Hostile ^100% Download

6

Crypto miner with C2 and persistence

MIPS pinned-host C2 with TCP inspectionSelf-locating MIPS shell implant with systemd persistence

SHA-2561c901701ce83b6eac3570ec169d85ae3334df1e4878b359040e1cd9987e2fb68

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeK(Mc)O₅(C₄P₄AsEr₃Dy₂)H₆(F₉Cm₁₁CrDbOs₅Po₅)Md₄(Bi₄BkHe)

Evidence

Little-endian MIPS syscall instruction 0x2e0–0x560

⋯15 more rows
0x3d01c00a5271c00a2af2530000010000724...'....%0.....$
0x3e0631002240c00000080b0428e01000324c..$......B....$
0x3f030004314000000000400028e80b040ae0.C...........@.
⋯23 more rows

Little-endian MIPS open/create flags 0xbbc–0xd3c

⋯7 more rows
0xc2c840040104800bc8f5880998fa4010624[email protected]......$
0xc3c0103052409f82003252040024800bc8f...$.. .% @.H...
0xc4c7c00400425904000c00005245f1f100c|.@.%.@....$_...
⋯15 more rows

Little-endian MIPS direct connect syscall 0x3cb14–0x3cbe4

⋯3 more rows
0x3cb443be8037c208b628c10004014cc86998f;..| .b...@.....
0x3cb544a1002240c0000000a00e01400000000J..$............
0x3cb6401f0432c26006010232002002c00bf8f..C,&.`.# ..,...
0x3cb742800b28f2400b18f2000b08f0800e003(...$... .......
⋯7 more rows

Little-endian MIPS direct socket syscall 0x3d5e8–0x3d6b8

⋯3 more rows
0x3d618000000000a001c3ca4009c2721e09903.......<...'!...
0x3d628571002240c000000f7ffe01400000000W..$............
0x3d6380800e003000000000000000000000000................
0x3d64800000000000000000a001c3c70009c27...........<p..'
⋯7 more rows

Bare ExecStart= with empty value 0xa7df4–0xa80e4

⋯6 more rows
0xa7e54000000002f7661722f746d7000000000..../var/tmp....
0xa7e642f70726f632f6e65742f756e69780000/proc/net/unix..
0xa7e742f746d702f2e582d6c6f636b00000000/tmp/.X-lock....
0xa7e842f70726f632f73656c6600006578616d/proc/self..exam
⋯5 more rows
0xa7ee42f73686d2f0000002f7661722f746d70/shm/.../var/tmp
0xa7ef42f0000002f646174612f00002f737461/.../data/../sta
0xa7f04740000002f636d646c696e6500000000t.../cmdline....
0xa7f14786d7269670000007374726174756d00xmrig...stratum.
0xa7f246d696e65726400006b646576746d7066minerd..kdevtmpf
0xa7f34736900006b696e73696e67006370756dsi..kinsing.cpum
0xa7f44696e6572000000007379737276000000iner....sysrv...
0xa7f542e7570645f0000006b776f726b657200.upd_...kworker.
0xa7f646b736f66746972716400000065787434ksoftirqd...ext4
0xa7f74000000006a626432000000006b737761....jbd2....kswa
0xa7f84706400007761746368646f6700000000pd..watchdog....
0xa7f946d6967726174696f6e0000006b626c6fmigration...kblo
0xa7fa4636b640062696f736574000020286465ckd.bioset.. (de
0xa7fb46c657465642900002e6d696772617469leted)...migrati
0xa7fc46f6e00002f7573722f6c69622f737973on../usr/lib/sys
0xa7fd474656d64000000002f7362696e2f7270temd..../sbin/rp
0xa7fe46362696e640000002f7573722f736269cbind.../usr/sbi
0xa7ff46e2f63726f6e00002f70726f632f6e65n/cron../proc/ne
0xa8004742f7463700000002f70726f632f6e65t/tcp.../proc/ne
0xa8014742f7463703600002f6574632f63726ft/tcp6../etc/cro
0xa80246e2e64002f6574632f63726f6e2e642fn.d./etc/cron.d/
0xa8034000000002f6574632f72632e6c6f6361..../etc/rc.loca
0xa80446c000000626f61746e65742d756e6974l...boatnet-unit
0xa80542d7632002f2e00002f2e2e002f657463-v2./.../.../etc
0xa80642f73797374656d642f73797374656d2f/systemd/system/
0xa8074000000002e6f7269670000002f766172.....orig.../var
0xa80842f63616368652f2e7570645f626f6174/cache/.upd_boat
0xa8094000000002d2d73656c662d636865636b....--self-check
0xa80a4000000002f70726f632f73656c662f6f..../proc/self/o
0xa80b46f6d5f73636f72655f61646a00000000om_score_adj....
0xa80c42d313030300000002f70726f632f7365-1000.../proc/se
0xa80d46c662f6f6f6d5f61646a00002d313700lf/oom_adj..-17.
0xa80e42f6465762f7761746368646f67000000/dev/watchdog...