Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240226-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
29/03/2024, 02:41
Static task
static1
Behavioral task
behavioral1
Sample
d3fa47112af0aadb023531c36b419d32b60aafa38b9aa2017943dd35d45c17f3.elf
Resource
ubuntu1804-amd64-20240226-en
ubuntu-18.04-amd64
General
-
Target
d3fa47112af0aadb023531c36b419d32b60aafa38b9aa2017943dd35d45c17f3.elf
-
Size
61KB
-
MD5
865f2da8ebc299d9ee70cd857ddd43a3
-
SHA1
67cf6e728b98c3d94ab75c6ac3e4563c964af0ca
-
SHA256
d3fa47112af0aadb023531c36b419d32b60aafa38b9aa2017943dd35d45c17f3
-
SHA512
dfba34ab819bae82090904a52d88e17372472e9ee4ef295765cc2c29360bcea9703079124f74dba2178fecb2bd8ee0499c7ed134cb342dbe64babe599c5df952
-
SSDEEP
1536:N8SA+LqjeBwC+7uoJt1z2C/RLw/lqF5JufGl:VLqWwPt1d2/A5Af2
Malware Config
Signatures
-
Contacts a large (23830) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/1238/maps File opened for reading /proc/9/maps File opened for reading /proc/17/exe File opened for reading /proc/89/exe File opened for reading /proc/592/maps File opened for reading /proc/1089/maps File opened for reading /proc/6/exe File opened for reading /proc/29/exe File opened for reading /proc/702/maps File opened for reading /proc/1526/maps File opened for reading /proc/16/exe File opened for reading /proc/36/maps File opened for reading /proc/98/maps File opened for reading /proc/156/maps File opened for reading /proc/15/maps File opened for reading /proc/79/maps File opened for reading /proc/1524/exe File opened for reading /proc/1534/exe File opened for reading /proc/13/exe File opened for reading /proc/21/maps File opened for reading /proc/162/exe File opened for reading /proc/168/maps File opened for reading /proc/1125/maps File opened for reading /proc/28/maps File opened for reading /proc/81/maps File opened for reading /proc/961/maps File opened for reading /proc/1233/maps File opened for reading /proc/1520/maps File opened for reading /proc/165/maps File opened for reading /proc/432/maps File opened for reading /proc/1112/maps File opened for reading /proc/1152/maps File opened for reading /proc/1170/maps File opened for reading /proc/1239/maps File opened for reading /proc/1054/maps File opened for reading /proc/1299/maps File opened for reading /proc/2/exe File opened for reading /proc/20/maps File opened for reading /proc/29/maps File opened for reading /proc/32/maps File opened for reading /proc/435/maps File opened for reading /proc/1142/maps File opened for reading /proc/1147/maps File opened for reading /proc/7/exe File opened for reading /proc/30/maps File opened for reading /proc/34/maps File opened for reading /proc/84/exe File opened for reading /proc/706/maps File opened for reading /proc/23/maps File opened for reading /proc/154/maps File opened for reading /proc/954/maps File opened for reading /proc/1326/maps File opened for reading /proc/8/maps File opened for reading /proc/131/exe File opened for reading /proc/1137/maps File opened for reading /proc/1537/exe File opened for reading /proc/9/exe File opened for reading /proc/197/exe File opened for reading /proc/536/maps File opened for reading /proc/945/maps File opened for reading /proc/1146/maps File opened for reading /proc/8/exe File opened for reading /proc/156/exe File opened for reading /proc/1056/maps