Extracted

Extracted

• • Target
    ohshit.sh
  • Size 3KB
  • SHA256 2891f71eabf60c4554d5d2b6bcecde6a6cc7f507952e8fa1edbcefe9f7df88f0
  • MD5 a313982b4980a7a3b0bad0104ad5fb93
  • SHA1 235c8c150f02e14c215329fa3cd8e7c2cf756e14
  • SHA512 c52be528de170e9019a7f711a6085df352fe55cbc974e650ac0e9c913ba9b33afb7bb3f9a3cfa390c9180df657363b34052209047b913a9a30e4d648938433fc
  • TLSH
    T155816EB6B65EAC75B88E4638A31C72648482146706B17BF4F09F7B302F2E778B55D324
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  botnetlzrddefense_evasiondiscoveryexecutionmiraipersistenceprivilege_escalationupx

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Deletes system logs

    Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

    defense_evasion

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Deletes log files

    Deletes log files on the system.

    defense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Modifies rc script

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence

  • Writes file to system bin folder

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2behavioral3behavioral4