wife.arm7.elf
Mirai botnet DDoS malware
Covert C2 with procfs process fingerprintingMulti-vector DDoS bot handlers
SHA-256070ba172753a92d15aa6bccd35f362cf3081559c47e0e014b8d7b44dc4eb8e90
Evidence
⋯7 more rows
0x208280000a0e10000a0e12442070007c0a0e1........$B......
0x208380470a0e3000000ef0c70a0e10ef0a031.p.......p.....1
0x208485e0400ea0000a0e128c01fe50cc09fe7^.......(.......
0x2085800003ce30600001a07c0a0e10470a0e3..<..........p..
⋯5 more rows
0x208b80000a0e10000a0e19441070007c0a0e1.........A......
0x208c80370a0e3000000ef0c70a0e10ef0a031.p.......p.....1
0x208d83a0400ea0000a0e128c01fe50cc09fe7:.......(.......
0x208e800003ce30600001a07c0a0e10370a0e3..<..........p..
⋯15 more rows
⋯5 more rows
0x29efc00000000000000000000000000000000................
0x29f0c0000000000000000000000002f70726f............/pro
0x29f1c632f73656c662f636d646c696e650000c/self/cmdline..
0x29f2c2f70726f632f73656c662f6578650000/proc/self/exe..
0x29f3c2f6465762f73686d000000006d656d66/dev/shm....memf
⋯3 more rows
0x29f7c6e657469666400007761746368646f67netifd..watchdog
0x29f8c640000005b6b736f6674697271642f30d...[ksoftirqd/0
0x29f9c5d0000005b7263755f73636865645d00]...[rcu_sched].
0x29fac696e6974000000006a6264322f736461init....jbd2/sda
⋯10 more rows
⋯4 more rows
0x2a0fc25732f2e6b77256400000000544d5044%s/.kw%d....TMPD
0x2a10c495200002f646174612f6c6f63616c2fIR../data/local/
0x2a11c746d7000257300002f70726f632f2564tmp.%s../proc/%d
0x2a12c2f73746174000000252a632025640000/stat...%*c %d..
0x2a13c2f70726f632f25642f65786500000000/proc/%d/exe....
0x2a14c2f70726f632f25642f636d646c696e65/proc/%d/cmdline
0x2a15c000000002f73797374656d2f00000000..../system/....
0x2a16c2d73657276696365000000002f70726f-service..../pro
0x2a17c630000004b494c4c45525f4452595f52c...KILLER_DRY_R
0x2a18c554e00002f70726f632f25642f636f6dUN../proc/%d/com
0x2a19c6d0000002c000000257325732b256400m...,...%s%s+%d.
0x2a1ac7772697461626c650000000064656c65writable....dele
0x2a1bc74656400726563656e7400002f70726fted.recent../pro
0x2a1cc632f25642f666400736f636b65743a5bc/%d/fd.socket:[
0x2a1dc000000002f70726f632f6e65742f7463..../proc/net/tc
0x2a1ec700000002f70726f632f6e65742f7463p.../proc/net/tc
0x2a1fc703600006f7574626f756e6400000000p6..outbound....
0x2a20c6c697374656e00006e616d652d6d6973listen..name-mis
⋯11 more rows
0x2a2cc726b6469723d2573203d3d3d00000000rkdir=%s ===....
0x2a2dc2f7661722f746d70000000002f646174/var/tmp..../dat
0x2a2ec612f6461746100002f646174612f746da/data../data/tm
0x2a2fc700000002f7661722f72756e00000000p.../var/run....
⋯11 more rows
⋯13 more rows
0x2a5fc5d2055445020666c6f6f642066696e69] UDP flood fini
0x2a60c736865642e000000474554202f204854shed....GET / HT
0x2a61c54502f312e310d0a486f73743a202573TP/1.1..Host: %s
0x2a62c0d0a557365722d4167656e743a204d6f..User-Agent: Mo
⋯6 more rows
0x2a69c636b5f736e6d705f616d703a20736f63ck_snmp_amp: soc
0x2a6ac6b65740061747461636b5f736e6d705fket.attack_snmp_
0x2a6bc616d703a2049505f484452494e434c00amp: IP_HDRINCL.
0x2a6cc5b202b205d20534e4d5020616d706c69[ + ] SNMP ampli
⋯5 more rows
0x2a72c7364705f616d703a20736f636b657400sdp_amp: socket.
0x2a73c61747461636b5f737364705f616d703aattack_ssdp_amp:
0x2a74c2049505f484452494e434c004d2d5345 IP_HDRINCL.M-SE
0x2a75c41524348202a20485454502f312e310dARCH * HTTP/1.1.
0x2a76c0a484f53543a203233392e3235352e32.HOST: 239.255.2
0x2a77c35352e3235303a313930300d0a4d414e55.250:1900..MAN
0x2a78c3a2022737364703a646973636f766572: "ssdp:discover
0x2a79c220d0a4d583a20310d0a53543a207373"..MX: 1..ST: ss
0x2a7ac64703a616c6c0d0a0d0a00005b202b20dp:all......[ +
0x2a7bc5d205353445020616d706c6966696361] SSDP amplifica
⋯4 more rows
0x2a80c0000000061747461636b5f6e74705f61....attack_ntp_a
0x2a81c6d703a20736f636b6574000061747461mp: socket..atta
⋯5 more rows
0x2ae40202564732c2073706f6f663d25640a00 %ds, spoof=%d..
0x2ae5061747461636b5f7463705f73746f6d70attack_tcp_stomp
0x2ae603a20736f636b65740000000061747461: socket....atta
⋯21 more rows