Suspicious ^80% Download

manji.i686

Mirai botnet persistence evasion

Unix ELF TracerPid debugger checkReferences a systemd ExecStart directive

SHA-2561de1203ad2e75e3c022df7e216e51613e3ccd1f6fe91d196759c2163a16b26e3

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeK(Li)O₃(AlDyP₄)H₆(CmCrDb₂F₈Os₆Po₃)Md₂(Bi₂He)Th

Evidence

ChaCha20/Salsa20 cipher constant 0x4ce0–0x4da0

⋯3 more rows
0x4d105756538b7c24108b4c24148b742418fcWVS.|$..L$..t$..
0x4d20c70765787061c747046e642033c74708..expa.G.nd 3.G.
0x4d30322d6279c7470c7465206b0fb641010f2-by.G.te k..A..
⋯7 more rows

Direct i386 kill syscall wrapper 0x9180–0x9250

⋯3 more rows
0x91b05bc35383ec088b5424108b4c241487d3[.S....T$..L$...
0x91c0b825000000cd8087d33d00f0ffff89c3.%.......=......
0x91d0760ce872040000f7db891883cbff5a89v..r..........Z.
0x91e0d8595bc35731c05383ec148b4c24248b.Y[.W1.S....L$$.
⋯7 more rows

References own process status procfs path 0x108bb–0x10bab

⋯3 more rows
0x108eb6c6d6e6f707172737475767778797a00lmnopqrstuvwxyz.
0x108fb2f70726f632f25642f636d646c696e65/proc/%d/cmdline
0x1090b002f70726f632f2564002f70726f632f./proc/%d./proc/
0x1091b73656c660064697675732d6368656174self.divus-cheat
0x1092b732e636f6d002f70726f632f73656c66s.com./proc/self
0x1093b2f657865002f70726f632f637075696e/exe./proc/cpuin
0x1094b666f0063707520636f72657300000000fo.cpu cores....
0x1095b0300000000000102030405060708090a................
⋯3 more rows
0x1099b2f7573722f6c69622f002f7573722f6c/usr/lib/./usr/l
0x109ab6f63616c2f002f6f70742f002f70726focal/./opt/./pro
0x109bb632f6d6f756e747300252a7320253235c/mounts.%*s %25
0x109cb3573202536337300746d7066730072615s %63s.tmpfs.ra
0x109db6d66730025732f2573002f657463002fmfs.%s/%s./etc./
0x109eb6574632f73797374656d642f73797374etc/systemd/syst
0x109fb656d0077005b556e69745d0a00446573em.w.[Unit]..Des
⋯3 more rows
0x10a3b5b536572766963655d0a00547970653d[Service]..Type=
0x10a4b73696d706c650a004578656353746172simple..ExecStar
0x10a5b743d25730a00526573746172743d616ct=%s..Restart=al
0x10a6b776179730a0052657374617274536563ways..RestartSec
0x10a7b3d31300a0a005b496e7374616c6c5d0a=10...[Install].
0x10a8b0057616e74656442793d6d756c74692d.WantedBy=multi-
0x10a9b757365722e7461726765740a000a2320user.target...# 
0x10aab4175746f2d6164646564207365727669Auto-added servi
0x10abb63650a00257320260a0063726f6e7461ce..%s &..cronta
0x10acb62202d6c20323e2f6465762f6e756c6cb -l 2>/dev/null
0x10adb002f6574632f696e69742e64002f6574./etc/init.d./et
0x10aeb632f696e69742e642f25730023212f62c/init.d/%s.#!/b
0x10afb696e2f73680a0023232320424547494ein/sh..### BEGIN
0x10b0b20494e495420494e464f0a0023205072 INIT INFO..# Pr
0x10b1b6f76696465733a202020202020202020ovides:         
⋯3 more rows
0x10b5b703a0a0023232320454e4420494e4954p:..### END INIT
0x10b6b20494e464f0a0a002f7661722f746d70 INFO.../var/tmp
0x10b7b002f6465762f73686d002f6574632f72./dev/shm./etc/r
0x10b8b632e6c6f63616c002f7573722f6c6f63c.local./usr/loc
0x10b9b616c2f62696e002f7573722f6c6f6361al/bin./usr/loca
0x10bab6c2f6c6962002f6f7074002f7661722fl/lib./opt./var/

References the /bin/sh shell path 0x10e84–0x11004

⋯6 more rows
0x10ee46d65006e6f6469726174696d65002c00me.nodiratime.,.
0x10ef42d63002f62696e2f7368000000000000-c./bin/sh......
0x10f0400000000000000000100000000000000................
0x10f1400000000286e696c2900286e756c6c29....(nil).(null)
0x10f24002b002d002000307800305800101010.+.-. .0x.0X....
0x10f34080a0a0a686c4c6a7a74715a00020408....hlLjztqZ....
0x10f440800000800000108001f0500000f0708................
0x10f5402000400010003000010050000000700................
0x10f6402000400010003000001070f10111213................
0x10f74156e7078586f75646966466545674761.npxXoudifFeEgGa
0x10f84414353637300202b302d232749000800ACScs. +0-#'I...
0x10f9405000300040001000002000000040008................
⋯7 more rows

Connection scan status strings 0x119b7–0x11a97

⋯3 more rows
0x119e73a2063616e6e6f742073706c69636500: cannot splice.
0x119f7436f6e6e656374696f6e2074696d6564Connection timed
0x11a07206f757400436f6e6e656374696f6e20 out.Connection 
0x11a177265667573656400486f737420697320refused.Host is 
0x11a27646f776e004e6f20726f75746520746fdown.No route to
⋯7 more rows