Hostile ^100% Download

49cf9dbaef457a2cba724ed3fc3bed08951103a363dc819dda896ebb4b89ed23

Prometei botnet configuration

Encrypted parent-relay bot configurationPrometei packed Linux bot

SHA-25649cf9dbaef457a2cba724ed3fc3bed08951103a363dc819dda896ebb4b89ed23

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeK(Mc)O₃(As₂CAl)H₃(Cm₂FOs)Md₃(Bi₄BkHe)Th

Evidence

ELF64 header omits section table 0x0–0x1f0

0x07f454c46020101000000000000000000.ELF............
0x1002003e000100000050b65e0100000000..>.....P.^.....
0x2040000000000000000000000000000000@...............
0x3000000000400038000300000000000000[email protected].........
0x4001000000060000000000000000000000................
0x5000004000000000000000400000000000..@.......@.....
⋯7 more rows
0xd000000000000000000000000000000000................
0xe0100000000000000056fc093955505821........V..9UPX!
0xf0fc0a0e1600000000b0a9130051041000............Q...
0x10070020000be00000008000000bbfb20ffp............. .
⋯15 more rows

Contains a /tmp/ or /var/tmp/ path 0x5af0f–0x5af9f

0x5af0fffbe90eb6c50a4f7a3f95ff50ffcbef2....lP...._.....
0x5af1f7871c61ecccf6a0072de4861736850ffxq....j.r.HashP.
0x5af2f7fd1ff6f77657250726f6a6563c06100...owerProjec.a.
0x5af3f2f746d702f64656275672e74786fdf9a/tmp/debug.txo..
0x5af4f6d200d0a4e26703c632f7374611e252am ..N&p<c/sta.%*
⋯5 more rows

ELF embeds a cleartext http:// URL 0x6c75e–0x6c96e

⋯3 more rows
0x6c78e89395b5dc3681e0000005ae81e000000.9[].h....Z.....
0x6c79e50524f545f455845437c50524f545f57PROT_EXEC|PROT_W
0x6c7ae52495445206661696c65642e0a005e6aRITE failed...^j
0x6c7be025f6a01580f056a7f5f6a3c580f050a._j.X..j._j<X...
0x6c7ce0024496e666f3a20546869732066696c.$Info: This fil
0x6c7de65206973207061636b65642077697468e is packed with
0x6c7ee20746865205550582065786563757461 the UPX executa
0x6c7fe626c65207061636b657220687474703able packer http:
0x6c80e2f2f7570782e73662e6e657420240a00//upx.sf.net $..
0x6c81e2449643a2055505820342e323420436f$Id: UPX 4.24 Co
0x6c82e70797269676874202843292031393936pyright (C) 1996
⋯6 more rows
0x6c89e514d29c94183c8ff6a22415a525e6a03QM).A...j"AZR^j.
0x6c8ae5a29ff6a09580f054889442410505a53Z).j.X..H.D$.PZS
0x6c8be5ead504889e14989d5ad50ad41904889^.PH..I...P.A.H.
0x6c8cef75effd559488b742418488b7c24106a.^..YH.t$.H.|$.j
0x6c8de055a6a0a580f0541ffe55de87effffff.Zj.X..A..].~...
0x6c8ee2f70726f632f73656c662f6578650000/proc/self/exe..
0x6c8fe0100002d0c00003008000008000000ff...-...0........
⋯7 more rows

Prometei Linux bot configuration 0x6d871–0x6da31

⋯7 more rows
0x6d8e1d80600b0a91300492a004cf40000007b.......I*.L....{
0x6d8f122636f6e666967223a312c226964223a"config":1,"id":
0x6d901223165657972373434754530484e7844"1eeyr744uE0HNxD
0x6d9117a222c22656e636b6579223a22706270z","enckey":"pbp
0x6d92176457557725a66442b793071554e6f43vEuWrZfD+y0qUNoC
0x6d9314c6b685447726b66787870794c516667LkhTGrkfxxpyLQfg
0x6d94178563146312b6d7747326d345a557531xV1F1+mwG2m4ZUu1
0x6d95136434b3355684b3543643539394364576CK3UhK5Cd599CdW
0x6d961336971444f656979463436306a546d373iqDOeiyF460jTm7
0x6d97155594d6a316c6d394f6d337370656d77UYMj1lm9Om3spemw
⋯3 more rows
0x6d9b135386a56305a4c4439344f4777494b3758jV0ZLD94OGwIK7
0x6d9c14a6c736d356e4b553d222c2250617265Jlsm5nKU=","Pare
0x6d9d16e744964223a22383036384545395850ntId":"8068EE9XP
0x6d9e1584d38583331574856222c226970223aXM8X31WHV","ip":
0x6d9f12234352e35352e3132312e313731222c"45.55.121.171",
0x6da0122506172656e744970223a223138312e"ParentIp":"181.
0x6da1134332e3131312e323238222c2250617243.111.228","Par
0x6da21656e74486f73746e616d65223a224a41entHostname":"JA
0x6da315252494147414441227d2c          RRIAGADA"},     