Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
20/02/2024, 14:09
240220-rgk4sshh86 1020/02/2024, 14:09
240220-rgea9ahh84 1020/02/2024, 14:09
240220-rgacashc81 1020/02/2024, 14:08
240220-rf14mahc8y 10Analysis
-
max time kernel
149s -
max time network
148s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20240220-en -
resource tags
arch:amd64arch:i386image:ubuntu2004-amd64-20240220-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system -
submitted
20/02/2024, 14:09
Behavioral task
behavioral1
Sample
bulu.x86
Resource
ubuntu2004-amd64-20240220-en
ubuntu-20.04-amd64
3 signatures
150 seconds
General
-
Target
bulu.x86
-
Size
93KB
-
MD5
3ec42c2b5735a9af6069cfb2a6fab7e1
-
SHA1
ac87428571c10dd202db2529ee8ee354d88c9d29
-
SHA256
4c0015b10dc4587576678e3220c4e79f74e315e644966fa547b5c748268462ff
-
SHA512
0067fca4de9c85d9371b314d1e97509f76cedd99bf5f64401f3613cb19e3b6b0f919a03be3f91664ef0bdd9b78bae8804c9efdc2f8899d9d5f4b605de5146145
-
SSDEEP
1536:VCuLcw/F/nVBysNdiu7RjKhXKn7Tfr4qcm0TyNTWuQn/E6uTuSsRXtb:Lcw/F/VssNdioKhX87TfjBayQuQRY3Ab
Score
7/10
Malware Config
Signatures
-
Changes its process name 1 IoCs
description pid Process Changes the process name, possibly in an attempt to hide itself 1417 bulu.x86 -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/1096/cmdline File opened for reading /proc/167/cmdline File opened for reading /proc/967/cmdline File opened for reading /proc/1413/cmdline File opened for reading /proc/1448/cmdline File opened for reading /proc/74/cmdline File opened for reading /proc/105/cmdline File opened for reading /proc/1141/cmdline File opened for reading /proc/678/cmdline File opened for reading /proc/786/cmdline File opened for reading /proc/1051/cmdline File opened for reading /proc/781/cmdline File opened for reading /proc/21/cmdline File opened for reading /proc/946/cmdline File opened for reading /proc/1437/cmdline File opened for reading /proc/89/cmdline File opened for reading /proc/617/cmdline File opened for reading /proc/988/cmdline File opened for reading /proc/1097/cmdline File opened for reading /proc/76/cmdline File opened for reading /proc/78/cmdline File opened for reading /proc/1152/cmdline File opened for reading /proc/1432/cmdline File opened for reading /proc/200/cmdline File opened for reading /proc/1414/cmdline File opened for reading /proc/1457/cmdline File opened for reading /proc/273/cmdline File opened for reading /proc/1047/cmdline File opened for reading /proc/1449/cmdline File opened for reading /proc/3/cmdline File opened for reading /proc/73/cmdline File opened for reading /proc/1039/cmdline File opened for reading /proc/1415/cmdline File opened for reading /proc/1444/cmdline File opened for reading /proc/1446/cmdline File opened for reading /proc/119/cmdline File opened for reading /proc/517/cmdline File opened for reading /proc/1034/cmdline File opened for reading /proc/1201/cmdline File opened for reading /proc/277/cmdline File opened for reading /proc/659/cmdline File opened for reading /proc/1241/cmdline File opened for reading /proc/1406/cmdline File opened for reading /proc/134/cmdline File opened for reading /proc/201/cmdline File opened for reading /proc/835/cmdline File opened for reading /proc/1458/cmdline File opened for reading /proc/91/cmdline File opened for reading /proc/170/cmdline File opened for reading /proc/1440/cmdline File opened for reading /proc/175/cmdline File opened for reading /proc/1435/cmdline File opened for reading /proc/1439/cmdline File opened for reading /proc/1452/cmdline File opened for reading /proc/16/cmdline File opened for reading /proc/803/cmdline File opened for reading /proc/1101/cmdline File opened for reading /proc/1410/cmdline File opened for reading /proc/805/cmdline File opened for reading /proc/949/cmdline File opened for reading /proc/1084/cmdline File opened for reading /proc/1418/cmdline File opened for reading /proc/10/cmdline File opened for reading /proc/24/cmdline