Suspicious ^80% Download

4dc0e0f94782e10be52142c441da7e9fec97ce06fcabbf3b99d21a5e25ad903a

C2, persistence, DHT, evasion

Malformed ELF header or section headers: section header table extends past end of fileNameless static ELF pins an external address

SHA-2564dc0e0f94782e10be52142c441da7e9fec97ce06fcabbf3b99d21a5e25ad903a

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeO₃(As₂P₃C)H₆(Cm₁₃Db₃F₃Os₂PoU₄)Md₄(ArBi₄BkHe)

Evidence

ARM architecture from ELF header bytes 0x0–0x90

0x07f454c46010101000000000000000000.ELF............
0x1002002800010000009481000034000000..(.........4...
0x2050b00400020000043400200005002800P.......4. ...(.
⋯7 more rows

_main program entry symbol 0x200a8–0x20168

⋯3 more rows
0x200d8faffff3a020151e3000051318110a031...:..Q...Q1...1
0x200e88330a031faffff3a0020a0e3010050e1.0.1...:. ....P.
0x200f80100402003208221a10050e1a1004020..@ . .!..P...@ 
⋯7 more rows

HTTP protocol version strings 0x34b68–0x34c38

⋯3 more rows
0x34b98504f5354202f63646e2d6367692f0000POST /cdn-cgi/..
0x34ba820485454502f312e310d0a557365722d HTTP/1.1..User-
0x34bb84167656e743a20000d0a486f73743a20Agent: ...Host: 
⋯8 more rows

Native S-number init script 0x35408–0x35688

⋯3 more rows
0x354382e736800257325732573257300000000.sh.%s%s%s%s....
0x3544823212f62696e2f73680000002f6d6e74#!/bin/sh.../mnt
0x354582f6a666673322f776966692e73680000/jffs2/wifi.sh..
⋯4 more rows
0x354a800000000727700002f6465762f000000....rw../dev/...
0x354b86d74640077620000726200002f62696emtd.wb..rb../bin
0x354c82f7368002f62696e2f62617368000000/sh./bin/bash...
0x354d82f6574632f72632e642f00002f657463/etc/rc.d/../etc
0x354e82f7263532e642f002573257325732573/rcS.d/.%s%s%s%s
0x354f825730000232100002f6574632f696e69%s..#!../etc/ini
0x35508742e642f533935626162792e73680000t.d/S95baby.sh..
0x3551869707461626c6573202d4920494e5055iptables -I INPU
⋯12 more rows
0x355e8524f50002f7573722f6c6f63616c2f63ROP./usr/local/c
0x355f874000000726d202f686f6d652f687474t...rm /home/htt
0x3560870642f7765625f7368656c6c5f636d64pd/web_shell_cmd
0x356182e676368000000006563686f2033203e.gch....echo 3 >
⋯7 more rows

Pinned external IPv4 host literal in binary 0x35d18–0x35fc8

0x35d186174202d7020756470202d2d73706f72at -p udp --spor
0x35d2874202564202d6a204143434550540000t %d -j ACCEPT..
0x35d38302e302e302e30005b6964705d0000000.0.0.0.[idp]...
0x35d4854686973206e6f646520646f65736e27This node doesn'
0x35d58742061636365707420616e6e6f756e63t accept announc
⋯6 more rows
0x35dc861636b65722e64656269616e2e6f7267acker.debian.org
0x35dd83a363838310000003231322e3132392e:6881...212.129.
0x35de833332e35393a36383831000038322e3233.59:6881..82.2
0x35df832312e3130332e3234343a363838310021.103.244:6881.
0x35e083133302e3233392e31382e3135393a36130.239.18.159:6
0x35e183838310038372e39382e3136322e3838881.87.98.162.88
0x35e283a36383831004e665a8f80c8ac238dac:6881.NfZ....#..
0x35e384706d54f6f7e4d6ec63bf08c8faa85e7G..Oo~Mn.;......
⋯11 more rows
0x35ef866756e6374696f6e2054696d656f7574function Timeout
0x35f082829207b20646f63756d656e742e6c6f() { document.lo
0x35f18636174696f6e2e68726566203d20646fcation.href = do
0x35f2863756d656e742e55524c202b20287e64cument.URL + (~d
⋯10 more rows