Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    23s
  • max time network
    9s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20231215-en
  • resource tags

    arch:armhfimage:debian9-armhf-20231215-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    20/12/2023, 05:14

General

  • Target

    ai.sh

  • Size

    831B

  • MD5

    b1a64a7afeda8fc66076eae49bdb6267

  • SHA1

    0d840e800c0dac1d51f8a243056e94ed385c3a98

  • SHA256

    9d5036d204e6598fd4c4ac93688c9acdec3d6a1e4d14018ec16db955f3ee8b24

  • SHA512

    619c55b6f6d222c8a831a441205b75359976d9d80ba01734640d81b96a32e2b263448e16be8d3dad9afb1c78ebcd717cbc8dbefe134fc593f079a931140c67fa

Malware Config

Signatures

  • Detects Kaiten/Tsunami Payload 1 IoCs
  • Detects Kaiten/Tsunami payload 1 IoCs
  • Kaiten/Tsunami

    Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.

  • XMRig Miner payload 4 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Executes dropped EXE 7 IoCs
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads CPU attributes 1 TTPs 2 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/ai.sh
    /tmp/ai.sh
    1⤵
    • Writes file to tmp directory
    PID:658
    • /bin/grep
      grep EST
      2⤵
        PID:671
      • /bin/grep
        grep 94.241.140.177
        2⤵
          PID:672
        • /bin/grep
          grep 80
          2⤵
            PID:673
          • /bin/mkdir
            mkdir -p /var/tmp/.22
            2⤵
              PID:675
            • /bin/tar
              tar -xf xm.jpg
              2⤵
                PID:682
                • /usr/local/sbin/gzip
                  gzip -d
                  3⤵
                    PID:684
                  • /usr/local/bin/gzip
                    gzip -d
                    3⤵
                      PID:684
                    • /usr/sbin/gzip
                      gzip -d
                      3⤵
                        PID:684
                      • /usr/bin/gzip
                        gzip -d
                        3⤵
                          PID:684
                        • /sbin/gzip
                          gzip -d
                          3⤵
                            PID:684
                          • /bin/gzip
                            gzip -d
                            3⤵
                              PID:684
                          • /bin/chmod
                            chmod +x start
                            2⤵
                              PID:687
                            • /var/tmp/.22/start
                              ./start
                              2⤵
                              • Executes dropped EXE
                              PID:688
                              • /bin/uname
                                uname -m
                                3⤵
                                  PID:689
                                • /var/tmp/.22/hide
                                  ./hide
                                  3⤵
                                  • Executes dropped EXE
                                  PID:690
                                • /var/tmp/.22/create
                                  ./create
                                  3⤵
                                  • Executes dropped EXE
                                  PID:692
                                  • /bin/cat
                                    cat auto
                                    4⤵
                                      PID:693
                                    • /usr/bin/crontab
                                      crontab cronjobs
                                      4⤵
                                      • Creates/modifies Cron job
                                      PID:694
                                    • /bin/rm
                                      rm -f cronjobs
                                      4⤵
                                        PID:762
                                      • /usr/bin/crontab
                                        crontab -l
                                        4⤵
                                        • Reads runtime system information
                                        PID:767
                                      • /bin/chmod
                                        chmod u+x auto init.d
                                        4⤵
                                          PID:770
                                        • /bin/sh
                                          sh -c "./auto > /dev/null 2>&1 &"
                                          4⤵
                                            PID:771
                                          • /bin/rm
                                            rm -f aarch64 x86_64 hide.c init.c start create
                                            4⤵
                                              PID:773
                                      • /usr/bin/base64
                                        base64 -d
                                        1⤵
                                          PID:668
                                        • /bin/cat
                                          cat
                                          1⤵
                                            PID:680
                                          • /var/tmp/.22/auto
                                            ./auto
                                            1⤵
                                            • Executes dropped EXE
                                            PID:772
                                            • /var/tmp/.22/init.d
                                              /var/tmp/.22/init.d
                                              2⤵
                                                PID:774
                                                • /var/tmp/.22/init
                                                  ./init
                                                  3⤵
                                                  • Executes dropped EXE
                                                  PID:776
                                              • /bin/chmod
                                                chmod 755 auto hide init init.d logs mining mkcfg xm.jpg
                                                2⤵
                                                  PID:778
                                                • /usr/bin/pkill
                                                  pkill -9 init
                                                  2⤵
                                                  • Reads CPU attributes
                                                  • Reads runtime system information
                                                  PID:780
                                              • /var/tmp/.22/mining
                                                ./mining
                                                1⤵
                                                • Executes dropped EXE
                                                PID:781
                                                • /var/tmp/.22/init
                                                  /var/tmp/.22/init
                                                  2⤵
                                                  • Executes dropped EXE
                                                  PID:783
                                                • /bin/uname
                                                  uname -m
                                                  2⤵
                                                    PID:785
                                                  • /bin/ps
                                                    ps -ef
                                                    2⤵
                                                    • Reads CPU attributes
                                                    • Reads runtime system information
                                                    PID:787
                                                  • /bin/grep
                                                    grep "sendmail: accepting connections"
                                                    2⤵
                                                      PID:788
                                                    • /bin/grep
                                                      grep -v grep
                                                      2⤵
                                                        PID:789
                                                      • /usr/bin/awk
                                                        awk "{print \$2}"
                                                        2⤵
                                                          PID:791
                                                        • /usr/bin/head
                                                          head -1
                                                          2⤵
                                                            PID:792

                                                        Network

                                                        MITRE ATT&CK Enterprise v15

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        • /tmp/sh-thd.HVezhm

                                                          Filesize

                                                          34B

                                                          MD5

                                                          d73b6cacb30d623ccbb82cb8b3489476

                                                          SHA1

                                                          83a9395088a8885f45dfb4de5dc509aa74bb5164

                                                          SHA256

                                                          1a6177c310e4ddd1526252e4fcecfa3c78a440760f4adae90e4b2d60ad3000c5

                                                          SHA512

                                                          94e1949188ff086eec6dbc72dc01967f5c952928399db92656d65dc30f767e188f1a43f9558ffcf0fffaf38a522b335e6509228330780a97f09432c1b50f5941

                                                        • /var/spool/cron/crontabs/tmp.xnt8NK

                                                          Filesize

                                                          266B

                                                          MD5

                                                          2c45f7b3f01e9572c4bd494fffca25aa

                                                          SHA1

                                                          31012c82d6f1633d2a4b75228516d662f35c1625

                                                          SHA256

                                                          46ec04534cf3c81cd39a7a7dae63c5f43f800ec3f679410dd044a30c96a89a2a

                                                          SHA512

                                                          6e59afa38913d924ed7d40dca131e4a5e45a3dc60f6740611995be6ff9879f021bfd4e9d2f878d630d749bd93e441f68d17749e445240f65cbae7b6f402c3f58

                                                        • /var/tmp/.22/aarch64

                                                          Filesize

                                                          4.2MB

                                                          MD5

                                                          7b9dcdf38da77fae4048dd7e131ddd30

                                                          SHA1

                                                          cbcb2f6654a9a143f70c09ca7b47f4da40957581

                                                          SHA256

                                                          9912dcecb64a7f76360ea5a80ca06c0b2ae86783a104c9c9638708003bf825a1

                                                          SHA512

                                                          324825b9339fbf93eba8ecc08cfcb478edbddb6c3e6216304603d1d2e18238780a052b56d722796716add9c8756167c8538ea6d4aaef458d4a887ec0967ee8c9

                                                        • /var/tmp/.22/auto

                                                          Filesize

                                                          13B

                                                          MD5

                                                          814dd64cc10a8383fa795113ba6fc201

                                                          SHA1

                                                          bfd109586b63447862882cacc5e1560cbbc5d759

                                                          SHA256

                                                          2d6b8ac13c7c35eb920dbdb703537e379bd275089a090aa2043bdcd4db6ae319

                                                          SHA512

                                                          22d94b78f5079941c475999bb38a56b7f3253e503a349157f4a8da1afe77385253a9adf2e046bed99e258bce423195bcd9a518fbc1de622aa09dd052284f448e

                                                        • /var/tmp/.22/auto

                                                          Filesize

                                                          237B

                                                          MD5

                                                          31dd8df9646ec4ba759bb9bab05d50d2

                                                          SHA1

                                                          56d64851b676586beaab6b385e270855815e95bd

                                                          SHA256

                                                          5b1574e562a37087c472f214870d022e7ca80de38a601f6b16893cc2a398071f

                                                          SHA512

                                                          ae95c5016b6ccbd94a0700801bd31f113e366a1f54460a1c102f694a52d703fde19242a8bd886a854494b679793344ae123d1cd9086e97254122e8bd51d5ffb0

                                                        • /var/tmp/.22/create

                                                          Filesize

                                                          669B

                                                          MD5

                                                          18d2b80638dc8ed90e86c7caf316fe43

                                                          SHA1

                                                          887f50f37a7e57abd113153becd5d8e36a780b19

                                                          SHA256

                                                          d6a88499031026e3216ac733dd5b6365d597fa91599d33ec10a65cbb72e229b8

                                                          SHA512

                                                          1ab557c50377097f1b4f59bacea66de1b569ea8e341d47155919d2996157f71e078e3a4b474ef005c7320e4eb46199fdda01dcffe5df6973778059466c0f2cec

                                                        • /var/tmp/.22/cronjobs

                                                          Filesize

                                                          44B

                                                          MD5

                                                          98b58e548a19a44729a7d714872f9c40

                                                          SHA1

                                                          e547c6d88e92e35b5ebec931f0437aa1ea5885ac

                                                          SHA256

                                                          0bf4705afed32cc558a79fc696d1a4f9d58fa5e50a6cf4debd7ef0fba4e4016a

                                                          SHA512

                                                          a1892a0e42d614dfda33ba377e59227f9c1fb1f88d1378e45f3620ddfa4150def0b453e26289c9056c5a24f07909ce0d04fe607c1f41d05b087358a6c62f7e28

                                                        • /var/tmp/.22/cronjobs

                                                          Filesize

                                                          84B

                                                          MD5

                                                          376ad2f12d602894f51b5af852cd66fe

                                                          SHA1

                                                          54817f1951a10091d576fe3adbd1ded616227087

                                                          SHA256

                                                          9a90d545850ccd6839475a2409fc65db6a7261e3f4c9c0b9a005bee4539941be

                                                          SHA512

                                                          dee880479e82fc7d4627e1aec389b16fdfa5c64921da048b23ca7ccc6d60271118230eb0487831a5d1509cc291504a897e552a680997db99db78bd181084c019

                                                        • /var/tmp/.22/hide

                                                          Filesize

                                                          17KB

                                                          MD5

                                                          0bb4618c041fdb18c2e115b65bc5401f

                                                          SHA1

                                                          d9d039df279c4cdcceba347630a5fbdd296fca22

                                                          SHA256

                                                          3f1e584ca9393a3f635d8a8573e5b7f863df0dc092911de03bffc2d4ab4f8b53

                                                          SHA512

                                                          7dfc744f8aa5d571db704a56d6f5d5bda4b1889b1829a1cdbcc0272d059dc9fa1d2055e56c47ffb39851f175bbde41a6b137a1175cb7ad06eb64c601302538cf

                                                        • /var/tmp/.22/init

                                                          Filesize

                                                          41KB

                                                          MD5

                                                          3d7964550b662754985bae37e0ee427b

                                                          SHA1

                                                          3de28ccabe03f53cc4f534c96337ece4878d7a0e

                                                          SHA256

                                                          03fab42e0825e6c35b803a125d63191dcf819f48bc9152180379b6c598632075

                                                          SHA512

                                                          75849f318fa46c8415fac9bded6b0bcecc2762cbb3b2c63d0d27794bfaaf8803fff3b67919758a2b7d534f30ea0a4010e828615a09d64f562820e111b00ea7c3

                                                        • /var/tmp/.22/mining

                                                          Filesize

                                                          355B

                                                          MD5

                                                          8674ce902ffedf49ae4be47baabcc2c0

                                                          SHA1

                                                          441ecd5d3a928125e10a0b6b19f7eed31cfd4476

                                                          SHA256

                                                          8f93a7dd12dbd84749cb5cf675cd8371bd732655a8d048f269d8e88e8136e2e3

                                                          SHA512

                                                          8428b05454cc9a6ccc3ddea862d9f38b6f10f542ebf6f784b2f7027a985f1adc9bf7c69d3306b6d4d1896af9ec8e7fe1e1d9291c60652c46d7e5126a2d2e3380

                                                        • /var/tmp/.22/mkcfg

                                                          Filesize

                                                          2KB

                                                          MD5

                                                          b586844bb52809b9dd6c5982347e27e0

                                                          SHA1

                                                          1aa9693db7bd01099d3022c5d697b601a938e205

                                                          SHA256

                                                          a86693407c7ec7a73e1f0e39ae7727f8bdbbc690cbaedeb3817f04cb9f87a57c

                                                          SHA512

                                                          2a3c4031b987178e8b93ced37794d2b2803ffb595b431f05b25793fd4874d8059d9499b8c00ca5abeb7524bba3c4d23a3a5cf2091a811c79224803f7a5f440f0

                                                        • /var/tmp/.22/start

                                                          Filesize

                                                          176B

                                                          MD5

                                                          fe2ac6ae76a359f127213790c460496f

                                                          SHA1

                                                          df036a0088e1f418cb6e618fae06cf6282e79452

                                                          SHA256

                                                          0f1e5ab87d39835c6c28f242e68f7855a57813ef8e3e07091eee4f4d4f7ef78d

                                                          SHA512

                                                          8e41371af2cca37fff463fa1fff44db1cb462c8bf65f93f0ba0779adcfb4c812e411baf00bd67a2e7c92ddb27d65894bb18e205d6ca0e588c81219ba1b272889

                                                        • /var/tmp/.22/x86_64

                                                          Filesize

                                                          4.6MB

                                                          MD5

                                                          1ba3f6f197a8ddd84cf30e29eed01ae9

                                                          SHA1

                                                          e63b06246de680ac8357fb2d2fb467c630b85dd2

                                                          SHA256

                                                          bbcdffd6fa3b1370dfc091bfd3bfca38be013f72f94af7ef29466d911c9604d8

                                                          SHA512

                                                          818f671bbe14e3b863511fc13fd83bf30fdf6c89240431d96b4d85105d99552c16f3e90ff52f90ce2e1cb3a14df37be6f99203eeb24ff0327245987d3ebeb3a3

                                                        • /var/tmp/.22/xm.jpg

                                                          Filesize

                                                          3.9MB

                                                          MD5

                                                          1371a2ca243dc0cd5fae198d69f44708

                                                          SHA1

                                                          f7921b63d2b3f7587f192a5708e339e6a9b1f2f6

                                                          SHA256

                                                          13607684da4fc4c2493996ff4ffe2347a806cb13b905d97bec815d5bf33824da

                                                          SHA512

                                                          84aa7f461c8ebcdd5434f6be119217b9a51ea08c46b0b1ae1e9f0f4081dd77364c552beab8511719b8727972c46c25ab8769faccd65f8b21d6d591ee7a7d4b13