Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20240523-en -
resource tags
arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system -
submitted
17/12/2024, 02:05
Behavioral task
behavioral1
Sample
0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf
Resource
ubuntu2404-amd64-20240523-en
General
-
Target
0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf
-
Size
54KB
-
MD5
448299ea09222114fcbbc43a647604e1
-
SHA1
ab09cdb797afb64d7a49806d09ebea50f7acea6a
-
SHA256
0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1
-
SHA512
b9389aafc318d05b4df8fe1d730b75588d0fbfc0d6a8ef00bf1d880ab908a834ec12883bb999b92862d6c6e922ea69d8f1843c35e0f7bcde76dd57a0e81443ce
-
SSDEEP
1536:JeESt/basV2rcZhG6ySN7nauRe9xzWOIaEjrqMY:JeESt/basVTgS7nauw9BtXEST
Malware Config
Signatures
-
Contacts a large (37874) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 3644 chmod -
Loads a kernel module 48 IoCs
Loads a Linux kernel module, potentially to achieve persistence
pid Process 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf 3645 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf -
Writes file to system bin folder 1 IoCs
description ioc Process File opened for modification /bin/systemd 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf -
description ioc Process File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mv -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/bin/systemd 0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf
Processes
-
/tmp/0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf/tmp/0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf1⤵
- Loads a kernel module
- Writes file to system bin folder
- Writes file to tmp directory
PID:3638 -
/usr/bin/rmrm -rf bin/systemd2⤵PID:3640
-
-
/usr/bin/mkdirmkdir bin2⤵
- Reads runtime system information
PID:3642
-
-
/usr/bin/mvmv "/qc��!c��/tmp/0a2bb8f1e08010f0775a98dc698728a5dbb306038549eba91a3ca46c3b0771f1.elf" "bin/systemd"2⤵
- Reads runtime system information
PID:3643
-
-
/usr/bin/chmodchmod 777 "bin/systemd"2⤵
- File and Directory Permissions Modification
PID:3644
-