Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10shell-bot/22
ubuntu-18.04-amd64
7shell-bot/a.out
ubuntu-18.04-amd64
1shell-bot/cfs
ubuntu-18.04-amd64
7shell-bot/cfs
debian-9-armhf
7shell-bot/cfs
debian-9-mips
7shell-bot/cfs
debian-9-mipsel
1shell-bot/...SE.vbs
windows7-x64
1shell-bot/...SE.vbs
windows10-2004-x64
1shell-bot/...rt.vbs
windows7-x64
1shell-bot/...rt.vbs
windows10-2004-x64
1shell-bot/...es.vbs
windows7-x64
1shell-bot/...es.vbs
windows10-2004-x64
1shell-bot/...Config
ubuntu-18.04-amd64
3shell-bot/...Config
debian-9-armhf
1shell-bot/...Config
debian-9-mips
3shell-bot/...Config
debian-9-mipsel
3shell-bot/...t.so:.
ubuntu-18.04-amd64
1shell-bot/...gen.sh
ubuntu-18.04-amd64
1shell-bot/...gen.sh
debian-9-armhf
1shell-bot/...gen.sh
debian-9-mips
1shell-bot/...gen.sh
debian-9-mipsel
1shell-bot/...ig.vbs
windows7-x64
1shell-bot/...ig.vbs
windows10-2004-x64
1shell-bot/...re.vbs
windows7-x64
1shell-bot/...re.vbs
windows10-2004-x64
1shell-bot/...ngelog
ubuntu-18.04-amd64
3shell-bot/...ngelog
debian-9-armhf
1shell-bot/...ngelog
debian-9-mips
shell-bot/...ngelog
debian-9-mipsel
1shell-bot/...nstall
ubuntu-18.04-amd64
1shell-bot/...nstall
debian-9-armhf
1shell-bot/...nstall
debian-9-mips
1Analysis
-
max time kernel
156s -
max time network
134s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20231026-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20231026-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
14/11/2023, 07:28
Behavioral task
behavioral1
Sample
shell-bot/22
Resource
ubuntu1804-amd64-20231026-en
ubuntu-18.04-amd64
Behavioral task
behavioral2
Sample
shell-bot/a.out
Resource
ubuntu1804-amd64-20231026-en
ubuntu-18.04-amd64
Behavioral task
behavioral3
Sample
shell-bot/cfs
Resource
ubuntu1804-amd64-20231026-en
ubuntu-18.04-amd64
Behavioral task
behavioral4
Sample
shell-bot/cfs
Resource
debian9-armhf-20231026-en
debian-9-armhf
Behavioral task
behavioral5
Sample
shell-bot/cfs
Resource
debian9-mipsbe-20231026-en
debian-9-mips
Behavioral task
behavioral6
Sample
shell-bot/cfs
Resource
debian9-mipsel-20231026-en
debian-9-mipsel
Behavioral task
behavioral7
Sample
shell-bot/ftp-server/Unreal3.2.10.2/.RELEASE.vbs
Resource
win7-20231020-en
windows7-x64
Behavioral task
behavioral8
Sample
shell-bot/ftp-server/Unreal3.2.10.2/.RELEASE.vbs
Resource
win10v2004-20231023-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
shell-bot/ftp-server/Unreal3.2.10.2/.bugreport.vbs
Resource
win7-20231020-en
windows7-x64
Behavioral task
behavioral10
Sample
shell-bot/ftp-server/Unreal3.2.10.2/.bugreport.vbs
Resource
win10v2004-20231023-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
shell-bot/ftp-server/Unreal3.2.10.2/Changes.vbs
Resource
win7-20231025-en
windows7-x64
Behavioral task
behavioral12
Sample
shell-bot/ftp-server/Unreal3.2.10.2/Changes.vbs
Resource
win10v2004-20231020-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
shell-bot/ftp-server/Unreal3.2.10.2/Config
Resource
ubuntu1804-amd64-20231026-en
ubuntu-18.04-amd64
Behavioral task
behavioral14
Sample
shell-bot/ftp-server/Unreal3.2.10.2/Config
Resource
debian9-armhf-20231026-en
debian-9-armhf
Behavioral task
behavioral15
Sample
shell-bot/ftp-server/Unreal3.2.10.2/Config
Resource
debian9-mipsbe-20231026-en
debian-9-mips
Behavioral task
behavioral16
Sample
shell-bot/ftp-server/Unreal3.2.10.2/Config
Resource
debian9-mipsel-20231026-en
debian-9-mipsel
Behavioral task
behavioral17
Sample
shell-bot/ftp-server/Unreal3.2.10.2/GCONV_PATH=./pwnkit.so:.
Resource
ubuntu1804-amd64-20231026-en
ubuntu-18.04-amd64
Behavioral task
behavioral18
Sample
shell-bot/ftp-server/Unreal3.2.10.2/autogen.sh
Resource
ubuntu1804-amd64-20231026-en
ubuntu-18.04-amd64
Behavioral task
behavioral19
Sample
shell-bot/ftp-server/Unreal3.2.10.2/autogen.sh
Resource
debian9-armhf-20231026-en
debian-9-armhf
Behavioral task
behavioral20
Sample
shell-bot/ftp-server/Unreal3.2.10.2/autogen.sh
Resource
debian9-mipsbe-20231026-en
debian-9-mips
Behavioral task
behavioral21
Sample
shell-bot/ftp-server/Unreal3.2.10.2/autogen.sh
Resource
debian9-mipsel-20231026-en
debian-9-mipsel
Behavioral task
behavioral22
Sample
shell-bot/ftp-server/Unreal3.2.10.2/config.vbs
Resource
win7-20231020-en
windows7-x64
Behavioral task
behavioral23
Sample
shell-bot/ftp-server/Unreal3.2.10.2/config.vbs
Resource
win10v2004-20231023-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
shell-bot/ftp-server/Unreal3.2.10.2/configure.vbs
Resource
win7-20231020-en
windows7-x64
Behavioral task
behavioral25
Sample
shell-bot/ftp-server/Unreal3.2.10.2/configure.vbs
Resource
win10v2004-20231020-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
shell-bot/ftp-server/Unreal3.2.10.2/createchangelog
Resource
ubuntu1804-amd64-20231026-en
ubuntu-18.04-amd64
Behavioral task
behavioral27
Sample
shell-bot/ftp-server/Unreal3.2.10.2/createchangelog
Resource
debian9-armhf-20231026-en
debian-9-armhf
Behavioral task
behavioral28
Sample
shell-bot/ftp-server/Unreal3.2.10.2/createchangelog
Resource
debian9-mipsbe-20231026-en
debian-9-mips
Behavioral task
behavioral29
Sample
shell-bot/ftp-server/Unreal3.2.10.2/createchangelog
Resource
debian9-mipsel-20231026-en
debian-9-mipsel
Behavioral task
behavioral30
Sample
shell-bot/ftp-server/Unreal3.2.10.2/curlinstall
Resource
ubuntu1804-amd64-20231026-en
ubuntu-18.04-amd64
Behavioral task
behavioral31
Sample
shell-bot/ftp-server/Unreal3.2.10.2/curlinstall
Resource
debian9-armhf-20231026-en
debian-9-armhf
Behavioral task
behavioral32
Sample
shell-bot/ftp-server/Unreal3.2.10.2/curlinstall
Resource
debian9-mipsbe-20231026-en
debian-9-mips
General
-
Target
shell-bot/cfs
-
Size
61KB
-
MD5
ae06aeeeca8b36a3cc2daca5db6ffd79
-
SHA1
1dd65107062d113b36a99d68c8e4c0c326d705b3
-
SHA256
0f2bf625544e5a5c862e1397776be27a62f2deb4e27dabb2391c2b16de2110f7
-
SHA512
1a9b2e623e82568c7bfcb652acdd51f4093260101a7fb03f46c441dc16482e636dadfc386b7bf3b5031443eaf9a69fa41ac62b774ef528fa1096a510456eb8da
-
SSDEEP
768:ysJEryYUeNMZeZr2H3iFF9J50A8XZqP99pJW3gObz/P:XEr1UeNsc2HEBGBZqNigQ/P
Malware Config
Signatures
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /usr/sbin/cfs 1538 cfs