Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20240523-en -
resource tags
arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system -
submitted
15/12/2024, 04:11
Behavioral task
behavioral1
Sample
rebirth.x86.elf
Resource
ubuntu2404-amd64-20240523-en
General
-
Target
rebirth.x86.elf
-
Size
75KB
-
MD5
c70d6d70685235b94fed5ec73aed3b2c
-
SHA1
cc9ebae95a7c15a670388fc44e0fd41547c17e18
-
SHA256
3231a0ef57c7107fefb310e12f4d2994fc9d0afd9c76148ce1cd409d5cb5dd7e
-
SHA512
e3fb2b71ad3a106724355eeae05f20f483ebd5c78e36d93c2a2ad7137bb6fd95b3c79d916322a99b2819c07ee00bc132cf1bad1735edc3a02e4144dd5c408954
-
SSDEEP
1536:dvBGpSzKkubpUa2jecqCR/JYHqDIw+e6+MFOPRkTZRbXXTzpwbZnR+5:hcpHblUaBcPNeHqEw36FOPOZRTXTNwbf
Malware Config
Signatures
-
Contacts a large (23995) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
File and Directory Permissions Modification 1 TTPs 2 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 2440 sh 2444 chmod -
Modifies rc script 2 TTPs 1 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
description ioc Process File opened for modification /etc/rc.local rebirth.x86.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /bin/systemd 2438 rebirth.x86.elf -
description ioc Process File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mv -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/bin/systemd sh
Processes
-
/tmp/rebirth.x86.elf/tmp/rebirth.x86.elf1⤵
- Modifies rc script
- Changes its process name
PID:2438 -
/bin/shsh -c "rm -rf bin/systemd && mkdir bin; >bin/systemd && mv /tmp/rebirth.x86.elf bin/systemd; chmod 777 bin/systemd"2⤵
- File and Directory Permissions Modification
- Writes file to tmp directory
PID:2440 -
/usr/bin/rmrm -rf bin/systemd3⤵PID:2441
-
-
/usr/bin/mkdirmkdir bin3⤵
- Reads runtime system information
PID:2442
-
-
/usr/bin/mvmv /tmp/rebirth.x86.elf bin/systemd3⤵
- Reads runtime system information
PID:2443
-
-
/usr/bin/chmodchmod 777 bin/systemd3⤵
- File and Directory Permissions Modification
PID:2444
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Privilege Escalation
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1