Extracted

Extracted

Extracted

• • Target
    ohshit.sh
  • Size 741B
  • SHA256 e315fc9b73af92acb65c6d972ec760e47234b8afdd8f1a4b8aca66984f2517d4
  • MD5 27981914bbac7819e9e9b22e369e96f6
  • SHA1 38a563e22f76d98fabd8d7b15389448d2ed22fe9
  • SHA512 a096613ff232fb37a80387d07ca3826105113ce8d8b66d146a811acbfe563d56ac5f49f2b1dac814f21e354166d024eec8c534df9056535c9ba4a885fa6bd6b9
  • TLSH
    T1AC0128436463F0E1A3BF543EEF6BA1423452312B55689D00FBCE271A4F4A924600730B
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  botnetowaridefense_evasiondiscoverymirai

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Mirai ARM payload

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  behavioral1behavioral2behavioral3behavioral4