-
/usr/bin/clearclear2⤵PID:470
-
-
/bin/sleepsleep 12⤵PID:471
-
-
/usr/bin/clearclear2⤵PID:472
-
-
/bin/sleepsleep 12⤵PID:473
-
-
/usr/bin/clearclear2⤵PID:474
-
-
/bin/sleepsleep 12⤵PID:475
-
-
/usr/bin/clearclear2⤵PID:476
-
-
/bin/sleepsleep 12⤵PID:477
-
-
/usr/bin/clearclear2⤵PID:478
-
-
/bin/sleepsleep 12⤵PID:479
-
-
/usr/bin/clearclear2⤵PID:480
-
-
/bin/sleepsleep 12⤵PID:481
-
-
/usr/bin/clearclear2⤵PID:482
-
-
/bin/sleepsleep 12⤵PID:483
-
-
/usr/bin/clearclear2⤵PID:484
-
-
/bin/sleepsleep 12⤵PID:485
-
-
/usr/bin/clearclear2⤵PID:486
-
-
/bin/sleepsleep 12⤵PID:487
-
-
/usr/bin/clearclear2⤵PID:488
-
-
/bin/sleepsleep 12⤵PID:489
-
-
/usr/bin/clearclear2⤵PID:490
-
-
/bin/sleepsleep 12⤵PID:491
-
-
/usr/bin/clearclear2⤵PID:492
-
-
/bin/sleepsleep 12⤵PID:493
-
-
/usr/bin/clearclear2⤵PID:498
-
-
/bin/sleepsleep 12⤵PID:507
-
-
/usr/bin/clearclear2⤵PID:521
-
-
/bin/sleepsleep 12⤵PID:523
-
-
/usr/bin/clearclear2⤵PID:524
-
-
/bin/sleepsleep 12⤵PID:525
-
-
/usr/bin/clearclear2⤵PID:526
-
-
/bin/sleepsleep 12⤵PID:527
-
-
/usr/bin/clearclear2⤵PID:528
-
-
/bin/sleepsleep 12⤵PID:529
-
-
/usr/bin/clearclear2⤵PID:532
-
-
/bin/sleepsleep 12⤵PID:536
-
-
/usr/bin/clearclear2⤵PID:546
-
-
/bin/sleepsleep 12⤵PID:551
-
-
/usr/bin/clearclear2⤵PID:560
-
-
/bin/sleepsleep 12⤵PID:564
-
-
/usr/bin/clearclear2⤵PID:576
-
-
/bin/sleepsleep 12⤵PID:581
-
-
/usr/bin/clearclear2⤵PID:583
-
-
/bin/sleepsleep 12⤵PID:584
-
-
/usr/bin/clearclear2⤵PID:585
-
-
/bin/sleepsleep 12⤵PID:586
-
-
/usr/bin/clearclear2⤵PID:587
-
-
/bin/sleepsleep 12⤵PID:588
-
-
/usr/bin/clearclear2⤵PID:595
-
-
/bin/sleepsleep 12⤵PID:600
-
-
/usr/bin/clearclear2⤵PID:608
-
-
/bin/sleepsleep 12⤵PID:613
-
-
/usr/bin/clearclear2⤵PID:622
-
-
/bin/sleepsleep 12⤵PID:624
-
-
/usr/bin/clearclear2⤵PID:625
-