Overview

overview

10

Static

static

1

ohshit.sh

ubuntu-18.04-amd64

10

ohshit.sh

debian-9-armhf

10

ohshit.sh

debian-9-mips

10

ohshit.sh

debian-9-mipsel

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    ohshit.sh
  • Size 2KB
  • Sample260913-am3glacf46
  • SHA256 48b3bb8bbc6af681852437f83cd3ccdb1675829ddfc5dfacb1f19802654c8915
  • MD5 SHA1 SHA512 TLSH
Score
10/10
mirailzrdantivmbotnetdefense_evasiondiscoverylinux

Malware Config

Extracted

Family

  • mirai

Botnet

  • LZRD

C2

  • 93.152.221.22

Extracted

Family

  • mirai

C2

  • 93.152.221.22

Extracted

Family

  • mirai

Botnet

  • LZRD

C2

  • 93.152.221.22

Extracted

Family

  • mirai

Botnet

  • LZRD

C2

  • 93.152.221.22

Extracted

Family

  • mirai

Botnet

  • LZRD

C2

  • 93.152.221.22

Targets

    • Target
      ohshit.sh
    • Size 2KB
    • SHA256 48b3bb8bbc6af681852437f83cd3ccdb1675829ddfc5dfacb1f19802654c8915
    • MD5 SHA1 SHA512 TLSH
    Score
    10/10
    botnetlzrddefense_evasiondiscoverymiraiantivm

    • Family: Mirai

      Mirai is a prevalent Linux malware infecting exposed network devices.

      botnetmirai

    • File and Directory Permissions Modification

      Adversaries may modify file or directory permissions to evade defenses.

      defense_evasion

    • Executes dropped EXE

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

      defense_evasion

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Writes file to system bin folder

    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Enterprise v16

Tasks