Hostile ^100% Download

aurora.sh4

Mirai botnet malware

Detects ELF malware Mirai relatedDetects Mirai Botnet Malware

SHA-2562ef818af2a9b1ae9990c10f919480c58c875b6ab8736a1c54e34557b259339d9

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeK₂(Mc₃Te)O₄(ErILa₂As)H₃(Cm₄F₃Po)Md₅(ArBi₃BkHe)Th₂

Evidence

SuperH machine field in ELF header 0x0–0x90

0x07f454c46010101000000000000000000.ELF............
0x1002002a0001000000a001400034000000..*[email protected]...
0x201cd40000090000003400200003002800........4. ...(.
⋯7 more rows

BusyBox invoked with bot marker name 0xc6a4–0xc994

⋯7 more rows
0xc714cc39ffffe36f264ff66e0b00f66c0900.9...o&O.n...l..
0xc724504f5354202f63646e2d6367692f0000POST /cdn-cgi/..
0xc73420485454502f312e310d0a557365722d HTTP/1.1..User-
0xc7444167656e743a20000d0a486f73743a20Agent: ...Host: 
⋯4 more rows
0xc79400000000504f53540000000027000000....POST....'...
0xc7a43d0000002f70726f632f6e65742f7463=.../proc/net/tc
0xc7b4700000002f6465762f7761746368646fp.../dev/watchdo
0xc7c4670000002f6465762f6d6973632f7761g.../dev/misc/wa
0xc7d4746368646f6700000a00000000000001tchdog..........
0xc7e4000000002f2e007664004872006c6500..../..vd.Hr.le.
0xc7f465700000720000006162636465666768ep..r...abcdefgh
0xc804696a6b6c6d6e6f707172737475767730ijklmnopqrstuvw0
0xc8143132333435363738000000005243515112345678....RCQQ
0xc824554d5046000000001310111617000000UMPF............
⋯5 more rows
0xc8845043564d500000004f474b4c514f0000PCVMP...OGKLQO..
0xc894514750544b4147005157524750544b51QGPTKAG.QWRGPTKQ
0xc8a44d500000455747515600000043464f4bMP..EWGQV...CFOK
0xc8b44c13000043464f4b4c4b51565043564dL...CFOKLKQVPCVM
0xc8c45000000057404c5600000000494e5413[email protected].
0xc8d41011160078564717101300004a4b1117....xVG.....JK..
0xc8e4131a00004854405846000000434c494d[email protected]
0xc8f400000000584e5a5a0c0000001557486f....XNZZ.....WHo
0xc904494d12544b585a54000000001557486fIM.TKXZT.....WHo
0xc914494d1243464f4b4c00000000515b5156IM.CFOKL....Q[QV
0xc924474f00004b4955400000000046504743[email protected]
⋯7 more rows

XOR-decoded macOS Safari User-Agent 0xccd7–0xcfc7

⋯3 more rows
0xcd075447501802414e4d5746444e4350470fTGP..ANMWFDNCPG.
0xcd174c454b4c5a220000006f4d584b4e4e43LEKLZ"...oMXKNNC
0xcd270d170c12020a754b4c464d5551026c76......uKLFMUQ.lv
0xcd370213120c121902756d7514160b026352.......umu....cR
0xcd47524e47754740694b560d1711150c1114RNGuG@iKV.......
0xcd57020a696a766f6e0e024e4b4947026547..ijvon..NKIG.eG
0xcd6741494d0b02614a504d4f470d17130c12AIM..aJPMOG.....
0xcd770c101512160c1312110271434443504b..........qCDCPK
0xcd870d1711150c111422006f4d584b4e4e43.......".oMXKNNC
0xcd970d170c12020a754b4c464d5551026c76......uKLFMUQ.lv
0xcda70213120c121902756d7514160b026352.......umu....cR
0xcdb7524e47754740694b560d1711150c1114RNGuG@iKV.......
0xcdc7020a696a766f6e0e024e4b4947026547..ijvon..NKIG.eG
0xcdd741494d0b02614a504d4f470d17100c12AIM..aJPMOG.....
0xcde70c101516110c1313140271434443504b..........qCDCPK
0xcdf70d1711150c111422006f4d584b4e4e43.......".oMXKNNC
0xce070d170c12020a754b4c464d5551026c76......uKLFMUQ.lv
0xce1702140c131902756d7514160b02635252......umu....cRR
0xce274e47754740694b560d1711150c111402NGuG@iKV........
0xce370a696a766f6e0e024e4b494702654741.ijvon..NKIG.eGA
0xce47494d0b02614a504d4f470d17130c120cIM..aJPMOG......
0xce57101512160c1312110271434443504b0d.........qCDCPK.
0xce671711150c11142200006f4d584b4e4e43......"..oMXKNNC
0xce770d170c12020a754b4c464d5551026c76......uKLFMUQ.lv
0xce8702140c131902756d7514160b02635252......umu....cRR
0xce974e47754740694b560d1711150c111402NGuG@iKV........
0xcea70a696a766f6e0e024e4b494702654741.ijvon..NKIG.eGA
0xceb7494d0b02614a504d4f470d17100c120cIM..aJPMOG......
0xcec7101516110c1313140271434443504b0d.........qCDCPK.
0xced71711150c11142200006f4d584b4e4e43......"..oMXKNNC
0xcee70d170c12020a6f43414b4c564d514a19......oCAKLVMQJ.
0xcef7026b4c56474e026f4341026d71027a02.kLVGN.oCA.mq.z.
0xcf0713127d13137d140b026352524e477547..}..}...cRRNGuG
0xcf1740694b560d1412130c150c15020a696a@iKV..........ij
0xcf27766f6e0e024e4b494702654741494d0bvon..NKIG.eGAIM.
0xcf3702744750514b4d4c0d1b0c130c100271.tGPQKML.......q
0xcf47434443504b0d1412130c150c15220000CDCPK........"..
0xcf57002f6465762f6e756c6c000000000000./dev/null......
⋯7 more rows