Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

22/10/2024, 02:07 UTC

241022-cka1nssfkj 10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    ubuntu-24.04_amd64
  • resource
    ubuntu2404-amd64-20240523-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
  • submitted
    22/10/2024, 02:07 UTC

General

  • Target

    The-MALWARE-Repo-master/Botnets/FritzFrog/5fb29fb0136978b9ccf60750af09cec74a257a0ca9c47159ca74dbba21fbcc59

  • Size

    8.7MB

  • MD5

    97cfb3c26a12e13792f7d1741309d767

  • SHA1

    a010f85cdda9f83cbc738eb1b41cd621f3d6018e

  • SHA256

    5fb29fb0136978b9ccf60750af09cec74a257a0ca9c47159ca74dbba21fbcc59

  • SHA512

    162028b9e93bb4718427304a96767880da7094c99ae6145e61a562f09dae0ce6726b2dfac95782990f50fa9bfc9f82b1aacb9e7b12442094137872fa8a3f3379

  • SSDEEP

    98304:yM1SkPCVk8rOmgYcGrr69gRQTI6xmiiLuSESStOAco7Xk:yM1SkPCVkIgcWAQ06xniLuSExR

Malware Config

Signatures

  • Adds new SSH keys 1 TTPs 1 IoCs

    Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.

  • Deletes itself 1 IoCs
  • Deletes log files 1 TTPs 1 IoCs

    Deletes log files on the system.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Virtualization/Sandbox Evasion: Time Based Evasion 1 TTPs 15 IoCs

    Adversaries may detect and evade virtualized environments and sandboxes.

  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • System Network Configuration Discovery 1 TTPs 4 IoCs

    Adversaries may gather information about the network configuration of a system.

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/5fb29fb0136978b9ccf60750af09cec74a257a0ca9c47159ca74dbba21fbcc59
    /tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/5fb29fb0136978b9ccf60750af09cec74a257a0ca9c47159ca74dbba21fbcc59
    1⤵
    • Adds new SSH keys
    • Deletes itself
    • Deletes log files
    • Reads runtime system information
    • Writes file to tmp directory
    PID:2456
    • /usr/bin/uname
      uname -a
      2⤵
        PID:2473
      • /usr/bin/cat
        cat /proc/cpuinfo
        2⤵
        • Checks CPU configuration
        PID:2474
      • /usr/bin/cat
        cat /etc/issue
        2⤵
          PID:2475
        • /usr/bin/free
          free -m
          2⤵
            PID:2476
          • /usr/bin/uptime
            uptime
            2⤵
            • Virtualization/Sandbox Evasion: Time Based Evasion
            PID:2477
          • /usr/bin/journalctl
            journalctl -S "@0" -u sshd
            2⤵
              PID:2478
            • /usr/bin/cat
              cat "/var/log/auth*"
              2⤵
                PID:2480
              • /usr/bin/zcat
                zcat "/var/log/auth*"
                2⤵
                  PID:2481
                • /usr/local/sbin/gzip
                  gzip -cd "/var/log/auth*"
                  2⤵
                  • System Network Configuration Discovery
                  PID:2481
                • /usr/local/bin/gzip
                  gzip -cd "/var/log/auth*"
                  2⤵
                  • System Network Configuration Discovery
                  PID:2481
                • /usr/sbin/gzip
                  gzip -cd "/var/log/auth*"
                  2⤵
                  • System Network Configuration Discovery
                  PID:2481
                • /usr/bin/gzip
                  gzip -cd "/var/log/auth*"
                  2⤵
                  • System Network Configuration Discovery
                  PID:2481
                • /usr/bin/free
                  free -m
                  2⤵
                    PID:2482
                  • /usr/bin/uptime
                    uptime
                    2⤵
                    • Virtualization/Sandbox Evasion: Time Based Evasion
                    PID:2483
                  • /usr/bin/free
                    free -m
                    2⤵
                      PID:2484
                    • /usr/bin/uptime
                      uptime
                      2⤵
                      • Virtualization/Sandbox Evasion: Time Based Evasion
                      PID:2485
                    • /usr/bin/free
                      free -m
                      2⤵
                        PID:2489
                      • /usr/bin/uptime
                        uptime
                        2⤵
                        • Virtualization/Sandbox Evasion: Time Based Evasion
                        PID:2490
                      • /usr/bin/free
                        free -m
                        2⤵
                          PID:2491
                        • /usr/bin/uptime
                          uptime
                          2⤵
                          • Virtualization/Sandbox Evasion: Time Based Evasion
                          • Reads runtime system information
                          PID:2492
                        • /usr/bin/free
                          free -m
                          2⤵
                          • Reads runtime system information
                          PID:2493
                        • /usr/bin/uptime
                          uptime
                          2⤵
                          • Virtualization/Sandbox Evasion: Time Based Evasion
                          • Reads runtime system information
                          PID:2494
                        • /usr/bin/free
                          free -m
                          2⤵
                            PID:2496
                          • /usr/bin/uptime
                            uptime
                            2⤵
                            • Virtualization/Sandbox Evasion: Time Based Evasion
                            PID:2497
                          • /usr/bin/free
                            free -m
                            2⤵
                            • Reads runtime system information
                            PID:2498
                          • /usr/bin/uptime
                            uptime
                            2⤵
                            • Virtualization/Sandbox Evasion: Time Based Evasion
                            PID:2499
                          • /usr/bin/free
                            free -m
                            2⤵
                              PID:2500
                            • /usr/bin/uptime
                              uptime
                              2⤵
                              • Virtualization/Sandbox Evasion: Time Based Evasion
                              PID:2501
                            • /usr/bin/free
                              free -m
                              2⤵
                                PID:2502
                              • /usr/bin/uptime
                                uptime
                                2⤵
                                • Virtualization/Sandbox Evasion: Time Based Evasion
                                PID:2503
                              • /usr/bin/free
                                free -m
                                2⤵
                                  PID:2504
                                • /usr/bin/uptime
                                  uptime
                                  2⤵
                                  • Virtualization/Sandbox Evasion: Time Based Evasion
                                  • Reads runtime system information
                                  PID:2505
                                • /usr/bin/free
                                  free -m
                                  2⤵
                                    PID:2506
                                  • /usr/bin/uptime
                                    uptime
                                    2⤵
                                    • Virtualization/Sandbox Evasion: Time Based Evasion
                                    PID:2507
                                  • /usr/bin/free
                                    free -m
                                    2⤵
                                      PID:2523
                                    • /usr/bin/uptime
                                      uptime
                                      2⤵
                                      • Virtualization/Sandbox Evasion: Time Based Evasion
                                      PID:2524
                                    • /usr/bin/free
                                      free -m
                                      2⤵
                                        PID:2528
                                      • /usr/bin/uptime
                                        uptime
                                        2⤵
                                        • Virtualization/Sandbox Evasion: Time Based Evasion
                                        PID:2529
                                      • /usr/bin/free
                                        free -m
                                        2⤵
                                          PID:2530
                                        • /usr/bin/uptime
                                          uptime
                                          2⤵
                                          • Virtualization/Sandbox Evasion: Time Based Evasion
                                          • Reads runtime system information
                                          PID:2531

                                      Network

                                        No results found
                                      • 32.145.238.64:22
                                        600 B
                                        10
                                      • 211.161.77.35:2222
                                        600 B
                                        10
                                      • 96.216.80.244:22
                                        600 B
                                        10
                                      • 192.214.113.207:2222
                                        60 B
                                        40 B
                                        1
                                        1
                                      • 75.96.106.124:22
                                        600 B
                                        10
                                      • 187.107.42.213:22
                                        600 B
                                        10
                                      • 25.197.176.235:22
                                        600 B
                                        10
                                      • 142.16.218.193:22
                                        600 B
                                        10
                                      • 60.138.186.164:2222
                                        600 B
                                        10
                                      • 192.214.113.207:22
                                        60 B
                                        40 B
                                        1
                                        1
                                      • 97.85.123.16:22
                                        600 B
                                        10
                                      • 163.100.154.139:2222
                                        600 B
                                        10
                                      • 219.74.73.137:22
                                        600 B
                                        10
                                      • 124.90.249.1:22
                                        600 B
                                        10
                                      • 176.109.26.190:22
                                        600 B
                                        10
                                      • 242.104.178.200:22
                                        600 B
                                        10
                                      • 213.7.100.136:22
                                        600 B
                                        10
                                      • 86.132.49.128:2222
                                        600 B
                                        10
                                      • 22.138.247.186:2222
                                        600 B
                                        10
                                      • 160.40.146.31:22
                                        600 B
                                        10
                                      • 151.28.158.25:22
                                        600 B
                                        10
                                      • 169.244.140.24:22
                                        240 B
                                        4
                                      • 211.161.77.35:22
                                        600 B
                                        10
                                      • 158.218.202.159:22
                                        600 B
                                        10
                                      • 48.37.211.156:2222
                                        600 B
                                        10
                                      • 75.96.106.124:2222
                                        600 B
                                        10
                                      • 112.49.102.136:2222
                                        600 B
                                        10
                                      • 4.19.39.132:2222
                                        600 B
                                        10
                                      • 195.239.63.240:22
                                        600 B
                                        10
                                      • 212.204.215.130:22
                                        600 B
                                        10
                                      • 163.100.154.139:22
                                        600 B
                                        10
                                      • 2.87.30.66:22
                                        600 B
                                        10
                                      • 205.29.201.8:22
                                        600 B
                                        10
                                      • 82.237.12.176:22
                                        600 B
                                        10
                                      • 160.40.146.31:2222
                                        600 B
                                        10
                                      • 218.186.181.97:22
                                        540 B
                                        9
                                      • 136.188.192.104:2222
                                        540 B
                                        9
                                      • 195.239.63.240:2222
                                        540 B
                                        9
                                      • 96.216.80.244:2222
                                        540 B
                                        9
                                      • 205.29.201.8:2222
                                        540 B
                                        9
                                      • 212.204.215.130:2222
                                        540 B
                                        9
                                      • 88.176.250.71:2222
                                        540 B
                                        9
                                      • 97.85.123.16:2222
                                        540 B
                                        9
                                      • 160.36.46.9:22
                                        540 B
                                        9
                                      • 86.216.54.59:2222
                                        540 B
                                        9
                                      • 60.138.186.164:22
                                        540 B
                                        9
                                      • 139.110.17.141:2222
                                        540 B
                                        9
                                      • 66.112.139.105:22
                                        540 B
                                        9
                                      • 45.46.17.238:22
                                        540 B
                                        9
                                      • 28.238.201.54:22
                                        540 B
                                        9
                                      • 182.155.141.117:22
                                        540 B
                                        9
                                      • 79.131.72.69:22
                                        540 B
                                        9
                                      • 205.73.151.68:2222
                                        540 B
                                        9
                                      • 25.197.176.235:2222
                                        540 B
                                        9
                                      • 160.36.46.9:2222
                                        540 B
                                        9
                                      • 203.29.98.245:22
                                        540 B
                                        9
                                      • 66.112.139.105:2222
                                        540 B
                                        9
                                      • 169.244.140.24:2222
                                        240 B
                                        4
                                      • 96.219.128.14:2222
                                        540 B
                                        9
                                      • 213.7.100.136:2222
                                        540 B
                                        9
                                      • 29.164.191.203:2222
                                        540 B
                                        9
                                      • 176.109.26.190:2222
                                        540 B
                                        9
                                      • 39.50.226.45:2222
                                        540 B
                                        9
                                      • 82.237.12.176:2222
                                        540 B
                                        9
                                      • 125.2.165.139:22
                                        540 B
                                        9
                                      • 112.49.102.136:22
                                        540 B
                                        9
                                      • 2.87.30.66:2222
                                        540 B
                                        9
                                      • 189.188.195.15:22
                                        540 B
                                        9
                                      • 224.0.0.251:5353
                                        146 B
                                        2

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • /tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/nc

                                        Filesize

                                        8.7MB

                                        MD5

                                        97cfb3c26a12e13792f7d1741309d767

                                        SHA1

                                        a010f85cdda9f83cbc738eb1b41cd621f3d6018e

                                        SHA256

                                        5fb29fb0136978b9ccf60750af09cec74a257a0ca9c47159ca74dbba21fbcc59

                                        SHA512

                                        162028b9e93bb4718427304a96767880da7094c99ae6145e61a562f09dae0ce6726b2dfac95782990f50fa9bfc9f82b1aacb9e7b12442094137872fa8a3f3379

                                      We care about your privacy.

                                      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.