Hostile ^100% Download

manta.armv6l

Mirai botnet malware

Native ARM implant authors a self-respawning systemd unitNative ARM implant combines systemd persistence with shell staging

SHA-25642a687253a41984e499b93163cb334388be2b603758f652d6a772090af0e1b8b

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeK₃(AmLiMc₂)O₆(C₇P₆Er₆I₃La₂Dy)H₅(F₁₁Po₁₁Cm₂₄Db₂Os₈)Md₅(ArBi₃Bk₂In)

Evidence

ARM architecture from ELF header bytes 0x0–0x110

0x07f454c46010101000000000000000000.ELF............
0x1002002800010000005481000034000000..(.....T...4...
0x20b4ba0200020000043400200003002800........4. ...(.
⋯15 more rows

ARM direct read(2) syscall 0xdd98–0xdf28

⋯7 more rows
0xde080000e0e38040bde81eff2fe180402de9.....@..../..@-.
0xde180370a0e3000000ef010a70e30070a0e1.p........p..p..
0xde280000a0910300009a130200eb003067e2.............0g.
0xde38003080e50000e0e38040bde81eff2fe1.0.......@..../.
0xde4880402de9a070a0e3000000ef010a70e3[email protected].
0xde580070a0e10000a0910300009a060200eb.p..............
0xde68003067e2003080e50000e0e38040bde8.0g..0.......@..
0xde781eff2fe180402de92570a0e3000000ef../..@-.%p......
0xde88010a70e30070a0e10300009afa0100eb..p..p..........
0xde98003067e2003080e50070e0e30700a0e1.0g..0...p......
0xdea88040bde81eff2fe180402de94e70a0e3.@..../[email protected]..
⋯8 more rows

ARM direct write(2) syscall 0xdf40–0xe0d0

⋯7 more rows
0xdfb08040bde80cd08de21eff2fe180402de9.@......../..@-.
0xdfc00470a0e3000000ef010a70e30070a0e1.p........p..p..
0xdfd00000a0910300009aa90100eb003067e2.............0g.
0xdfe0003080e50000e0e38040bde81eff2fe1.0.......@..../.
⋯15 more rows

References the XMRig product name 0x20ba4–0x20e94

⋯5 more rows
0x20bf42e2f6d616e74612e636f6e6600000000./manta.conf....
0x20c042f746d702f2e6d616e74612e636f6e66/tmp/.manta.conf
0x20c14000000002f6574632f6d616e74612e63..../etc/manta.c
0x20c246f6e66002f7661722f72756e2f2e6d61onf./var/run/.ma
0x20c346e74612e636f6e66000000002f646576nta.conf..../dev
0x20c442f73686d2f2e6d616e74612e636f6e66/shm/.manta.conf
0x20c5400000000f48b0200048c0200188c0200................
0x20c64288c0200408c0200000000002f70726f(...@......./pro
0x20c74632f73656c662f6f6f6d5f73636f7265c/self/oom_score
0x20c845f61646a00000000770000002d313030_adj....w...-100
0x20c9430000000696e6974000000006d6972610...init....mira
0x20ca4690000002f70726f630000002f70726fi.../proc.../pro
0x20cb4632f25642f636f6d6d00000073797374c/%d/comm...syst
0x20cc4656d64006b7468726561646400000000emd.kthreadd....
0x20cd46b736f6674697271640000006b776f72ksoftirqd...kwor
0x20ce46b657200737368640000000064726f70ker.sshd....drop
0x20cf4626561720000000074656c6e65746400bear....telnetd.
⋯5 more rows
0x20d547379736c6f676400646275732d646165syslogd.dbus-dae
0x20d646d6f6e006d697261692e783836000000mon.mirai.x86...
0x20d746d697261692e61726d0000006d697261mirai.arm...mira
0x20d84692e6d69707300007473756e616d6900i.mips..tsunami.
0x20d946b616974656e000071626f7400000000kaiten..qbot....
0x20da46761666779740000626173686c697465gafgyt..bashlite
0x20db4000000006d6f626f74000000786d7269....mobot...xmri
0x20dc4670000006d6f6e65726f64006b646576g...monerod.kdev
0x20dd4746d7066736900006b696e73696e6700tmpfsi..kinsing.
0x20de46d696e65726400006370756d696e6572minerd..cpuminer
0x20df400000000626f61746e657400736f6674....boatnet.soft
0x20e04626f74006563686f626f7400736f7261bot.echobot.sora
0x20e14000000006f776172690000006d6f7a69....owari...mozi
0x20e2400000000636f6e64690000006b656b73....condi...keks
⋯7 more rows

Python executes fetched urllib response 0x210b4–0x213a4

⋯5 more rows
0x211046f74616c3a0000004d656d546f74616cotal:...MemTotal
0x211143a20256c6c750000257500005b6b776f: %llu..%u..[kwo
0x21124726b65722f303a305d0000005b6b776frker/0:0]...[kwo
0x21134726b65722f313a305d0000006b736f66rker/1:0]...ksof
0x2114474697271642f30005b6b737761706430tirqd/0.[kswapd0
0x211545d00000073797374656d642d6a6f7572]...systemd-jour
0x211646e616c00209102003091020040910200nal. ...0...@...
0x21174c88c02004c9102005891020003000000....L...X.......
0x21184000000002f70726f632f73656c662f65..../proc/self/e
0x21194786500002f6574632f72632e6c6f6361xe../etc/rc.loca
0x211a46c0000000a282f746d702f2e6d616e74l....(/tmp/.mant
0x211b461203e2f6465762f6e756c6c20323e26a >/dev/null 2>&
0x211c4312026290a0000002f6574632f63726f1 &)..../etc/cro
0x211d46e2e642f6d616e746100000040726562n.d/manta...@reb
0x211e46f6f7420726f6f74202f746d702f2e6doot root /tmp/.m
0x211f4616e74610a2a2f3330202a202a202a20anta.*/30 * * * 
0x212042a20726f6f74202f746d702f2e6d616e* root /tmp/.man
0x2121474610a002f6574632f696e69742e642fta../etc/init.d/
0x212246d616e746100000023212f62696e2f73manta...#!/bin/s
0x21234680a63617365202224312220696e2073h.case "$1" in s
0x212447461727429202f746d702f2e6d616e74tart) /tmp/.mant
0x21254612026203b3b20657361630a00000000a & ;; esac.....
0x212642f6574632f726325642e642f5339396d/etc/rc%d.d/S99m
0x21274616e7461000000002f6574632f737973anta..../etc/sys
0x2128474656d642f73797374656d2f6d616e74temd/system/mant
0x21294612e736572766963650000005b556e69a.service...[Uni
0x212a4745d0a4465736372697074696f6e3d73t].Description=s
0x212b4797374656d0a41667465723d6e657477ystem.After=netw
0x212c46f726b2e7461726765740a0a5b536572ork.target..[Ser
0x212d4766963655d0a547970653d73696d706cvice].Type=simpl
0x212e4650a4578656353746172743d2f746d70e.ExecStart=/tmp
0x212f42f2e6d616e74610a526573746172743d/.manta.Restart=
0x21304616c776179730a526573746172745365always.RestartSe
0x21314633d31300a0a5b496e7374616c6c5d0ac=10..[Install].
0x2132457616e74656442793d6d756c74692d75WantedBy=multi-u
0x213347365722e7461726765740a0073797374ser.target..syst
0x21344656d63746c206461656d6f6e2d72656cemctl daemon-rel
0x213546f616420323e2f6465762f6e756c6c3boad 2>/dev/null;
0x213642073797374656d63746c20656e61626c systemctl enabl
0x2137465206d616e74612e7365727669636520e manta.service 
0x21384323e2f6465762f6e756c6c3b207379732>/dev/null; sys
0x2139474656d63746c207374617274206d616etemctl start man
0x213a474612e7365727669636520323e2f6465ta.service 2>/de