ohshit.sh

First submission 2022-07-30 13:56:02

File details

File type: Bourne-Again shell script, ASCII text executable
File type: 2.87 KB (2940 bytes)
MD5: 4af30087216906bd81eeb2e1fe914729
SHA1: 22464d75918bd974e9e6cd61d45c1eaef50a8873
SHA256: bdba4d798dc55922d590fd7c2566d8858adfa2df523cf18624d3bc88ea6a913a
Virus Total: 35/60 VT report date: 2022-07-29 21:30:07

File features detected

Is DLL

Packers

Anti Debug

Anti VM

Signed

XOR

URLs, FQDN and IP indicators 1

URL Host (FQDN/IP) Date Added
hXXp://77.73.132.142/ohshit.sh VirusTotal Report 77.73.132.142 VirusTotal Report 2022-07-30 13:56:02

Strings analysis - Possible IPs found 1

77.73.132.142

Strings analysis - Possible URLs found 30

http://77.73.132.142/hiddenbin/boatnet.x86_64;cat
http://77.73.132.142/hiddenbin/boatnet.mips;
http://77.73.132.142/hiddenbin/boatnet.arc;cat
http://77.73.132.142/hiddenbin/boatnet.spc;
http://77.73.132.142/hiddenbin/boatnet.arm7;
http://77.73.132.142/hiddenbin/boatnet.i468;cat
http://77.73.132.142/hiddenbin/boatnet.sh4;cat
http://77.73.132.142/hiddenbin/boatnet.spc;cat
http://77.73.132.142/hiddenbin/boatnet.arc;
http://77.73.132.142/hiddenbin/boatnet.mpsl;
http://77.73.132.142/hiddenbin/boatnet.arm5;
http://77.73.132.142/hiddenbin/boatnet.arm7;cat
http://77.73.132.142/hiddenbin/boatnet.arm;
http://77.73.132.142/hiddenbin/boatnet.arm6;
http://77.73.132.142/hiddenbin/boatnet.ppc;
http://77.73.132.142/hiddenbin/boatnet.ppc;cat
http://77.73.132.142/hiddenbin/boatnet.i686;
http://77.73.132.142/hiddenbin/boatnet.x86;cat
http://77.73.132.142/hiddenbin/boatnet.i686;cat
http://77.73.132.142/hiddenbin/boatnet.arm5;cat
http://77.73.132.142/hiddenbin/boatnet.mpsl;cat
http://77.73.132.142/hiddenbin/boatnet.x86_64;
http://77.73.132.142/hiddenbin/boatnet.x86;
http://77.73.132.142/hiddenbin/boatnet.mips;cat
http://77.73.132.142/hiddenbin/boatnet.m68k;
http://77.73.132.142/hiddenbin/boatnet.arm6;cat
http://77.73.132.142/hiddenbin/boatnet.arm;cat
http://77.73.132.142/hiddenbin/boatnet.sh4;
http://77.73.132.142/hiddenbin/boatnet.m68k;cat
http://77.73.132.142/hiddenbin/boatnet.i468;