Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
7.rsync/a/a
ubuntu-20.04-amd64
10.rsync/a/init0
ubuntu-20.04-amd64
6.rsync/a/kswapd0
ubuntu-20.04-amd64
10.rsync/a/run
ubuntu-20.04-amd64
3.rsync/a/stop
ubuntu-20.04-amd64
10.rsync/b/a
ubuntu-20.04-amd64
7.rsync/b/run
ubuntu-20.04-amd64
7.rsync/b/stop
ubuntu-20.04-amd64
6.rsync/c/blitz
ubuntu-20.04-amd64
1.rsync/c/blitz32
ubuntu-20.04-amd64
3.rsync/c/blitz64
ubuntu-20.04-amd64
3.rsync/c/go
ubuntu-20.04-amd64
3.rsync/c/run
ubuntu-20.04-amd64
6.rsync/c/start
ubuntu-20.04-amd64
9.rsync/c/stop
ubuntu-20.04-amd64
6Analysis
-
max time kernel
11s -
max time network
481s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20240221-en -
resource tags
arch:amd64arch:i386image:ubuntu2004-amd64-20240221-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system -
submitted
15/04/2024, 16:01
Behavioral task
behavioral1
Sample
.rsync/a/a
Resource
ubuntu2004-amd64-20240221-en
Behavioral task
behavioral2
Sample
.rsync/a/init0
Resource
ubuntu2004-amd64-20240221-en
Behavioral task
behavioral3
Sample
.rsync/a/kswapd0
Resource
ubuntu2004-amd64-20240221-en
Behavioral task
behavioral4
Sample
.rsync/a/run
Resource
ubuntu2004-amd64-20240221-en
Behavioral task
behavioral5
Sample
.rsync/a/stop
Resource
ubuntu2004-amd64-20240221-en
Behavioral task
behavioral6
Sample
.rsync/b/a
Resource
ubuntu2004-amd64-20240221-en
Behavioral task
behavioral7
Sample
.rsync/b/run
Resource
ubuntu2004-amd64-20240221-en
Behavioral task
behavioral8
Sample
.rsync/b/stop
Resource
ubuntu2004-amd64-20240221-en
Behavioral task
behavioral9
Sample
.rsync/c/blitz
Resource
ubuntu2004-amd64-20240221-en
Behavioral task
behavioral10
Sample
.rsync/c/blitz32
Resource
ubuntu2004-amd64-20240221-en
Behavioral task
behavioral11
Sample
.rsync/c/blitz64
Resource
ubuntu2004-amd64-20240221-en
Behavioral task
behavioral12
Sample
.rsync/c/go
Resource
ubuntu2004-amd64-20240221-en
Behavioral task
behavioral13
Sample
.rsync/c/run
Resource
ubuntu2004-amd64-20240221-en
Behavioral task
behavioral14
Sample
.rsync/c/start
Resource
ubuntu2004-amd64-20240221-en
Behavioral task
behavioral15
Sample
.rsync/c/stop
Resource
ubuntu2004-amd64-20240221-en
General
-
Target
.rsync/a/run
-
Size
109B
-
MD5
623f15febc9933354a6a08543ae49aa3
-
SHA1
8b865eb9b747207160a6b5ff1aefad4fbc6fc465
-
SHA256
1a0391e55d19ec582410044bf2ddaaaea7cf1277d23a8d26b0443bb8e40fa672
-
SHA512
e1e048b28175eabef7aa5284cae83e44fba7438b72beeddc80c5e39a3b8adf03492ef90090d1fab84b509959fab4e3dd33ad66827c5759a3e9c451429c60bdc6
Malware Config
Signatures
-
Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.rsync/a/dir.dir run File opened for modification /tmp/.rsync/a/bash.pid run
Processes
-
/tmp/.rsync/a/run/tmp/.rsync/a/run1⤵
- Writes file to tmp directory
PID:1477 -
/tmp/.rsync/a/stop./stop2⤵PID:1478
-
-
/usr/bin/sleepsleep 102⤵PID:1479
-
-
/usr/bin/catcat dir.dir2⤵PID:1956
-
-
/usr/bin/nohupnohup ./kswapd01⤵PID:1957
-
/tmp/.rsync/a/kswapd0./kswapd01⤵PID:1957
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5B
MD53502b67d300d9d82f467e8e947073bf4
SHA18dc23557e025d35becc466b98b562207f4222b79
SHA256ba2fcf68b9defb7eb640b7bf1fff10d22a37dc41ba83c52401187ea748d9b4aa
SHA51217e9bcca410882101c25bde9096fa1bb436106bdf8219d224d45a6fdcad63d79feb8c8661672bb6aeaf165a0117caf17ea65a903df5a1c8609011e45d9fd427f
-
Filesize
14B
MD5b3d878adcf4672bbd1f31cffac10c769
SHA1ce5798837933ece35a7e26a0a3dc06cab19c6275
SHA256ea5fce19c5fbbbc6c3c36eb9e8e295dfb525e9669aafaf8abe9ddb4e00e345c7
SHA512019d21a618b3ccc70c0c7ede225cbbb704e2b448048586c44c74c81a747129da9f3f9675f2a29363af320d2684974a1ff00ac608c53de4458aeacd3ed4f9da2c