Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

3

Static

static

1

.sshv/brute

ubuntu-18.04-amd64

1

.sshv/print

ubuntu-18.04-amd64

3

.sshv/print

debian-9-armhf

3

.sshv/print

debian-9-mips

1

.sshv/print

debian-9-mipsel

1

.sshv/ps

ubuntu-18.04-amd64

.sshv/rand

ubuntu-18.04-amd64

1

.sshv/rand

debian-9-armhf

1

.sshv/rand

debian-9-mips

1

.sshv/rand

debian-9-mipsel

1

.sshv/ss

ubuntu-18.04-amd64

1

.sshv/su

ubuntu-18.04-amd64

3

.sshv/su

debian-9-armhf

3

.sshv/su

debian-9-mips

1

.sshv/su

debian-9-mipsel

3

Analysis

  • max time kernel
    32s
  • platform
    debian-9_mipsel
  • resource
    debian9-mipsel-20231215-en
  • resource tags

    arch:mipselimage:debian9-mipsel-20231215-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    22/12/2023, 05:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    .sshv/su

  • Size

    588B

  • MD5

    9669407e2cd92b81a505a2513ec0c9c9

  • SHA1

    2ad4fc5d7de1c7f0c5800839911f406cc30252e1

  • SHA256

    39801769a453bf7aa33c51f6241825793b60fac03ae9d9d2179620044eba7f1f

  • SHA512

    b43c65b7f906aed9e0351d2224c175a445c2a51c81ed1639484e8ef77ff421632994a8b1aafae43179345fe453aaaa9930bce86e6228e377332aca1f2170a945

Score
3/10

Malware Config

Signatures

  • Writes file to tmp directory 2 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/.sshv/su
    /tmp/.sshv/su
    1⤵
      PID:728
      • /bin/sh
        sh test
        2⤵
          PID:736
        • /bin/rm
          rm -rf test
          2⤵
            PID:739
          • /bin/rm
            rm -rf scan.log
            2⤵
              PID:741
            • /bin/rm
              rm -rf "*.pscan*"
              2⤵
                PID:742
              • /bin/rm
                rm -rf vuln.txt
                2⤵
                  PID:745
                • /bin/rm
                  rm -rf nobash.txt
                  2⤵
                    PID:746
                  • /bin/rm
                    rm -rf t.log
                    2⤵
                      PID:749
                    • /tmp/.sshv/ps
                      ./ps 22
                      2⤵
                        PID:751
                      • /bin/sleep
                        sleep 3
                        2⤵
                          PID:752
                        • /usr/bin/uniq
                          uniq
                          2⤵
                            PID:758
                          • /usr/bin/sort
                            sort
                            2⤵
                              PID:757
                            • /bin/cat
                              cat .pscan.22
                              2⤵
                                PID:756
                              • /tmp/.sshv/brute
                                ./brute 100
                                2⤵
                                  PID:760
                                • /bin/sleep
                                  sleep 1
                                  2⤵
                                    PID:761
                                  • /usr/bin/which
                                    which replace
                                    2⤵
                                      PID:762
                                    • /bin/cat
                                      cat vuln.txt
                                      2⤵
                                        PID:763
                                      • /usr/bin/cut
                                        cut -d " " "-f1,2" "--output-d=:"
                                        2⤵
                                          PID:764
                                        • /bin/cat
                                          cat nobash.txt
                                          2⤵
                                            PID:765
                                          • /usr/bin/cut
                                            cut -d " " "-f1,2,3" "--output-d=:"
                                            2⤵
                                              PID:766
                                            • /tmp/.sshv/print
                                              ./print
                                              2⤵
                                                PID:767

                                            Network

                                            MITRE ATT&CK Matrix

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads