Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20240221-en -
resource tags
arch:amd64arch:i386image:ubuntu2004-amd64-20240221-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system -
submitted
22/02/2024, 18:25
Static task
static1
Behavioral task
behavioral1
Sample
4840116c4d0a32424b68b1cbb29dd496.elf
Resource
ubuntu2004-amd64-20240221-en
ubuntu-20.04-amd64
3 signatures
150 seconds
General
-
Target
4840116c4d0a32424b68b1cbb29dd496.elf
-
Size
136KB
-
MD5
4840116c4d0a32424b68b1cbb29dd496
-
SHA1
96b0f5b6e0281cbb68908ca1d79d937b9f6d6ef4
-
SHA256
a59d71a5967aa4cfda8fd4e307b5f06fed93c83379a2d80c3b3e79b27f4b2a90
-
SHA512
2b48b40e42a3af66fe2a7e75d67838c902519f98957eb13b9ff123d7776d6b77ce023bafee9a8a3b6d25453f6c4064e348c44b5bb213575ba4531a5dc318873a
-
SSDEEP
3072:tGtwnNiaOnUTuFiPT9OSQ7AOaogjV2iZlBWCgHiA5QPdL:tGtwnNiaOnUTcuLyl5QPd
Score
7/10
Malware Config
Signatures
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a- M" ! 1479 4840116c4d0a32424b68b1cbb29dd496.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/1550/cmdline File opened for reading /proc/1843/cmdline File opened for reading /proc/2067/cmdline File opened for reading /proc/2078/cmdline File opened for reading /proc/177/cmdline File opened for reading /proc/1507/cmdline File opened for reading /proc/1586/cmdline File opened for reading /proc/1611/cmdline File opened for reading /proc/1070/cmdline File opened for reading /proc/1399/cmdline File opened for reading /proc/807/cmdline File opened for reading /proc/2020/cmdline File opened for reading /proc/1144/cmdline File opened for reading /proc/1433/cmdline File opened for reading /proc/1475/cmdline File opened for reading /proc/1527/cmdline File opened for reading /proc/81/cmdline File opened for reading /proc/952/cmdline File opened for reading /proc/931/cmdline File opened for reading /proc/1119/cmdline File opened for reading /proc/1462/cmdline File opened for reading /proc/1648/cmdline File opened for reading /proc/1802/cmdline File opened for reading /proc/93/cmdline File opened for reading /proc/578/cmdline File opened for reading /proc/1624/cmdline File opened for reading /proc/1956/cmdline File opened for reading /proc/1591/cmdline File opened for reading /proc/1992/cmdline File opened for reading /proc/1178/cmdline File opened for reading /proc/1548/cmdline File opened for reading /proc/1572/cmdline File opened for reading /proc/1880/cmdline File opened for reading /proc/1947/cmdline File opened for reading /proc/1027/cmdline File opened for reading /proc/1425/cmdline File opened for reading /proc/1603/cmdline File opened for reading /proc/77/cmdline File opened for reading /proc/140/cmdline File opened for reading /proc/1911/cmdline File opened for reading /proc/1953/cmdline File opened for reading /proc/1032/cmdline File opened for reading /proc/1722/cmdline File opened for reading /proc/1820/cmdline File opened for reading /proc/174/cmdline File opened for reading /proc/897/cmdline File opened for reading /proc/1000/cmdline File opened for reading /proc/1842/cmdline File opened for reading /proc/71/cmdline File opened for reading /proc/642/cmdline File opened for reading /proc/1619/cmdline File opened for reading /proc/1841/cmdline File opened for reading /proc/18/cmdline File opened for reading /proc/272/cmdline File opened for reading /proc/2039/cmdline File opened for reading /proc/1979/cmdline File opened for reading /proc/1559/cmdline File opened for reading /proc/1606/cmdline File opened for reading /proc/444/cmdline File opened for reading /proc/586/cmdline File opened for reading /proc/1037/cmdline File opened for reading /proc/1415/cmdline File opened for reading /proc/1556/cmdline File opened for reading /proc/2017/cmdline