ohshit.sh

First submission 2022-08-03 05:14:02

File details

File type: Bourne-Again shell script, ASCII text executable
File type: 2.93 KB (3000 bytes)
MD5: 433e1463af943aa52c0d7883acd5bea8
SHA1: 9cd81ca0dda9b8178dab337b0f861f50b112b727
SHA256: 401ff10a4346041fa05e1923cedb70a434e6f8303974d8d83e82dbace8d084dc
Virus Total: 32/60 VT report date: 2022-08-03 02:15:12

File features detected

Is DLL

Packers

Anti Debug

Anti VM

Signed

XOR

URLs, FQDN and IP indicators 1

URL Host (FQDN/IP) Date Added
hXXp://185.196.220.217/ohshit.sh VirusTotal Report 185.196.220.217 VirusTotal Report 2022-08-03 05:14:02

Strings analysis - Possible IPs found 1

185.196.220.217

Strings analysis - Possible URLs found 30

http://185.196.220.217/hiddenbin/boatnet.spc;cat
http://185.196.220.217/hiddenbin/boatnet.arm5;cat
http://185.196.220.217/hiddenbin/boatnet.m68k;
http://185.196.220.217/hiddenbin/boatnet.arm7;cat
http://185.196.220.217/hiddenbin/boatnet.i686;cat
http://185.196.220.217/hiddenbin/boatnet.arc;
http://185.196.220.217/hiddenbin/boatnet.i468;
http://185.196.220.217/hiddenbin/boatnet.spc;
http://185.196.220.217/hiddenbin/boatnet.arm;
http://185.196.220.217/hiddenbin/boatnet.ppc;cat
http://185.196.220.217/hiddenbin/boatnet.sh4;cat
http://185.196.220.217/hiddenbin/boatnet.m68k;cat
http://185.196.220.217/hiddenbin/boatnet.sh4;
http://185.196.220.217/hiddenbin/boatnet.arm6;
http://185.196.220.217/hiddenbin/boatnet.arm;cat
http://185.196.220.217/hiddenbin/boatnet.x86_64;cat
http://185.196.220.217/hiddenbin/boatnet.mips;
http://185.196.220.217/hiddenbin/boatnet.x86;
http://185.196.220.217/hiddenbin/boatnet.mpsl;
http://185.196.220.217/hiddenbin/boatnet.mpsl;cat
http://185.196.220.217/hiddenbin/boatnet.arc;cat
http://185.196.220.217/hiddenbin/boatnet.x86;cat
http://185.196.220.217/hiddenbin/boatnet.i686;
http://185.196.220.217/hiddenbin/boatnet.mips;cat
http://185.196.220.217/hiddenbin/boatnet.arm5;
http://185.196.220.217/hiddenbin/boatnet.i468;cat
http://185.196.220.217/hiddenbin/boatnet.x86_64;
http://185.196.220.217/hiddenbin/boatnet.arm6;cat
http://185.196.220.217/hiddenbin/boatnet.arm7;
http://185.196.220.217/hiddenbin/boatnet.ppc;