Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
153s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20231221-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20231221-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
13/02/2024, 05:02
Static task
static1
Behavioral task
behavioral1
Sample
bfb598be9ffe2a8452cec9efb06546a2eba2da10e1e52688f390eedeedcbca53.elf
Resource
ubuntu1804-amd64-20231221-en
ubuntu-18.04-amd64
General
-
Target
bfb598be9ffe2a8452cec9efb06546a2eba2da10e1e52688f390eedeedcbca53.elf
-
Size
53KB
-
MD5
25d57c6e18552f851bacc79b7d798dc9
-
SHA1
8325c4ee298cac66f43c5f7021a02ad0fffcd384
-
SHA256
bfb598be9ffe2a8452cec9efb06546a2eba2da10e1e52688f390eedeedcbca53
-
SHA512
18518b3116afdd6855357c49c1085c0841b56b3ec43fe29d12cce15e097a399733866f7f7abb0a209b2770dcc3cd9e5a5a998477a7e2a6d9dc919ce0633d88d0
-
SSDEEP
768:430LPFyF5SrN+HMivtmK45VkkWgDyTtLG2ZDjTIH:4ghOdvtniV7WgDy/cH
Malware Config
Signatures
-
Contacts a large (47670) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/3/exe File opened for reading /proc/1137/maps File opened for reading /proc/961/maps File opened for reading /proc/167/maps File opened for reading /proc/444/maps File opened for reading /proc/564/maps File opened for reading /proc/1239/maps File opened for reading /proc/14/exe File opened for reading /proc/1151/maps File opened for reading /proc/984/maps File opened for reading /proc/28/exe File opened for reading /proc/132/exe File opened for reading /proc/1530/maps File opened for reading /proc/1/maps File opened for reading /proc/12/maps File opened for reading /proc/6/maps File opened for reading /proc/1308/maps File opened for reading /proc/1498/maps File opened for reading /proc/1524/maps File opened for reading /proc/415/maps File opened for reading /proc/1119/maps File opened for reading /proc/25/maps File opened for reading /proc/79/exe File opened for reading /proc/591/maps File opened for reading /proc/658/maps File opened for reading /proc/1524/exe File opened for reading /proc/19/maps File opened for reading /proc/21/maps File opened for reading /proc/177/exe File opened for reading /proc/320/maps File opened for reading /proc/8/exe File opened for reading /proc/167/exe File opened for reading /proc/35/exe File opened for reading /proc/477/maps File opened for reading /proc/13/exe File opened for reading /proc/22/exe File opened for reading /proc/83/exe File opened for reading /proc/163/maps File opened for reading /proc/9/maps File opened for reading /proc/22/maps File opened for reading /proc/169/maps File opened for reading /proc/717/maps File opened for reading /proc/1075/maps File opened for reading /proc/1227/maps File opened for reading /proc/29/maps File opened for reading /proc/81/exe File opened for reading /proc/30/exe File opened for reading /proc/36/exe File opened for reading /proc/1177/maps File opened for reading /proc/1236/maps File opened for reading /proc/17/maps File opened for reading /proc/466/maps File opened for reading /proc/407/maps File opened for reading /proc/409/maps File opened for reading /proc/480/maps File opened for reading /proc/28/maps File opened for reading /proc/161/exe File opened for reading /proc/35/maps File opened for reading /proc/85/exe File opened for reading /proc/418/maps File opened for reading /proc/1165/maps File opened for reading /proc/10/maps File opened for reading /proc/23/exe File opened for reading /proc/172/maps