Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
24/01/2025, 11:05
250124-m67xmswqfk 128/04/2024, 19:36
240428-ybn2tsff8v 1028/04/2024, 19:22
240428-x3cbnsfd2t 1028/04/2024, 19:18
240428-xz2gdseh66 1028/04/2024, 19:07
240428-xsyrxsfa5x 1Analysis
-
max time kernel
0s -
max time network
115s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20240418-en -
resource tags
arch:amd64arch:i386image:ubuntu2004-amd64-20240418-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system -
submitted
28/04/2024, 19:18
Static task
static1
Behavioral task
behavioral1
Sample
k.elf
Resource
ubuntu2004-amd64-20240418-en
General
-
Target
k.elf
-
Size
1.5MB
-
MD5
cfb6d21ffe7c4279f761f2351c0810ee
-
SHA1
ee827023780964574f28c6ba333d800b73eae5c4
-
SHA256
95776f31cbcac08eb3f3e9235d07513a6d7a6bf9f1b7f3d400b2cf0afdb088a7
-
SHA512
c24342fe718d9cd8be98741cb7962b39cdf887b855ac0d7d6c0bbdd346fffd3f1dd1bdb91728bd16efe61456792fcc70b17e6f98cc052e229d186f1d7a28a9b8
-
SSDEEP
24576:t4mEitdoHarsfZqy5hEiefNvF6pVuQYGM:tdE2dxrUqy5ep5F6mQlM
Malware Config
Extracted
/tmp/readme.txt
conti
http://contirec7nchr45rx6ympez5rjldibnqzh7lsa56lvjvaeywhvoj3wad.onion/ykCDUCsFcCYo8BNSsvH2TZTvCnEUM30XKoeCZiXUQEjPnzp1nee2ivFY0hAf7frb
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Writes file to tmp directory 26 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.XIM-unix/readme.txt k.elf File opened for modification /tmp/.font-unix/readme.txt k.elf File opened for modification /tmp/.X11-unix/readme.txt k.elf File opened for modification /tmp/result.txt k.elf File opened for modification /tmp/readme.txt k.elf File opened for modification /tmp/.ICE-unix/readme.txt k.elf File opened for modification /tmp/systemd-private-725b003d63b644e08558703d434a2031-ModemManager.service-ZyCiSg/readme.txt k.elf File opened for modification /tmp/snap-private-tmp/readme.txt k.elf File opened for modification /tmp/systemd-private-725b003d63b644e08558703d434a2031-fwupd.service-1iX9vf/tmp/readme.txt k.elf File opened for modification /tmp/systemd-private-725b003d63b644e08558703d434a2031-colord.service-IjKOLf/readme.txt k.elf File opened for modification /tmp/systemd-private-725b003d63b644e08558703d434a2031-upower.service-QwDerh/tmp/readme.txt k.elf File opened for modification /tmp/.Test-unix/readme.txt k.elf File opened for modification /tmp/systemd-private-725b003d63b644e08558703d434a2031-systemd-timedated.service-7Vezui/readme.txt k.elf File opened for modification /tmp/systemd-private-725b003d63b644e08558703d434a2031-switcheroo-control.service-Bb7xCh/readme.txt k.elf File opened for modification /tmp/systemd-private-725b003d63b644e08558703d434a2031-systemd-timedated.service-7Vezui/tmp/readme.txt k.elf File opened for modification /tmp/systemd-private-725b003d63b644e08558703d434a2031-systemd-logind.service-xcG0zi/readme.txt k.elf File opened for modification /tmp/systemd-private-725b003d63b644e08558703d434a2031-systemd-resolved.service-XpraHi/tmp/readme.txt k.elf File opened for modification /tmp/systemd-private-725b003d63b644e08558703d434a2031-upower.service-QwDerh/readme.txt k.elf File opened for modification /tmp/k.elf k.elf File opened for modification /tmp/systemd-private-725b003d63b644e08558703d434a2031-systemd-resolved.service-XpraHi/readme.txt k.elf File opened for modification /tmp/systemd-private-725b003d63b644e08558703d434a2031-colord.service-IjKOLf/tmp/readme.txt k.elf File opened for modification /tmp/systemd-private-725b003d63b644e08558703d434a2031-ModemManager.service-ZyCiSg/tmp/readme.txt k.elf File opened for modification /tmp/systemd-private-725b003d63b644e08558703d434a2031-switcheroo-control.service-Bb7xCh/tmp/readme.txt k.elf File opened for modification /tmp/systemd-private-725b003d63b644e08558703d434a2031-fwupd.service-1iX9vf/readme.txt k.elf File opened for modification /tmp/ssh-xFWa55crivIA/readme.txt k.elf File opened for modification /tmp/systemd-private-725b003d63b644e08558703d434a2031-systemd-logind.service-xcG0zi/tmp/readme.txt k.elf
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5f2ec65b6ccc5e28343ce62a48279027f
SHA17ef88d7845747810a522b73b48f85774cc3d5d0e
SHA256a01e047b193671716125c6cf06171b0b0cac332631065ea5320fff4be0971582
SHA512b48e8c82812e03afbc39f55f59e5110d181b107000c87491eb6adfebe19b7a3679dac6debb5fd0319afb53a12ed476dd4d5212aa5470e8b015ff1abdb3ce1b38
-
Filesize
33B
MD5e7e930dbed22a8a67cfcd9c510268087
SHA11e19959cb6ac9c43da3c142c72fa71163f261095
SHA256b61d766a605a6c97ee10e601e707996734cb6a538356aeaa237903c3040e8303
SHA512c04c113344e21a79156bbd3cb86e74e584e5d154e5ce04f9fcad5184e0c2355dd7d6767b45bbb9fce720eed36cbcd36f4f9aa981e682a03f957c07a219dac931