General
- Target ohshit.x86_64
- Size 106KB
- Sample260818-alnxtabp7s
- SHA256 4f4193798293dd233ede99843c2b47642ba0253abeeff590cec855ad23d1c191
- MD5 62451cbc0027cf8593b3079e19eb39e7
- SHA1 6bf4efca0583f16d4abf40a4ed8864ec749e830d
- SHA512 2cc96b9f49430997bd282673a06291f43e1639be2b13687a0e6f7beaf8d537936ad8445a86e49504e7e8c2e0990392add64c17a3fef97272671bbb7a35bb3ef3
- SSDEEP 3072:gTOJu3ER2VGK3OuElzBY+5do5XpviDsBYpWsppF4p5pppppppppppppAphpBNpeZ:gTqeEGSXTdQZiYBYpWsppF4p5ppppppB
- TLSH T16CB34903B6C188FDC595D034477EB236C432F46E2235B29B27D4BE262E8DED12B5A791
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
ohshit.x86_64
Resource
ubuntu1804-amd64-20260513-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target ohshit.x86_64
- Size 106KB
- SHA256 4f4193798293dd233ede99843c2b47642ba0253abeeff590cec855ad23d1c191
- MD5 62451cbc0027cf8593b3079e19eb39e7
- SHA1 6bf4efca0583f16d4abf40a4ed8864ec749e830d
- SHA512 2cc96b9f49430997bd282673a06291f43e1639be2b13687a0e6f7beaf8d537936ad8445a86e49504e7e8c2e0990392add64c17a3fef97272671bbb7a35bb3ef3
- SSDEEP 3072:gTOJu3ER2VGK3OuElzBY+5do5XpviDsBYpWsppF4p5pppppppppppppAphpBNpeZ:gTqeEGSXTdQZiYBYpWsppF4p5ppppppB
- TLSH T16CB34903B6C188FDC595D034477EB236C432F46E2235B29B27D4BE262E8DED12B5A791
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Modifies Watchdog functionality
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder
-
Reads process memory
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.