Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240226-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
02/05/2024, 13:59
Static task
static1
Behavioral task
behavioral1
Sample
469fd650b7f8221cc096947e0b6dd4e8.elf
Resource
ubuntu1804-amd64-20240226-en
ubuntu-18.04-amd64
3 signatures
150 seconds
General
-
Target
469fd650b7f8221cc096947e0b6dd4e8.elf
-
Size
87KB
-
MD5
469fd650b7f8221cc096947e0b6dd4e8
-
SHA1
7fc85e0de64c58019e18067ae7b7c5f83aeaa4b1
-
SHA256
b313a0db30544c71db07d031ec9681d1ff00e4474b14c10bbae3f19ceb593b28
-
SHA512
dbd36feb7bbabefcc890968cc92a0685cf6d03337c48bf0ac265acd2ecc67a630ca01f306b3c476e4c3317ceb617c14424cd3c14f977b636a634825409294faf
-
SSDEEP
1536:xpmWc2AcighsZ8+/JxNcjHL1mSsM8emsJgBQ9TnkISGtAdL0xZ:xpmX2riED+/rNsHZmLFsCQ9kVTL0x
Score
6/10
Malware Config
Signatures
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description pid Process Changes the process name, possibly in an attempt to hide itself 1578 469fd650b7f8221cc096947e0b6dd4e8.elf -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/456/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/678/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/1061/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/1135/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/1311/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/20/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/439/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/1183/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/1449/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/13/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/545/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/648/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/1088/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/1205/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/1345/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/180/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/181/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/26/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/31/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/179/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/186/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/682/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/1594/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/7/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/25/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/84/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/115/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/1595/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/11/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/36/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/268/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/288/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/4/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/89/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/1172/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/1179/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/1319/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/17/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/1161/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/22/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/1090/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/1286/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/1140/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/1171/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/1209/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/1305/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/352/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/453/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/1186/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/1565/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/2/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/9/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/486/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/726/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/1085/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/1098/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/1169/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/1599/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/98/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/174/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/433/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/474/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/1372/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf File opened for reading /proc/1597/cmdline 469fd650b7f8221cc096947e0b6dd4e8.elf