Suspicious ^80% Download

manji.spc

Multi-vector persistence and evasion

Unix ELF TracerPid debugger checkReferences a systemd ExecStart directive

SHA-25640406026725734c077491b6363731b4cd1189a158259674091759c96b9a60fa4

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeK(Li)O₄(AlAsDyP₄)H₅(Cm₂Db₂F₈Os₆Po₂)Md₃(ArBiHe)

Evidence

SPARC machine field in ELF header 0x0–0x2f0

0x07f454c46010201000000000000000000.ELF............
0x100002000200000001000101a400000034...............4
0x2000017304000000000034002000030028..s......4. ...(
⋯45 more rows

ARM literal pool contains send syscall number 0x5a07–0x5ac7

⋯3 more rows
0x5a373990100010400008e7010000004000099....@.......@..
0x5a4721010000004000089501000000912a20!....@........* 
0x5a571880a220001280006e01000000400006... ....n....@..
⋯7 more rows

Process cmdline path format 0x13f90–0x140d0

⋯3 more rows
0x13fc07172737475767778797a000000000000qrstuvwxyz......
0x13fd02f70726f632f25642f636d646c696e65/proc/%d/cmdline
0x13fe000000000000000002f70726f632f2564......../proc/%d
0x13ff000000000000000002f70726f632f7365......../proc/se
0x140006c6600000000000064697675732d6368lf......divus-ch
0x14010656174732e636f6d0000000000000000eats.com........
0x140200a000000000000002f70726f632f7365......../proc/se
0x140306c662f65786500002f70726f632f6370lf/exe../proc/cp
0x1404075696e666f0000007200000000000000uinfo...r.......
0x1405063707520636f72657300000000000000cpu cores.......
0x1406000000003000000000001020304050607................
⋯7 more rows

References own process status procfs path 0x140e8–0x143d8

⋯3 more rows
0x14118616c2f00000000002f6f70742f000000al/...../opt/...
0x141282f70726f632f6d6f756e747300000000/proc/mounts....
0x14138252a7320253235357320253633730000%*s %255s %63s..
0x14148746d70667300000072616d6673000000tmpfs...ramfs...
0x1415825732f25730000002f65746300000000%s/%s.../etc....
0x141682f6574632f73797374656d642f737973/etc/systemd/sys
0x1417874656d00000000002f6574632f737973tem...../etc/sys
0x1418874656d642f73797374656d2f25732e73temd/system/%s.s
0x1419865727669636500007700000000000000ervice..w.......
⋯5 more rows
0x141f8547970653d73696d706c650a00000000Type=simple.....
0x142084578656353746172743d25730a000000ExecStart=%s....
0x14218526573746172743d616c776179730a00Restart=always..
0x14228526573746172745365633d31300a0a00RestartSec=10...
0x142385b496e7374616c6c5d0a000000000000[Install].......
0x1424857616e74656442793d6d756c74692d75WantedBy=multi-u
0x142587365722e7461726765740a0000000000ser.target......
0x1426873797374656d63746c20656e61626c65systemctl enable
0x142782025732e73657276696365203e2f6465 %s.service >/de
⋯3 more rows
0x142b872766963650a0000257320260a000000rvice...%s &....
0x142c863726f6e746162202d6c20323e2f6465crontab -l 2>/de
0x142d8762f6e756c6c00002863726f6e746162v/null..(crontab
0x142e8202d6c20323e2f6465762f6e756c6c3b -l 2>/dev/null;
0x142f8206563686f2027407265626f6f742025 echo '@reboot %
0x143087320262729207c2063726f6e74616220s &') | crontab 
0x143182d000000000000002f6574632f696e69-......./etc/ini
0x14328742e6400000000002f6574632f696e69t.d...../etc/ini
0x14338742e642f2573000023212f62696e2f73t.d/%s..#!/bin/s
0x14348680a0000000000002323232042454749h.......### BEGI
0x143584e20494e495420494e464f0a00000000N INIT INFO.....
0x14368232050726f76696465733a2020202020# Provides:     
⋯7 more rows

References the /bin/sh shell path 0x146f0–0x14930

⋯8 more rows
0x147706d650000000000002c00000000000000me......,.......
0x147802f62696e2f7368002d63000000000000/bin/sh.-c......
0x1479000000000000000000000000100000000................
0x147a00000000000000000286e696c29000000........(nil)...
0x147b0286e756c6c2900002b002d0020003078(null)..+.-. .0x
0x147c00030580000000000101010080a0a0a00.0X.............
0x147d0686c4c6a7a74715a0002040808000008hlLjztqZ........
0x147e0000001081f0000050f00080700020004................
0x147f000010003100000050000000700020004................
0x1480000010003000000000001070f10111213................
0x1481015000000000000006e7078586f756469........npxXoudi
0x1482066466545674761414353637300000000fFeEgGaACScs....
0x14830202b302d232749000008000500030004 +0-#'I.........
⋯16 more rows