Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

3

Static

static

1

.shv/brute

ubuntu-18.04-amd64

1

.shv/print

ubuntu-18.04-amd64

3

.shv/print

debian-9-armhf

1

.shv/print

debian-9-mips

3

.shv/print

debian-9-mipsel

3

.shv/ps

ubuntu-18.04-amd64

.shv/rand

ubuntu-18.04-amd64

1

.shv/rand

debian-9-armhf

1

.shv/rand

debian-9-mips

1

.shv/rand

debian-9-mipsel

1

.shv/ss

ubuntu-18.04-amd64

1

.shv/su

ubuntu-18.04-amd64

3

.shv/su

debian-9-armhf

1

.shv/su

debian-9-mips

3

.shv/su

debian-9-mipsel

3

Analysis

  • max time kernel
    9s
  • max time network
    131s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20231215-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20231215-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    22/12/2023, 04:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    .shv/su

  • Size

    588B

  • MD5

    9669407e2cd92b81a505a2513ec0c9c9

  • SHA1

    2ad4fc5d7de1c7f0c5800839911f406cc30252e1

  • SHA256

    39801769a453bf7aa33c51f6241825793b60fac03ae9d9d2179620044eba7f1f

  • SHA512

    b43c65b7f906aed9e0351d2224c175a445c2a51c81ed1639484e8ef77ff421632994a8b1aafae43179345fe453aaaa9930bce86e6228e377332aca1f2170a945

Score
3/10

Malware Config

Signatures

  • Writes file to tmp directory 3 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/.shv/su
    /tmp/.shv/su
    1⤵
      PID:1552
      • /bin/sh
        sh test
        2⤵
        • Writes file to tmp directory
        PID:1553
        • /tmp/.shv/print
          ./print
          3⤵
            PID:1554
        • /bin/rm
          rm -rf test
          2⤵
            PID:1555
          • /bin/rm
            rm -rf scan.log
            2⤵
              PID:1556
            • /bin/rm
              rm -rf "*.pscan*"
              2⤵
                PID:1557
              • /bin/rm
                rm -rf vuln.txt
                2⤵
                  PID:1558
                • /bin/rm
                  rm -rf nobash.txt
                  2⤵
                    PID:1559
                  • /bin/rm
                    rm -rf t.log
                    2⤵
                      PID:1560
                    • /tmp/.shv/ps
                      ./ps 22
                      2⤵
                        PID:1561
                      • /bin/sleep
                        sleep 3
                        2⤵
                          PID:1562
                        • /bin/cat
                          cat .pscan.22
                          2⤵
                            PID:1567
                          • /usr/bin/sort
                            sort
                            2⤵
                              PID:1568
                            • /usr/bin/uniq
                              uniq
                              2⤵
                                PID:1569
                              • /tmp/.shv/brute
                                ./brute 100
                                2⤵
                                  PID:1570
                                • /bin/sleep
                                  sleep 1
                                  2⤵
                                    PID:1571
                                  • /usr/bin/which
                                    which replace
                                    2⤵
                                      PID:1572
                                    • /bin/cat
                                      cat vuln.txt
                                      2⤵
                                        PID:1573
                                      • /usr/bin/cut
                                        cut -d " " "-f1,2" "--output-d=:"
                                        2⤵
                                          PID:1574
                                        • /bin/cat
                                          cat nobash.txt
                                          2⤵
                                            PID:1575
                                          • /usr/bin/cut
                                            cut -d " " "-f1,2,3" "--output-d=:"
                                            2⤵
                                              PID:1576
                                            • /tmp/.shv/print
                                              ./print
                                              2⤵
                                                PID:1577

                                            Network

                                            MITRE ATT&CK Matrix

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads