Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20240221-en -
resource tags
arch:amd64arch:i386image:ubuntu2004-amd64-20240221-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system -
submitted
10/04/2024, 02:07
Behavioral task
behavioral1
Sample
69f5f9dbbb813e1813c2920dd7372bb3580574b6057fbaa274a011b6a6a0e533.elf
Resource
ubuntu2004-amd64-20240221-en
General
-
Target
69f5f9dbbb813e1813c2920dd7372bb3580574b6057fbaa274a011b6a6a0e533.elf
-
Size
53KB
-
MD5
e9059ff87e59d67b85bb2cdf4a8b6ffb
-
SHA1
0e3ec50d0d9872438a2dec9dfe65626d2f923acd
-
SHA256
69f5f9dbbb813e1813c2920dd7372bb3580574b6057fbaa274a011b6a6a0e533
-
SHA512
ef3235729502938e4d25b5f0d0b5958f836d234d903e41b4337f5b78ac88dda6771660f241b4c648879080b332299b3eb6753024dceee0fe344e51227a25c551
-
SSDEEP
1536:gNaQBiZtVFgAORuN2f08HSnAhyGGiG+goRrSz:gNaQBmzgAOs0HSAhuY9Ri
Malware Config
Signatures
-
Contacts a large (75689) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /var/Sofia 1466 69f5f9dbbb813e1813c2920dd7372bb3580574b6057fbaa274a011b6a6a0e533.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/1931/cmdline File opened for reading /proc/9/cmdline File opened for reading /proc/242/cmdline File opened for reading /proc/444/cmdline File opened for reading /proc/618/cmdline File opened for reading /proc/836/cmdline File opened for reading /proc/1880/cmdline File opened for reading /proc/14/cmdline File opened for reading /proc/20/cmdline File opened for reading /proc/85/cmdline File opened for reading /proc/782/cmdline File opened for reading /proc/979/cmdline File opened for reading /proc/1091/cmdline File opened for reading /proc/76/cmdline File opened for reading /proc/1099/cmdline File opened for reading /proc/1101/cmdline File opened for reading /proc/1428/cmdline File opened for reading /proc/582/cmdline File opened for reading /proc/655/cmdline File opened for reading /proc/1911/cmdline File opened for reading /proc/3/cmdline File opened for reading /proc/105/cmdline File opened for reading /proc/499/cmdline File opened for reading /proc/811/cmdline File opened for reading /proc/1103/cmdline File opened for reading /proc/487/cmdline File opened for reading /proc/564/cmdline File opened for reading /proc/1396/cmdline File opened for reading /proc/2/cmdline File opened for reading /proc/1100/cmdline File opened for reading /proc/22/cmdline File opened for reading /proc/77/cmdline File opened for reading /proc/1407/cmdline File opened for reading /proc/1433/cmdline File opened for reading /proc/1438/cmdline File opened for reading /proc/1/cmdline File opened for reading /proc/72/cmdline File opened for reading /proc/170/cmdline File opened for reading /proc/1110/cmdline File opened for reading /proc/1138/cmdline File opened for reading /proc/1413/cmdline File opened for reading /proc/84/cmdline File opened for reading /proc/102/cmdline File opened for reading /proc/1029/cmdline File opened for reading /proc/1047/cmdline File opened for reading /proc/1174/cmdline File opened for reading /proc/2083/cmdline File opened for reading /proc/17/cmdline File opened for reading /proc/86/cmdline File opened for reading /proc/173/cmdline File opened for reading /proc/456/cmdline File opened for reading /proc/23/cmdline File opened for reading /proc/1034/cmdline File opened for reading /proc/5/cmdline File opened for reading /proc/21/cmdline File opened for reading /proc/119/cmdline File opened for reading /proc/585/cmdline File opened for reading /proc/16/cmdline File opened for reading /proc/1074/cmdline File opened for reading /proc/1408/cmdline File opened for reading /proc/12/cmdline File opened for reading /proc/270/cmdline File opened for reading /proc/804/cmdline File opened for reading /proc/817/cmdline