Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
160s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
15/12/2024, 01:54
Behavioral task
behavioral1
Sample
rebirth.arm5.elf
Resource
debian9-armhf-20240611-en
General
-
Target
rebirth.arm5.elf
-
Size
77KB
-
MD5
bc20ac7e3796eeb3398dfc154e355ef1
-
SHA1
6a56bc02448b45425020a2425a6ea39a7c72d8d7
-
SHA256
cfdac538bff6b50b3bc4726f45cf6e959b5c84b2b33c340670c958afc5a5e34f
-
SHA512
139416555fc4451509d5d3090114295d440aeab231a502dea7c1c79ed30860991f4ebfbd1946a727dc79dc9a8cdc9acd2184a063a10dde9ef2dc4695e47b071e
-
SSDEEP
1536:6ODrgViG5ZK5HKRjP72I9OqsFkWa9V5bPoVEmwbZnN:6ODrgdNj79OqukWkb3mwbZnN
Malware Config
Signatures
-
Contacts a large (23350) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
File and Directory Permissions Modification 1 TTPs 2 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 650 sh 658 chmod -
Modifies rc script 2 TTPs 1 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
description ioc Process File opened for modification /etc/rc.local rebirth.arm5.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /bin/systemd 649 rebirth.arm5.elf -
description ioc Process File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mv -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/bin/systemd sh
Processes
-
/tmp/rebirth.arm5.elf/tmp/rebirth.arm5.elf1⤵
- Modifies rc script
- Changes its process name
PID:649 -
/bin/shsh -c "rm -rf bin/systemd && mkdir bin; >bin/systemd && mv /tmp/rebirth.arm5.elf bin/systemd; chmod 777 bin/systemd"2⤵
- File and Directory Permissions Modification
- Writes file to tmp directory
PID:650 -
/bin/rmrm -rf bin/systemd3⤵PID:651
-
-
/bin/mkdirmkdir bin3⤵
- Reads runtime system information
PID:654
-
-
/bin/mvmv /tmp/rebirth.arm5.elf bin/systemd3⤵
- Reads runtime system information
PID:657
-
-
/bin/chmodchmod 777 bin/systemd3⤵
- File and Directory Permissions Modification
PID:658
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Privilege Escalation
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95B
MD5ea1dfdca9880b1a10b7368aa0dfe2aef
SHA1b945ec5d90fc07016b606cc10651203d058bfe88
SHA256fb51f4b2f2f0c8eadb95244b3a602d1355de8e4d578375dd7736effa1501fb1a
SHA5123a4fc8238729102268cff2a88f7ce0d3424a0739a94feb33b725d2f54dca8659427c9f393a1782f16a06e752bfca4e98e761427bb7ef90f4fbfeacbedd0b7b47