Hostile ^100% Download

manji.x86

Mirai botnet malware

Unix ELF TracerPid debugger checkReferences a systemd ExecStart directive

SHA-2561205d35b4ba501885610598b03cfd82c9e829836273293635595c118aedbff9e

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeK(Li)O₃(AlDyP₄)H₆(CmCrDb₂F₈Os₆Po₃)Md₃(Bi₂He)Th

Evidence

ChaCha20/Salsa20 cipher constant 0x3ff1–0x40b1

⋯3 more rows
0x4021565331c08b7c24108b4c241431db31d2VS1..|$..L$.1.1.
0x4031c70765787061c747046e642033c74708..expa.G.nd 3.G.
0x4041322d6279c7470c7465206b8a41018a192-by.G.te k.A...
⋯7 more rows

Direct i386 kill syscall wrapper 0x7fa5–0x8075

⋯3 more rows
0x7fd55bc35383ec088b5424108b4c241487d3[.S....T$..L$...
0x7fe5b825000000cd8087d389c33d00f0ffff.%.........=....
0x7ff5760ce875040000f7db891883cbff89d8v..u............
0x80055a595bc3575383ec1431c08b4c24248bZY[.WS...1..L$$.
⋯7 more rows

References own process status procfs path 0xf5fb–0xf8eb

⋯3 more rows
0xf62b6c6d6e6f707172737475767778797a00lmnopqrstuvwxyz.
0xf63b2f70726f632f25642f636d646c696e65/proc/%d/cmdline
0xf64b002f70726f632f2564002f70726f632f./proc/%d./proc/
0xf65b73656c660064697675732d6368656174self.divus-cheat
0xf66b732e636f6d002f70726f632f73656c66s.com./proc/self
0xf67b2f657865002f70726f632f637075696e/exe./proc/cpuin
0xf68b666f0063707520636f72657300000000fo.cpu cores....
0xf69b0300000000000102030405060708090a................
⋯3 more rows
0xf6db2f7573722f6c69622f002f7573722f6c/usr/lib/./usr/l
0xf6eb6f63616c2f002f6f70742f002f70726focal/./opt/./pro
0xf6fb632f6d6f756e747300252a7320253235c/mounts.%*s %25
0xf70b3573202536337300746d7066730072615s %63s.tmpfs.ra
0xf71b6d66730025732f2573002f657463002fmfs.%s/%s./etc./
0xf72b6574632f73797374656d642f73797374etc/systemd/syst
0xf73b656d0077005b556e69745d0a00446573em.w.[Unit]..Des
⋯3 more rows
0xf77b5b536572766963655d0a00547970653d[Service]..Type=
0xf78b73696d706c650a004578656353746172simple..ExecStar
0xf79b743d25730a00526573746172743d616ct=%s..Restart=al
0xf7ab776179730a0052657374617274536563ways..RestartSec
0xf7bb3d31300a0a005b496e7374616c6c5d0a=10...[Install].
0xf7cb0057616e74656442793d6d756c74692d.WantedBy=multi-
0xf7db757365722e7461726765740a000a2320user.target...# 
0xf7eb4175746f2d6164646564207365727669Auto-added servi
0xf7fb63650a00257320260a0063726f6e7461ce..%s &..cronta
0xf80b62202d6c20323e2f6465762f6e756c6cb -l 2>/dev/null
0xf81b002f6574632f696e69742e64002f6574./etc/init.d./et
0xf82b632f696e69742e642f25730023212f62c/init.d/%s.#!/b
0xf83b696e2f73680a0023232320424547494ein/sh..### BEGIN
0xf84b20494e495420494e464f0a0023205072 INIT INFO..# Pr
0xf85b6f76696465733a202020202020202020ovides:         
⋯3 more rows
0xf89b703a0a0023232320454e4420494e4954p:..### END INIT
0xf8ab20494e464f0a0a002f7661722f746d70 INFO.../var/tmp
0xf8bb002f6465762f73686d002f6574632f72./dev/shm./etc/r
0xf8cb632e6c6f63616c002f7573722f6c6f63c.local./usr/loc
0xf8db616c2f62696e002f7573722f6c6f6361al/bin./usr/loca
0xf8eb6c2f6c6962002f6f7074002f7661722fl/lib./opt./var/

English function-word token "for" 0xfefe–0xff8e

0xfefe2073797374656d00546f6f206d616e79 system.Too many
0xff0e206f70656e2066696c657300496e6170 open files.Inap
0xff1e70726f70726961746520696f63746c20propriate ioctl 
0xff2e666f7220646576696365005465787420for device.Text 
0xff3e66696c6520627573790046696c652074file busy.File t
⋯5 more rows

Connection scan status strings 0x106f7–0x107d7

⋯3 more rows
0x107273a2063616e6e6f742073706c69636500: cannot splice.
0x10737436f6e6e656374696f6e2074696d6564Connection timed
0x10747206f757400436f6e6e656374696f6e20 out.Connection 
0x107577265667573656400486f737420697320refused.Host is 
0x10767646f776e004e6f20726f75746520746fdown.No route to
⋯7 more rows