Suspicious ^80% Download

manji.ppc

Persistence, evasion, network C2

Unix ELF TracerPid debugger checkReferences a systemd ExecStart directive

SHA-2565225d02fc4b6a0d7d9e0cf638f751cf200931df18bd617a99e7947192c8ab6fc

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeK(Li)O₃(AlDyP₄)H₅(Cm₂Db₂F₈Os₆Po₂)Md₂(Bi₂He)

Evidence

PowerPC socketcall connect operation wrapper 0xc898–0xc9f8

⋯3 more rows
0xc8c84e8000209421ffe07c0802a690610008N.. .!..|....a..
0xc8d8386000039081000c38810008900100248`......8......$
0xc8e890a1001048001fdd8001002438210020....H......$8!. 
⋯7 more rows
0xc9687c0803a64e8000209421ffe07c0802a6|...N.. .!..|...
0xc978906100083860000a9081000c38810008.a..8`......8...
0xc9889001002490a1001090c1001448001f35...$........H..5
⋯7 more rows

PowerPC socketcall socket operation wrapper 0xca68–0xcb28

⋯3 more rows
0xca984e8000209421ffe07c0802a690610008N.. .!..|....a..
0xcaa8386000019081000c38810008900100248`......8......$
0xcab890a1001048001e0d8001002438210020....H......$8!. 
⋯7 more rows

PowerPC Linux socketcall syscall wrapper 0xe898–0xe968

⋯3 more rows
0xe8c87c0802a69421fff093e1000c90010014|....!..........
0xe8d838000066440000027c000026740910008..fD...|..&t...
0xe8e87c7f1b7841a200104bffaae993e30000|..xA...K.......
0xe8f83860ffff8001001483e1000c382100108`..........8!..
⋯7 more rows

Embedded shell echo stage marker 0x127ac–0x12a9c

⋯3 more rows
0x127dc6d6e6f707172737475767778797a0000mnopqrstuvwxyz..
0x127ec2f70726f632f25642f636d646c696e65/proc/%d/cmdline
0x127fc000000002f70726f632f256400000000..../proc/%d....
0x1280c2f70726f632f73656c66000064697675/proc/self..divu
0x1281c732d6368656174732e636f6d00000000s-cheats.com....
0x1282c2f70726f632f73656c662f6578650000/proc/self/exe..
0x1283c2f70726f632f637075696e666f000000/proc/cpuinfo...
0x1284c7200000063707520636f726573000000r...cpu cores...
0x1285c00000003000000000001020304050607................
⋯4 more rows
0x128ac2f0000002f7573722f6c6f63616c2f00/.../usr/local/.
0x128bc2f6f70742f0000002f70726f632f6d6f/opt/.../proc/mo
0x128cc756e747300000000252a732025323535unts....%*s %255
0x128dc7320253633730000746d706673000000s %63s..tmpfs...
0x128ec72616d667300000025732f2573000000ramfs...%s/%s...
0x128fc2f657463000000002f6574632f737973/etc..../etc/sys
0x1290c74656d642f73797374656d002f657463temd/system./etc
0x1291c2f73797374656d642f73797374656d2f/systemd/system/
0x1292c25732e73657276696365000077000000%s.service..w...
⋯4 more rows
0x1297c766963655d0a0000547970653d73696dvice]...Type=sim
0x1298c706c650a000000004578656353746172ple.....ExecStar
0x1299c743d25730a000000526573746172743dt=%s....Restart=
0x129ac616c776179730a005265737461727453always..RestartS
0x129bc65633d31300a0a005b496e7374616c6cec=10...[Install
0x129cc5d0a000057616e74656442793d6d756c]...WantedBy=mul
0x129dc74692d757365722e7461726765740a00ti-user.target..
0x129ec73797374656d63746c20656e61626c65systemctl enable
0x129fc2025732e73657276696365203e2f6465 %s.service >/de
0x12a0c762f6e756c6c20323e2631207c7c2074v/null 2>&1 || t
0x12a1c72756500610000000a23204175746f2drue.a....# Auto-
0x12a2c616464656420736572766963650a0000added service...
0x12a3c257320260a00000063726f6e74616220%s &....crontab 
0x12a4c2d6c20323e2f6465762f6e756c6c0000-l 2>/dev/null..
0x12a5c2863726f6e746162202d6c20323e2f64(crontab -l 2>/d
0x12a6c65762f6e756c6c3b206563686f202740ev/null; echo '@
0x12a7c7265626f6f7420257320262729207c20reboot %s &') | 
0x12a8c63726f6e746162202d0000002f657463crontab -.../etc
0x12a9c2f696e69742e64002f6574632f696e69/init.d./etc/ini

References own process status procfs path 0x12b5c–0x12dec

⋯3 more rows
0x12b8c5758595a303132333435363738390000WXYZ0123456789..
0x12b9c2f6574632f72632e6c6f63616c000000/etc/rc.local...
0x12bac2f7661722f746d70000000002f646576/var/tmp..../dev
0x12bbc2f73686d000000002f7573722f6c6f63/shm..../usr/loc
⋯6 more rows
0x12c2c10012bd410012be410012bec10012bf8..+...+...+...+.
0x12c3c10012c0410012bf010012c102f70726f..,...+...,./pro
0x12c4c632f73656c662f737461747573000000c/self/status...
0x12c5c5472616365725069643a00004c445f50TracerPid:..LD_P
0x12c6c52454c4f414400004c445f4155444954RELOAD..LD_AUDIT
⋯7 more rows
0x12cec2f73686d2f0000006874747064000000/shm/...httpd...
0x12cfc6e67696e780000006170616368650000nginx...apache..
0x12d0c6c696768747470640000000073736864lighttpd....sshd
0x12d1c0000000074656c6e65746400626f6100....telnetd.boa.
0x12d2c75687474706400006d696e695f687474uhttpd..mini_htt
0x12d3c7064000064726f706265617200000000pd..dropbear....
0x12d4c73797374656d64006b74687265616464systemd.kthreadd
0x12d5c000000006b736f667469727164000000....ksoftirqd...
0x12d6c6b737761706400006b776f726b657200kswapd..kworker.
0x12d7c0000000010012cf410012d0c10012cfc......,...-...,.
⋯7 more rows