Hostile ^92% Download

01895d202757e4242b27a2b27f834d2b77b5ec5a4925c9f16c276cf0488b82b0.elf

Botnet DDoS and ransomware indicators

Go network-device bot extracts credentials and exploits discovered devicesGo binary exposes multiple flood methods

SHA-25601895d202757e4242b27a2b27f834d2b77b5ec5a4925c9f16c276cf0488b82b0

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeO₅(LaAs₂I₄PCa)H₄(Cm₁₁Cr₅Db₅Os₄)Md₂(BiPt)

Evidence

Little-endian MIPS syscall instruction 0xf6c–0x109c

0xf6c00000000000000000000000000000000................
0xf7c00000000000000000000200101010003.......... .....
0xf8c00000000000000000000000000000000................
0xf9c040000005300000004000000476f0000....S.......Go..
0xfac335775734f3954303667586d556474583WusO9T06gXmUdtX
⋯4 more rows
0xffc5a3372000800c18f2b083d0006002014Z3r.....+.=... .
0x100c0000000025181f0040ae020c00000000....%...@.......
0x101cf8ff001000000000f4ffbfaff4ffbd27...............'
0x102c0000bfaf1000a3935a00173c9c7de48e........Z..<.}..
⋯7 more rows

Pinned external IPv4 host literal in binary 0x399bcc–0x399cec

⋯5 more rows
0x399c1c61747461636b206f6e20687474703a2fattack on http:/
0x399c2c2f3138352e3231332e3234302e36342f/185.213.240.64/
0x399c3c62696e732e73680d0a557365722d4167bins.sh..User-Ag
⋯11 more rows

References Go net/http Client.Do 0x43f8bb–0x43fa4b

⋯7 more rows
0x43f92b687474702e4e65775265717565737400http.NewRequest.
0x43f93b6e65742f687474702e282a436c69656enet/http.(*Clien
0x43f94b74292e446f006e65742f687474702e61t).Do.net/http.a
0x43f95b6c7761797346616c7365006e65742f68lwaysFalse.net/h
⋯15 more rows

Go binary exposes multiple flood methods 0x4477e4–0x447aa4

⋯5 more rows
0x44783465742f4d6574686f64732e696e697400et/Methods.init.
0x447844426f746e65742f4d6574686f64732e46Botnet/Methods.F
0x4478546f727441747461636b00426f746e6574ortAttack.Botnet
0x4478642f4d6574686f64732e466f7274417474/Methods.FortAtt
⋯8 more rows
0x4478f441747461636b2e66756e63312e646566Attack.func1.def
0x4479046572777261703100426f746e65742f4derwrap1.Botnet/M
0x4479146574686f64732e47616d65466c6f6f64ethods.GameFlood
0x44792400666d742e5072696e74660072756e74.fmt.Printf.runt
⋯8 more rows
0x4479b4732e47616d65466c6f6f642e66756e63s.GameFlood.func
0x4479c4312e6465666572777261703100426f741.deferwrap1.Bot
0x4479d46e65742f4d6574686f64732e48657846net/Methods.HexF
0x4479e46c6f6f6400426f746e65742f4d657468lood.Botnet/Meth
0x4479f46f64732e486f6d65486f6c6400426f74ods.HomeHold.Bot
⋯11 more rows

Go device credential-leak handler set 0x4481b5–0x4484a5

⋯5 more rows
0x448205696e2e6d61696e2e676f777261703100in.main.gowrap1.
0x4482156d61696e2e4175746f5374617274006fmain.AutoStart.o
0x448225732e45786563757461626c65006f732es.Executable.os.
0x448235437265617465006f732e282a46696c65Create.os.(*File
0x448245292e43686d6f6400696f2f696f757469).Chmod.io/iouti
0x4482556c2e5265616446696c65006d61696e2el.ReadFile.main.
0x4482654765745374617473006d61696e2e6765GetStats.main.ge
⋯11 more rows
0x448325636f6e66436865636b2e646566657277confCheck.deferw
0x44833572617031006d61696e2e676574437265rap1.main.getCre
0x448345644c65616b006e65742f687474702e47dLeak.net/http.G
0x4483556574006d61696e2e66696e6442797465et.main.findByte
0x448365456e64006d61696e2e67657443726564End.main.getCred
0x4483754c65616b2e6465666572777261703100Leak.deferwrap1.
0x4483856d61696e2e67657441646d696e437265main.getAdminCre
0x448395644c65616b006d61696e2e6765744164dLeak.main.getAd
0x4483a56d696e437265644c65616b2e64656665minCredLeak.defe
0x4483b5727772617031006d61696e2e66696e64rwrap1.main.find
0x4483c5446576696365006d61696e2e66696e64Device.main.find
0x4483d54465766963652e646566657277726170Device.deferwrap
⋯8 more rows
0x4484656365436170746368612e646566657277ceCaptcha.deferw
0x44847572617031006d61696e2e6c6f67696e44rap1.main.loginD
0x4484856576696365006d61696e2e6c6f67696eevice.main.login
0x4484954465766963652e646566657277726170Device.deferwrap
0x4484a531006d61696e2e737973636d6450696e1.main.syscmdPin